Verify API returning valid for a tampered verifiable credential

[rukshanfonseka]

I generated a VC using the SSIKI see below:

{ "type" : [ "VerifiableCredential" ], "@context" : [ "https://www.w3.org/2018/credentials/v1", "https://w3id.org/security/suites/jws-2020/v1" ], "id" : "urn:uuid:060ff114-5d8c-4e31-992a-31cbdb597822", "issuer" : "did:jwk:eyJrdHkiOiJSU0EiLCJlIjoiQVFBQiIsInVzZSI6InNpZyIsImtpZCI6IjI5OWU5ZTQ0Y2I5ZjQ4MWU5NDMzNTlkYzk1MWI2MGQ1IiwiYWxnIjoiUlMyNTYiLCJuIjoiczk1NWJ1SWJueHBkeldBRlVnUmdESG82UGZaY2c0WmF4MXMwbGZZaW9YTjhvaDBqUFhyTWdaVTJqNUtibnNST2VpSG0wWm1LUGlHV3NBX19ZQ19NaDBieExnN1JtTnFScDB5Z3BmMWN3VTFDSTBqcVI0MlUtd0NLZnNRbmxncG4zaDRCTnpFTkUtYkd1RVdqWWxScnIyMEZMTDA4bVd2b0NEb254MzJxdWR6MmhaZUlBaWpVaUxNNkZ4S3dtTm83ZmJQeXAzN2JnWTVaNXRjSDBkdFNjSGtYcDF1Q2VnWDZrZWI3cVQ5N2FsUHFKdWdIeWQyQTZjZUdTOUNPVkNvZkg2MGlZYXJRZjhBa3RhNXVpTEZERW15cWFHeXpySmxiNmZXQ1RVb0M4cXFHZ29ta0dMdGVBSExJMnZ2aDQyNUZzYzRHZjJLMDRqbW5OeE4zVFJWZmZuUDN2S2ZheGJPcXJ6ajd2S0ZrLTk3X0NlVXhXT2Jmc2lLeHMwQVpfYnozUzJ4eTRBeEhlRzNudVc3a2JYeFFGSl9BbHdVNmJsb1NTTElfendHNkVUME13LThRdDVZWExMdmZrN24yN09DVnZLRmpnd3pqVTQ4UnFvWmFlb1BzcW4tY2JEa1k4SGZOUnhOdnRQOXlNcTcxZTVROFpYTjQzc0tKMEQxSHcwdXIifQ", "issuanceDate" : "2023-06-28T01:45:16Z", "issued" : "2023-06-28T01:45:16Z", "validFrom" : "2023-06-28T01:45:16Z", "credentialSubject" : { "id" : "did:jwk:eyJrdHkiOiJSU0EiLCJlIjoiQVFBQiIsInVzZSI6InNpZyIsImtpZCI6IjA0ZGRmZjY2YWFiNjQzMTg5ZGVlMTAwNjdiNWRhYTU4IiwiYWxnIjoiUlMyNTYiLCJuIjoia0duYzltX1ByNlRxdUI5UmZ2YkowQVBSYlJEV3oxNkFqZjg5ajJic21pTmpScHRBeUEyYXFDeEd5eUhjakZwTnJ2Y0Y0RTNMTkh1cFM1Tk9EM3FFQ3VNdWVGSWtJLXFleUZBLVJSeWxOVnRKdVJVVV9IMHFtYkFZUGEyNnhjWG1OZFltNy0yZnFVd3NvVGFWOUVpdG9fM3RjVmRDalF2dWRMVUxfSVJGT0JLTFVpSnRMZjRzSjM3TjJ4X2kzQ3dSZ3dDUm11aEowUzhiclhKeWE5SHVUcW85SjQwX2wwdXBOSjRtck04dDE4dXNFUU9kTDY5c0FMeDdaUWF0X2RURW9mWFUxTXVkQXdRUzFpTlhhQkw2TElndkkyS3MxXzF4bmllRlV4N2poakxqQ2prVjlkdXRPNWVicjgyREJQOTFNV2YzcUUtMDIxbXJUZkpmbE5aRm9jOFY5SkJKSm9BOXgySDg1NWs3ejUxMzRWTk80R19tV2hRcHBnRmdidjZaakZHb3NvQVQ1SGI3c0dpc2RxaW5RZ215RGN4a2ZPWlpXeGdzN21NNmFCYzZIM2FXMmoydkhIUzA1ZkE0eVRWS242TEFlNC12V3dFbUtQY0dxVU1GYTM4dHpIRms2MVByNUtzNkVxN2dsamxwZldtWHZkUEhCNDc0TkJiM1hhdVIifQ", "name" : "John Doe", "age" : 30 }, "proof" : { "type" : "JsonWebSignature2020", "creator" : "did:jwk:eyJrdHkiOiJSU0EiLCJlIjoiQVFBQiIsInVzZSI6InNpZyIsImtpZCI6IjI5OWU5ZTQ0Y2I5ZjQ4MWU5NDMzNTlkYzk1MWI2MGQ1IiwiYWxnIjoiUlMyNTYiLCJuIjoiczk1NWJ1SWJueHBkeldBRlVnUmdESG82UGZaY2c0WmF4MXMwbGZZaW9YTjhvaDBqUFhyTWdaVTJqNUtibnNST2VpSG0wWm1LUGlHV3NBX19ZQ19NaDBieExnN1JtTnFScDB5Z3BmMWN3VTFDSTBqcVI0MlUtd0NLZnNRbmxncG4zaDRCTnpFTkUtYkd1RVdqWWxScnIyMEZMTDA4bVd2b0NEb254MzJxdWR6MmhaZUlBaWpVaUxNNkZ4S3dtTm83ZmJQeXAzN2JnWTVaNXRjSDBkdFNjSGtYcDF1Q2VnWDZrZWI3cVQ5N2FsUHFKdWdIeWQyQTZjZUdTOUNPVkNvZkg2MGlZYXJRZjhBa3RhNXVpTEZERW15cWFHeXpySmxiNmZXQ1RVb0M4cXFHZ29ta0dMdGVBSExJMnZ2aDQyNUZzYzRHZjJLMDRqbW5OeE4zVFJWZmZuUDN2S2ZheGJPcXJ6ajd2S0ZrLTk3X0NlVXhXT2Jmc2lLeHMwQVpfYnozUzJ4eTRBeEhlRzNudVc3a2JYeFFGSl9BbHdVNmJsb1NTTElfendHNkVUME13LThRdDVZWExMdmZrN24yN09DVnZLRmpnd3pqVTQ4UnFvWmFlb1BzcW4tY2JEa1k4SGZOUnhOdnRQOXlNcTcxZTVROFpYTjQzc0tKMEQxSHcwdXIifQ", "created" : "2023-06-28T01:45:16Z", "proofPurpose" : "assertionMethod", "verificationMethod" : "did:jwk:eyJrdHkiOiJSU0EiLCJlIjoiQVFBQiIsInVzZSI6InNpZyIsImtpZCI6IjI5OWU5ZTQ0Y2I5ZjQ4MWU5NDMzNTlkYzk1MWI2MGQ1IiwiYWxnIjoiUlMyNTYiLCJuIjoiczk1NWJ1SWJueHBkeldBRlVnUmdESG82UGZaY2c0WmF4MXMwbGZZaW9YTjhvaDBqUFhyTWdaVTJqNUtibnNST2VpSG0wWm1LUGlHV3NBX19ZQ19NaDBieExnN1JtTnFScDB5Z3BmMWN3VTFDSTBqcVI0MlUtd0NLZnNRbmxncG4zaDRCTnpFTkUtYkd1RVdqWWxScnIyMEZMTDA4bVd2b0NEb254MzJxdWR6MmhaZUlBaWpVaUxNNkZ4S3dtTm83ZmJQeXAzN2JnWTVaNXRjSDBkdFNjSGtYcDF1Q2VnWDZrZWI3cVQ5N2FsUHFKdWdIeWQyQTZjZUdTOUNPVkNvZkg2MGlZYXJRZjhBa3RhNXVpTEZERW15cWFHeXpySmxiNmZXQ1RVb0M4cXFHZ29ta0dMdGVBSExJMnZ2aDQyNUZzYzRHZjJLMDRqbW5OeE4zVFJWZmZuUDN2S2ZheGJPcXJ6ajd2S0ZrLTk3X0NlVXhXT2Jmc2lLeHMwQVpfYnozUzJ4eTRBeEhlRzNudVc3a2JYeFFGSl9BbHdVNmJsb1NTTElfendHNkVUME13LThRdDVZWExMdmZrN24yN09DVnZLRmpnd3pqVTQ4UnFvWmFlb1BzcW4tY2JEa1k4SGZOUnhOdnRQOXlNcTcxZTVROFpYTjQzc0tKMEQxSHcwdXIifQ#0", "jws" : "eyJiNjQiOmZhbHNlLCJjcml0IjpbImI2NCJdLCJhbGciOiJQUzI1NiJ9..b3ZZl9j2XgzzqcVD7bGHEQL-6onzm7Bl8ewinzVD2dW2yRFB9LXYfv4Qb9ixTUjCFo_gO6qd-dDFgHhWSlw7ZwCpelAUpnd4idxAlg2DsWMMGB6NebVGFciKVEHaLUcy2AA5IbIgwzrciwL0YhN3wDVvAvpeIpzXDjMxk4rmZ3l4nSfZ1UqSKbublECRbmQePlzfbKnOZik1D3k1fZ0NbQeyKUeeu6de9E5ZcUw8opHWFoUwr1-v5KBmORiwIp_mGzHt8x2iUmnOwVeahohkVDHg6X5uPAUmHBKspxsfeaE-DWkHelt_Qrt143Rsu8ebhdMY3RHzpK-0pjZifZMeFfYFNtvD7pqgFeNRcZEDDHyGURINGCzwGpDdXSz5wchdrzKY5s2jBv6-PUVSZ9pNqRpoT54XtsshZkIe0NoL_14eQWtwBd1qpTIxJg4Geq8toFm-QH6qSyCXlj0JImyz37vxomFScd2c3S_HCdXP8e4DbLL_C-hondl3ssqaAxvp" } }

I used v1/verify and I get:
{ "valid": true, "results": [ { "result": true, "policyResults": { "SignaturePolicy": { "isSuccess": true } }, "valid": true } ] }

I went and changed the age in the VC but I always get valid. What am I doing wrong?

[waltkb]

"@context" : [ "https://www.w3.org/2018/credentials/v1", "https://w3id.org/security/suites/jws-2020/v1" ]

Hi, your context is just for the base credential (https://www.w3.org/2018/credentials/v1) and the proof attribute (https://w3id.org/security/suites/jws-2020/v1), you have to specify a @context that includes the required attributes of the credentialSubject. Right now, credentialSubject is not being used for the signature.

You can also use the JWT signature format instead of LD-Signature. This signature format works on the whole JSON of the credential.