---
title: "Error reference: Cryptographic integrity | KYA"
url: https://knowyouragent.ch/en/method/errors/cryptographic-integrity
lang: en
updated: 2026-10-12
license: © Innopulse Consulting GmbH
---

# Error reference: Cryptographic integrity

Are signatures, disclosures, hash chains and manifest unchanged?

This check recomputes all signatures and hash values: the signature of a JWS, the digests of disclosures, the key binding JWT, the chaining of a receipt chain, the manifest of an evidence pack and the signature of a timestamp. It answers whether the evidence is unchanged and matches its key.

A code in this check almost always means that something was altered or does not fit together. The verdict is then invalid.

## `signature_invalid`

**The signature does not match the content.**

**Cause:** The signature does not match content and key. Causes are content altered afterwards, a wrong key or, for HTTP signatures, a deviating signature base.

**Fix:** Use the original evidence. Check whether the key ID matches the key provided; for HTTP signatures, compare the signature base with the RFC 9421 signature base tool.

## `no_key`

**No key available. Add the issuer's key under “Trust of the verifying party”.**

**Cause:** No matching key was found for the signature: neither provided, nor embedded, nor through a resolvable DID.

**Fix:** Provide the issuer's public key under “Trust of the verifying party”, ideally from its published JWKS, and make sure the key ID matches.

## `unsupported_alg`

**The signature algorithm is not available in this environment. Update your browser (Chrome or Edge 137+, Firefox 129+, Safari 17+).**

**Cause:** The signature algorithm is not supported, for example because it is insecure, requires a shared key or is missing in the browser.

**Fix:** Sign with a supported algorithm such as ES256, EdDSA with Ed25519 or RSA-PSS. If a browser merely lacks Ed25519, KYA reports the check as not checked, never as invalid.

## `disclosure_digest_mismatch`

**A disclosure does not match its hash.**

**Cause:** The computed digest of a disclosure does not match the expected value, because the disclosure was altered or created with a different hash algorithm.

**Fix:** Take over disclosures character for character without re-encoding, and observe the algorithm in _sd_alg. The SD-JWT decoder shows the computed digest of every disclosure.

## `disclosure_unreferenced`

**A disclosure is not referenced in the signed content.**

**Cause:** A disclosure does not belong to this token: its digest appears nowhere in the signed part.

**Fix:** Present only the disclosures that belong to the token. The SD-JWT decoder shows for every disclosure whether its digest is referenced in the token.

## `disclosure_duplicate`

**A disclosure appears twice.**

**Cause:** The same disclosure or digest occurs more than once. SD-JWT does not allow this, because it can indicate a manipulated presentation.

**Fix:** Present each disclosure exactly once. Check the software that assembles the presentation.

## `kb_jwt_invalid`

**The key binding JWT is invalid: the presenter does not demonstrably hold the bound key.**

**Cause:** The key binding JWT is invalid: the signature does not match the key in the credential, the sd_hash does not match the presentation, or recipient and time do not fit.

**Fix:** Create the key binding JWT anew after assembling the disclosures, with the agent's private key and the sd_hash over exactly the presented form.

## `chain_hash_mismatch`

**A receipt was changed after it was chained.**

**Cause:** The hash of an entry in the receipt chain does not match: the entry was altered after being written.

**Fix:** Use the original chain and investigate who changed the entry. A correction belongs at the end of the chain as a new entry, never as a change.

## `chain_link_broken`

**The receipt chain has a gap or a wrong order.**

**Cause:** An entry does not point to the hash of its predecessor. The chain has a gap or the order is wrong.

**Fix:** Present the complete chain in its original order. Missing entries cannot be inserted afterwards without breaking the chain.

## `binding_mismatch`

**A layer is not bound to the previous one: the hash binding does not match.**

**Cause:** Two parts that should belong together do not match, such as layers of Verifiable Intent or a part of an evidence pack and its reference.

**Fix:** Use parts that were created together. Do not mix layers or parts from different transactions.

## `manifest_mismatch`

**The pack content does not match the manifest.**

**Cause:** The manifest of an evidence pack does not match its parts: a part was altered, added or removed.

**Fix:** Export the pack again from the system that keeps mandate, decision and receipts, and do not change any parts afterwards.

## `no_crypto_material`

**The evidence contains no cryptographic material.**

**Cause:** The evidence contains nothing that could be verified cryptographically, such as unsigned JSON.

**Fix:** Present signed evidence. Unsigned details can be informative but prove nothing.

## `tsa_signature_invalid`

**The timestamp signature is invalid.**

**Cause:** The timestamp authority's signature over the timestamp is invalid. The timestamp was altered or damaged.

**Fix:** Use the original timestamp file or request a new timestamp. The timestamp inspector shows whether the file is readable.

[Error reference](https://knowyouragent.ch/en/method/errors) · [Checks](https://knowyouragent.ch/en/method/checks)

---
Quelle: https://knowyouragent.ch/en/method/errors/cryptographic-integrity · KYA – Know Your Agent