Error reference: Cryptographic integrity
Are signatures, disclosures, hash chains and manifest unchanged?
This check recomputes all signatures and hash values: the signature of a JWS, the digests of disclosures, the key binding JWT, the chaining of a receipt chain, the manifest of an evidence pack and the signature of a timestamp. It answers whether the evidence is unchanged and matches its key.
A code in this check almost always means that something was altered or does not fit together. The verdict is then invalid.
signature_invalid
The signature does not match the content.
Cause: The signature does not match content and key. Causes are content altered afterwards, a wrong key or, for HTTP signatures, a deviating signature base.
Fix: Use the original evidence. Check whether the key ID matches the key provided; for HTTP signatures, compare the signature base with the RFC 9421 signature base tool.
no_key
No key available. Add the issuer's key under “Trust of the verifying party”.
Cause: No matching key was found for the signature: neither provided, nor embedded, nor through a resolvable DID.
Fix: Provide the issuer's public key under “Trust of the verifying party”, ideally from its published JWKS, and make sure the key ID matches.
unsupported_alg
The signature algorithm is not available in this environment. Update your browser (Chrome or Edge 137+, Firefox 129+, Safari 17+).
Cause: The signature algorithm is not supported, for example because it is insecure, requires a shared key or is missing in the browser.
Fix: Sign with a supported algorithm such as ES256, EdDSA with Ed25519 or RSA-PSS. If a browser merely lacks Ed25519, KYA reports the check as not checked, never as invalid.
disclosure_digest_mismatch
A disclosure does not match its hash.
Cause: The computed digest of a disclosure does not match the expected value, because the disclosure was altered or created with a different hash algorithm.
Fix: Take over disclosures character for character without re-encoding, and observe the algorithm in _sd_alg. The SD-JWT decoder shows the computed digest of every disclosure.
disclosure_unreferenced
A disclosure is not referenced in the signed content.
Cause: A disclosure does not belong to this token: its digest appears nowhere in the signed part.
Fix: Present only the disclosures that belong to the token. The SD-JWT decoder shows for every disclosure whether its digest is referenced in the token.
disclosure_duplicate
A disclosure appears twice.
Cause: The same disclosure or digest occurs more than once. SD-JWT does not allow this, because it can indicate a manipulated presentation.
Fix: Present each disclosure exactly once. Check the software that assembles the presentation.
kb_jwt_invalid
The key binding JWT is invalid: the presenter does not demonstrably hold the bound key.
Cause: The key binding JWT is invalid: the signature does not match the key in the credential, the sd_hash does not match the presentation, or recipient and time do not fit.
Fix: Create the key binding JWT anew after assembling the disclosures, with the agent's private key and the sd_hash over exactly the presented form.
chain_hash_mismatch
A receipt was changed after it was chained.
Cause: The hash of an entry in the receipt chain does not match: the entry was altered after being written.
Fix: Use the original chain and investigate who changed the entry. A correction belongs at the end of the chain as a new entry, never as a change.
chain_link_broken
The receipt chain has a gap or a wrong order.
Cause: An entry does not point to the hash of its predecessor. The chain has a gap or the order is wrong.
Fix: Present the complete chain in its original order. Missing entries cannot be inserted afterwards without breaking the chain.
binding_mismatch
A layer is not bound to the previous one: the hash binding does not match.
Cause: Two parts that should belong together do not match, such as layers of Verifiable Intent or a part of an evidence pack and its reference.
Fix: Use parts that were created together. Do not mix layers or parts from different transactions.
manifest_mismatch
The pack content does not match the manifest.
Cause: The manifest of an evidence pack does not match its parts: a part was altered, added or removed.
Fix: Export the pack again from the system that keeps mandate, decision and receipts, and do not change any parts afterwards.
no_crypto_material
The evidence contains no cryptographic material.
Cause: The evidence contains nothing that could be verified cryptographically, such as unsigned JSON.
Fix: Present signed evidence. Unsigned details can be informative but prove nothing.
tsa_signature_invalid
The timestamp signature is invalid.
Cause: The timestamp authority's signature over the timestamp is invalid. The timestamp was altered or damaged.
Fix: Use the original timestamp file or request a new timestamp. The timestamp inspector shows whether the file is readable.