Questions on technology and formats in KYA
This page answers common technical questions about verification with KYA: which formats are supported, how verification runs locally and how results can be reproduced.
Leutrim Miftaraj, Founder, Innopulse Consulting GmbH
Published
What this is about
KYA verifies evidence about actions of AI agents according to an open verification profile. The verification guide explains it step by step; details for integration are in the developer section.
Questions and answers
Which formats does KYA verify?
SD-JWT VC, JWS, evidence packs in the kya-pack/1 format, receipt chains in the kya-chain/1 format, status lists following IETF Token Status List, timestamps following RFC 3161, Mastercard Verifiable Intent and signed HTTP requests following RFC 9421 and Web Bot Auth.
Is my data transmitted?
No. Verification runs entirely in the browser. The page's content security policy forbids network requests from the verification, and there is neither an account nor tracking.
What do valid, invalid and indeterminate mean?
Valid means everything essential is proven. Invalid means something is disproven, for example by a wrong signature. Indeterminate means nothing is disproven, but not everything essential is proven.
What do the levels KYA-A0 to KYA-A4 mean?
They show how much is proven: from mere readability through integrity, identity and authority up to an independently anchored point in time at level KYA-A4.
Where do the keys for verification come from?
From the verifying party. It provides the issuers' public keys, for example from their JWKS. Keys merely embedded in the evidence are reported by KYA as self-asserted.
How does KYA check revocation?
Through status lists following IETF Token Status List, which the verifying party provides under “Status lists (token)”. Without a status list, revocation remains unchecked, and the verdict does not become valid.
How does KYA verify a timestamp?
KYA verifies the timestamp's CMS signature following RFC 3161, its purpose, the binding to the content and the path to the timestamp anchor provided.
Can I integrate KYA into my software?
Yes. The engine @knowyouragent/verify-core is a TypeScript package without dependencies under Apache 2.0, installable from knowyouragent.ch, with the kya-verify command line.
Are there test vectors?
Yes. 62 public test vectors with real signatures and timestamps are available under Apache 2.0, including vectors from the Mastercard Verifiable Intent and Cloudflare Web Bot Auth reference implementations.
Which browsers are supported?
Current versions of Chromium-based browsers, Firefox and Safari. If a browser lacks an algorithm such as Ed25519, KYA reports the step as not checked, never as invalid.
Is the result reproducible?
Yes. Same input, same options and same verification time produce the same result with the same reportDigest, in the browser as well as in the package.
Are there JSON schemas for the formats?
Yes. JSON schemas following Draft 2020-12 are available for download for verification reports, evidence packs and receipt chains.
Which command line is available?
The package includes the kya-verify command line. It verifies files with the same results as the browser and returns exit codes for valid, invalid and indeterminate.
How large is the engine?
The engine is a TypeScript package without dependencies and uses only WebCrypto. It runs in Node.js from version 20, in current browsers and in edge environments.
How do I verify a signed HTTP request?
Paste request line, headers, empty line and content into the input field and provide the public key as a JWKS. KYA rebuilds the signature base following RFC 9421. The HTTP signature guide shows this with the official IETF example.
Are results stored?
No. KYA stores neither evidence nor results. You keep the certificate yourself if needed.
Sources
- KYA-Prüfprofil: https://knowyouragent.ch/standard/pruefprofil
- Testvektoren (JSON): https://knowyouragent.ch/vectors/vectors.json