Verify agent evidence in 5 steps
All you need is a browser and the evidence, such as a mandate, an evidence pack or a signed request. Verification takes a few minutes and runs entirely on your device.
Leutrim Miftaraj, Founder, Innopulse Consulting GmbH
Published
Key points
- All you need is a browser and the evidence; verification runs locally.
- KYA detects the format itself, from SD-JWT VC to signed HTTP requests.
- As the verifying party, you provide keys, status lists and timestamp anchors yourself.
- The JSON certificate can be recomputed at any time with the same data.
Open the verification page
Open the verification page. The page loads its files once; verification itself makes no network requests, and evidence never leaves your device. You do not need an account.
If you first want to see what a result looks like, choose an entry under “Examples”, such as “Complete pack”. The examples use real signatures from the public test vectors and the IETF standard RFC 9421.
Paste the evidence
Paste the evidence into the input field for tokens, evidence packs, receipt chains or timestamps. KYA detects the format itself: SD-JWT VC, JWS, an evidence pack in the kya-pack/1 format, a receipt chain, Verifiable Intent or a signed HTTP request.
Load binary timestamps following RFC 3161 through the file button or drag the file into the field. The clear button resets the input.
Provide the verifying party's trust
Open the advanced section for keys, status lists and timestamp anchors. This is where you define whom you trust as the verifying party:
- Trusted keys (JWK or JWKS): the issuers' public keys, ideally from their published JWKS.
- Status lists (token): current status lists so that revocation can be checked.
- Timestamp anchors (PEM certificate): the certificate of the timestamp authority or its root.
Without these details, KYA still verifies but reports that origin, revocation or point in time are not proven.
Verify and read the verdict
Click “Verify”. The certificate shows the verdict: valid if everything essential is proven, invalid if something is disproven, and indeterminate if nothing is disproven but not everything is proven.
It also shows a level from KYA-A0 to KYA-A4 and the status of each of the ten checks with reasons. This shows exactly what is missing, such as a status list or a timestamp anchor.
Keep the certificate
Download the result as a JSON certificate and keep it together with the transaction. The certificate contains a reportDigest, a hash over the result.
Verification is reproducible: same input, same options, same result. Third parties can therefore recompute the certificate later with the same data, in the browser or with the engine as a package.
Frequently asked questions
Is my evidence transmitted?
No. Verification runs entirely in the browser; the page's content security policy forbids network requests from the verification.
Why is my result indeterminate?
Because nothing is disproven, but not everything essential is proven. The certificate names what is missing, such as an issuer key, a status list or a timestamp anchor.
Can I verify many pieces of evidence automatically?
Yes. The engine is available as a package with the kya-verify command line and can be integrated into pipelines.
Can I verify without internet access?
Yes, once the verification page has loaded. Verification itself makes no network requests; you provide keys, status lists and anchors in advance. For many verifications, the engine as a package in your own environment is also suitable.
What do I do with an invalid result?
Do not accept the action. The certificate shows which step is disproven.
Sources
- KYA-Prüfprofil: https://knowyouragent.ch/standard/pruefprofil