You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Aca-Py does some pre-validation when verifying Anoncreds presentations (proofs), some scenarios are rejected (things that are indicative of tampering, for example) and some attributes are removed before running the anoncreds validation (for example removing superfluous non-revocation timestamps). Any Aca-Py validations or presentation modifications are indicated by the "verify_msgs" attribute in the final presentation exchange object
4
+
5
+
The list of possible verification messages is [here](https://github.com/hyperledger/aries-cloudagent-python/blob/main/aries_cloudagent/indy/verifier.py#L24), and consists of:
6
+
7
+
```
8
+
class PresVerifyMsg(str, Enum):
9
+
"""Credential verification codes."""
10
+
11
+
RMV_REFERENT_NON_REVOC_INTERVAL = "RMV_RFNT_NRI"
12
+
RMV_GLOBAL_NON_REVOC_INTERVAL = "RMV_GLB_NRI"
13
+
TSTMP_OUT_NON_REVOC_INTRVAL = "TS_OUT_NRI"
14
+
CT_UNREVEALED_ATTRIBUTES = "UNRVL_ATTR"
15
+
PRES_VALUE_ERROR = "VALUE_ERROR"
16
+
PRES_VERIFY_ERROR = "VERIFY_ERROR"
17
+
```
18
+
19
+
If there is additional information, it will be included like this: `TS_OUT_NRI::19_uuid` (which means the attribute identified by `19_uuid` contained a timestamp outside of the non-revocation interval (which is just a warning)).
20
+
21
+
A presentation verification may include multiple messages, for example:
22
+
23
+
```
24
+
...
25
+
"verified": "true",
26
+
"verified_msgs": [
27
+
"TS_OUT_NRI::18_uuid",
28
+
"TS_OUT_NRI::18_id_GE_uuid",
29
+
"TS_OUT_NRI::18_busid_GE_uuid"
30
+
],
31
+
...
32
+
```
33
+
34
+
... or it may include a single message, for example:
35
+
36
+
```
37
+
...
38
+
"verified": "false",
39
+
"verified_msgs": [
40
+
"VALUE_ERROR::Encoded representation mismatch for 'Preferred Name'"
41
+
],
42
+
...
43
+
```
44
+
45
+
... or the `verified_msgs` may be null or an empty array.
46
+
47
+
## Presentation Modifications and Warnings
48
+
49
+
The following modifications/warnings may be done by Aca-Py which shouldn't affect the verification of the received proof):
50
+
51
+
- "RMV_RFNT_NRI": Referent contains a non-revocation interval for a non-revocable credential (timestamp is removed)
52
+
- "RMV_GLB_NRI": Presentation contains a global interval for a non-revocable credential (timestamp is removed)
53
+
- "TS_OUT_NRI": Presentation contains a non-revocation timestamp outside of the requested non-revocation interval (warning)
54
+
- "UNRVL_ATTR": Presentation contains attributes with unrevealed values (warning)
55
+
56
+
## Presentation Pre-validation Errors
57
+
58
+
The following pre-verification checks are done, which will fail the proof (before calling anoncreds) and will result in the following message:
59
+
60
+
```
61
+
VALUE_ERROR::<description of the failed validation>
62
+
```
63
+
64
+
These validations are all done within the [Indy verifier class](https://github.com/hyperledger/aries-cloudagent-python/blob/main/aries_cloudagent/indy/verifier.py) - to see the detailed validation just look for anywhere a `raise ValueError(...)` appears in the code.
65
+
66
+
A summary of the possible errors is:
67
+
68
+
- information missing in presentation exchange record
69
+
- timestamp provided for irrevocable credential
70
+
- referenced revocation registry not found on ledger
71
+
- timestamp outside of reasonable range (future date or pre-dates revocation registry)
72
+
- mis-match between provided and requested timestamps for non-revocation
73
+
- mis-match between requested and provided attributes or predicates
74
+
- self-attested attribute is provided for a requested attribute with restrictions
75
+
- encoded value doesn't match raw value
76
+
77
+
## Anoncreds Verification Exceptions
78
+
79
+
Typically when you call the anoncreds `verifier_verify_proof()` method, it will return a `True` or `False` based on whether the presentation cryptographically verifies. However in the case where anoncreds throws an exception, the exception text will be included in a verification message as follows:
0 commit comments