Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add sd-jwt vc profile to vci #128

Merged
merged 20 commits into from
Dec 21, 2023
Merged

add sd-jwt vc profile to vci #128

Show file tree
Hide file tree
Changes from 16 commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
907df86
add sd-jwt vc profile to vci
Dec 7, 2023
5445eed
Apply suggestions from code review
Sakurann Dec 7, 2023
2f7293d
fixing a jwt example
Sakurann Dec 7, 2023
7edba46
remove client metadata and add credential metadata
Dec 7, 2023
ab1e2d2
Merge branch 'sd-jwt-vc' of https://github.com/openid/OpenID4VCI into…
Dec 7, 2023
a08908e
Apply suggestions from code review
Sakurann Dec 11, 2023
a4f63a7
restructure issuer metadata
Dec 11, 2023
c33b9c5
Replace "JSON String" with just "String" etc.
jogu Dec 13, 2023
cdd3ffe
change to correct jwt string
Sakurann Dec 13, 2023
d6abcb6
Merge branch 'main' of https://github.com/openid/OpenID4VCI into sd-j…
Dec 13, 2023
79e7c2f
remove credential_definition
Dec 14, 2023
ff79ac5
align vct values
Sakurann Dec 14, 2023
b678b63
update requirements
Dec 14, 2023
c62c29b
Merge branch 'sd-jwt-vc' of https://github.com/openid/OpenID4VCI into…
Dec 14, 2023
6d61d61
Update examples/credential_metadata_sd_jwt_vc.json
bc-pi Dec 14, 2023
9d7fdd8
Update openid-4-verifiable-credential-issuance-1_0.md
tlodderstedt Dec 18, 2023
b0b5d5f
Merge branch 'main' of https://github.com/openid/OpenID4VCI into sd-j…
Dec 21, 2023
79dfddc
clarify when the type must be present
Dec 21, 2023
a2dd7d0
make sure proof jwt is well-formed (issue 134)
Dec 21, 2023
f8b0d45
Apply suggestions from torsten's code review
Sakurann Dec 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions examples/authorization_details_sd_jwt_vc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
[
{
"type": "openid_credential",
"format": "vc+sd-jwt",
"vct": "SD_JWT_VC_example_in_OpenID4VCI"
}
]
61 changes: 61 additions & 0 deletions examples/credential_metadata_sd_jwt_vc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
{
"credentials_supported": {
"SD_JWT_VC_example_in_OpenID4VCI": {
"format": "vc+sd-jwt",
"scope": "SD_JWT_VC_example_in_OpenID4VCI",
"cryptographic_binding_methods_supported": [
"jwk"
],
"cryptographic_suites_supported": [
"ES256"
],
"display": [
{
"name": "IdentityCredential",
"locale": "en-US",
"background_color": "#12107c",
"text_color": "#FFFFFF"
}
],
"vct": "SD_JWT_VC_example_in_OpenID4VCI",
"claims": {
"given_name": {
"display": [
{
"name": "Given Name",
"locale": "en-US"
},
{
"name": "Vorname",
"locale": "de-DE"
}
]
},
"last_name": {
"display": [
{
"name": "Surname",
"locale": "en-US"
},
{
"name": "Nachname",
"locale": "de-DE"
}
]
},
"email": {},
"phone_number": {},
"address": {
"street_address": {},
"locality": {},
"region": {},
"country": {}
},
"birthdate": {},
"is_over_18": {},
"is_over_21": {},
"is_over_65": {}
}
}
}
}
11 changes: 11 additions & 0 deletions examples/credential_offer_sd_jwt_vc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{
"credential_issuer": "https://credential-issuer.example.com",
"credentials": [
"SD_JWT_VC_example_in_OpenID4VCI"
],
"grants": {
"authorization_code": {
"issuer_state": "eyJhbGciOiJSU0Et...FYUaBy"
}
}
}
8 changes: 8 additions & 0 deletions examples/credential_request_sd_jwt_vc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{
"format": "vc+sd-jwt",
"vct": "SD_JWT_VC_example_in_OpenID4VCI",
"proof": {
"proof_type": "jwt",
"jwt":"eyJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiblVXQW9BdjNYWml0aDhFN2kxOU9kYXhPTFlGT3dNLVoyRXVNMDJUaXJUNCIsInkiOiJIc2tIVThCalVpMVU5WHFpN1N3bWo4Z3dBS18weGtjRGpFV183MVNvc0VZIn19.eyJhdWQiOiJodHRwczovL2NyZWRlbnRpYWwtaXNzdWVyLmV4YW1wbGUuY29tIiwiaWF0IjoxNzAxOTYwNDQ0LCJub25jZSI6IkxhclJHU2JtVVBZdFJZTzZCUTR5bjgifQ.-a3EDsxClUB4O3LeDD5DVGEnNMT01FCQW4P6-2-BNBqc_Zxf0Qw4CWayLEpqkAomlkLb9zioZoipdP-jvh1WlA"
}
}
58 changes: 55 additions & 3 deletions openid-4-verifiable-credential-issuance-1_0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1850,7 +1850,7 @@ The following is a non-normative example of an authorization details object with

The following additional parameters are defined for Credential Requests and this Credential format.

* `credential_definition`: REQUIRED. Object containing the detailed description of the Credential type. It consists at least of the following sub claims:
* `credential_definition`: REQUIRED when the `credential_identifier` is not used. Object containing the detailed description of the Credential type. It consists at least of the following sub claims:
* `type`: REQUIRED. Array as defined in (#server_metadata_jwt_vc_json). The credential issued by the Credential Issuer MUST at least contain the values listed in this claim.
* `credentialSubject`: OPTIONAL. An object as defined in (#authorization_jwt_vc_json).

Expand Down Expand Up @@ -1916,7 +1916,7 @@ The following is a non-normative example of an authorization details object with

The following additional parameters are defined for Credential Requests and this Credential format.

* `credential_definition`: REQUIRED. Object containing the detailed description of the Credential type. It consists at least of the following sub claims:
* `credential_definition`: REQUIRED when the `credential_identifier` is not used. Object containing the detailed description of the Credential type. It consists at least of the following sub claims:
* `@context`: REQUIRED. Array as defined in (#server_metadata_ldp_vc).
* `type`: REQUIRED. Array as defined in (#server_metadata_ldp_vc). The Credential issued by the Credential Issuer MUST at least contain the values listed in this claim.
* `credentialSubject`: OPTIONAL. An object as defined in (#authorization_ldp_vc).
Expand Down Expand Up @@ -2003,7 +2003,7 @@ The following is a non-normative example of an authorization details object with

The following additional parameters are defined for Credential Requests and this Credential format.

* `doctype`: REQUIRED. String as defined in (#server_metadata_mso_mdoc). The Credential issued by the Credential Issuer MUST at least contain the values listed in this claim.
* `doctype`: REQUIRED when the `credential_identifier` is not used. String as defined in (#server_metadata_mso_mdoc). The Credential issued by the Credential Issuer MUST at least contain the values listed in this claim.
* `claims`: OPTIONAL. An object as defined in (#server_metadata_mso_mdoc).

The following is a non-normative example of a Credential Request with Credential format `mso_mdoc`:
Expand All @@ -2014,6 +2014,58 @@ The following is a non-normative example of a Credential Request with Credential

The value of the `credential` claim in the Credential Response MUST be a string that is the base64url-encoded representation of the issued Credential.

## IETF SD-JWT VC
Sakurann marked this conversation as resolved.
Show resolved Hide resolved

Sakurann marked this conversation as resolved.
Show resolved Hide resolved
This section defines a Credential Format Profile for Credentials complying with [@!I-D.ietf-oauth-sd-jwt-vc].

### Format Identifier

The Credential format identifier is `vc+sd-jwt`.

### Credential Issuer Metadata {#server_metadata_sd_jwt_vc}

Sakurann marked this conversation as resolved.
Show resolved Hide resolved
The following additional Credential Issuer metadata parameters are defined for this Credential format to be added to the `credentials_supported` parameter in addition to those defined in (#credential-issuer-parameters).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will conflict with with the credential_configurations_supported change.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

how?



* `vct`: REQUIRED. String designating the type of a Credential as defined in [@!I-D.ietf-oauth-sd-jwt-vc].
* `claims`: OPTIONAL. Object containing a list of name/value pairs, where each name identifies a claim about the subject offered in the Credential. The value can be another such object (nested data structures), or an array of such objects. To express the specifics about the claim, the most deeply nested value MAY be an object that includes a following non-exhaustive list of parameters defined by this specification:
* `mandatory`: OPTIONAL. Boolean which when set to `true` indicates the claim MUST be present in the issued Credential. If the `mandatory` property is omitted its default should be assumed to be `false`.
* `value_type`: OPTIONAL. String value determining type of value of the claim. A non-exhaustive list of valid values defined by this specification are `string`, `number`, and image media types such as `image/jpeg` as defined in IANA media type registry for images (https://www.iana.org/assignments/media-types/media-types.xhtml#image).
* `display`: OPTIONAL. Array of objects, where each object contains display properties of a certain claim in the Credential for a certain language. Below is a non-exhaustive list of valid parameters that MAY be included:
* `name`: OPTIONAL. String value of a display name for the claim.
* `locale`: OPTIONAL. String value that identifies language of this object represented as language tag values defined in BCP47 [@!RFC5646]. There MUST be only one object for each language identifier.
* `order`: OPTIONAL. An array of the claim name values that lists them in the order they should be displayed by the Wallet.

The following is a non-normative example of an object comprising `credentials_supported` parameter of Credential format `vc+sd-jwt`.
Sakurann marked this conversation as resolved.
Show resolved Hide resolved

<{{examples/credential_metadata_sd_jwt_vc.json}}

### Authorization Details {#authorization_sd_jwt_vc}

The following additional claims are defined for authorization details of type `openid_credential` and this Credential format.

* `vct`: REQUIRED. String as defined in (#server_metadata_sd_jwt_vc). This claim contains the type values the Wallet requests authorization for at the Credential Issuer.
* `claims`: OPTIONAL. An object as defined in (#server_metadata_sd_jwt_vc).

The following is a non-normative example of an authorization details object with Credential format `vc+sd-jwt`.

<{{examples/authorization_details_sd_jwt_vc.json}}

### Credential Request

The following additional parameters are defined for Credential Requests and this Credential format.

* `vct`: REQUIRED when the `credential_identifier` is not used. String as defined in (#server_metadata_sd_jwt_vc). This claim contains the type values the Wallet requests authorization for at the Credential Issuer.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to clearer about when VCT and credential_identifier are both present in a credential request? Does one need to take precedent, what if they conflict?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we do, I think it should be clarified when addressing issue #132.

the clarification should also be in this section that defines the behavior of credential request https://openid.github.io/OpenID4VCI/openid-4-verifiable-credential-issuance-wg-draft.html#name-credential-request, so this is probably out of scope of this PR.

the current thinking has been that both format specific claims and credential_identifier can be present since it is possible to use both scopes and RAR in the same authz request

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cannot think of any case where both, the credential_identifier and the vct could be in the same request, so this should be a MUST NOT if credential_identifier is present.

The credential request text already states "When this parameter is used, the format parameter and any other Credential format specific set of parameters such as those defined in (#format_profiles) MUST NOT be present."

Additionally, I'm not sure these requirements should be stated in a profile as the interplay between credential_identifier and format+format specific type information is subject to the core spec. I think the profile should state something like: "vct: determines the type of a credential of this format, might also be used in credential request ..."

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right. I confused the ability to use both for the same credential - we still currently support using RAR for one credential and format/type for another with the same access token.

This came up because 'vct' is mandatory when format/type is used but must not be present when credential_identifier is used. So honestly, I would suggest that current language works ok.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* `vct`: REQUIRED when the `credential_identifier` is not used. String as defined in (#server_metadata_sd_jwt_vc). This claim contains the type values the Wallet requests authorization for at the Credential Issuer.
* `vct`: String as defined in (#server_metadata_sd_jwt_vc). This claim contains the type values the Wallet requests authorization for at the Credential Issuer. This claim MUST NOT be present if the `credential_identifier` is present in the request.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I clarified for all other credential formats, too.

* `claims`: OPTIONAL. An object as defined in (#server_metadata_sd_jwt_vc).

The following is a non-normative example of a Credential Request with Credential format `vc+sd-jwt`.

<{{examples/credential_request_sd_jwt_vc.json}}

### Credential Response {#credential_response_jwt_vc_json}

The value of the `credential` claim in the Credential Response MUST be a string that is an SD-JWT VC. Credentials of this format are already suitable for transfer and, therefore, they need not and MUST NOT be re-encoded.

# Document History

[[ To be removed from the final specification ]]
Expand Down