Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add sd-jwt vc profile to vci #128

Merged
merged 20 commits into from
Dec 21, 2023
Merged
Show file tree
Hide file tree
Changes from 5 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions examples/authorization_details_sd_jwt_vc.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
[
{
"type": "openid_credential",
"format": "vc+sd-jwt",
"credential_definition": {
Sakurann marked this conversation as resolved.
Show resolved Hide resolved
"vct": "IdentityCredential"
Sakurann marked this conversation as resolved.
Show resolved Hide resolved
}
}
]
59 changes: 59 additions & 0 deletions examples/credential_metadata_sd_jwt_vc.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
{
"format": "vc+sd-jwt",
"scope": "IdentityCredential_SD-JWT-VC",
"cryptographic_binding_methods_supported": [
"did:example"
],
"cryptographic_suites_supported": [
"ES256K"
Sakurann marked this conversation as resolved.
Show resolved Hide resolved
],
"display": [
{
"name": "IdentityCredential",
"locale": "en-US",
"background_color": "#12107c",
"text_color": "#FFFFFF"
}
],
"credential_definition": {
"vct": "IdentityCredential",
"claims": {
"given_name": {
"display": [
{
"name": "Given Name",
"locale": "en-US"
},
{
"name": "Vorname",
"locale": "de-DE"
}
]
},
"last_name": {
"display": [
{
"name": "Surname",
"locale": "en-US"
},
{
"name": "Nachname",
"locale": "de-DE"
}
]
},
"email": {},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we leave these claims out of the example if there is no translation?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's ok to leave as-is..

"phone_number": {},
"address": {
"street_address": {},
"locality": {},
"region": {},
"country": {}
},
"birthdate": {},
"is_over_18": {},
"is_over_21": {},
"is_over_65": {}
}
}
}
11 changes: 11 additions & 0 deletions examples/credential_offer_sd_jwt_vc.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{
"credential_issuer": "https://credential-issuer.example.com",
"credentials": [
"IdentityCredential_SD-JWT-VC"
Sakurann marked this conversation as resolved.
Show resolved Hide resolved
],
"grants": {
"authorization_code": {
"issuer_state": "eyJhbGciOiJSU0Et...FYUaBy"
}
}
}
10 changes: 10 additions & 0 deletions examples/credential_request_sd_jwt_vc.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"format": "vc+sd-jwt",
"credential_definition": {
Sakurann marked this conversation as resolved.
Show resolved Hide resolved
"vct": "IdentityCredential"
Sakurann marked this conversation as resolved.
Show resolved Hide resolved
},
"proof": {
"proof_type": "jwt",
"jwt":"eyJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoick00bmJvTmlrVm1LQlB2dVd3Q0NTeDRYTFBLNlZjUEp5NDlYOEJyd0Q2OCIsInkiOiI1cXhkZ1hvVVh1RFJPMGVxZjlvWHhKLUhzeDM2QlVDOXNoeWtxNk9NRU9RIn19.eyJhdWQiOiJodHRwczovL2lzc3Vlci1vcGVuaWQ0dmMuc3NpLnRpci5idWRydS5kZSIsImlhdCI6MTcwMTk2MDQ0NCwibm9uY2UiOiJMYXJSR1NibVVQWXRSWU82QlE0eW44In0.lOqcNuzNacLwyKqIy5zBK2BQ05flHr6dIGgvXT0IHQC06VBVgT1dI6MjwwsDjs3c6-M_aWfDAFltLya6UKIW_Q"
Sakurann marked this conversation as resolved.
Show resolved Hide resolved
}
}
56 changes: 56 additions & 0 deletions openid-4-verifiable-credential-issuance-1_0.md
Original file line number Diff line number Diff line change
Expand Up @@ -1920,6 +1920,62 @@ The following is a non-normative example of a Credential Request with Credential

The value of the `credential` claim in the Credential Response MUST be a string that is the base64url-encoded representation of the issued Credential.

## IETF SD-JWT VC
Sakurann marked this conversation as resolved.
Show resolved Hide resolved

Sakurann marked this conversation as resolved.
Show resolved Hide resolved
This section defines a Credential Format Profile for Credentials complying with [@!I-D.ietf-oauth-sd-jwt-vc].

### Format Identifier

The Credential format identifier is `vc+sd-jwt`.

### Credential Issuer Metadata {#server_metadata_vc_sd-jwt}

Sakurann marked this conversation as resolved.
Show resolved Hide resolved
The following additional Credential Issuer metadata are defined for this Credential format to be added to the `credentials_supported` parameter in addition to those defined in (#credential-issuer-parameters).
Sakurann marked this conversation as resolved.
Show resolved Hide resolved

* `credential_definition`: REQUIRED. JSON object containing the detailed description of the Credential type. It consists of the following sub elements:
Sakurann marked this conversation as resolved.
Show resolved Hide resolved
* `vct`: REQUIRED. JSON string designating the type of a Credential as defined in [@!I-D.ietf-oauth-sd-jwt-vc].
* `claims`: OPTIONAL. A JSON object containing a list of name/value pairs, where each name identifies a claim offered in the Credential. The value can be another such object (nested data structures), or an array of such objects. To express the specifics about the claim, the most deeply nested value MAY be a JSON object that includes a following non-exhaustive list of parameters defined by this specification:
* `mandatory`: OPTIONAL. Boolean which when set to `true` indicates the claim MUST be present in the issued Credential. If the `mandatory` property is omitted its default should be assumed to be `false`.
* `value_type`: OPTIONAL. String value determining type of value of the claim. A non-exhaustive list of valid values defined by this specification are `string`, `number`, and image media types such as `image/jpeg` as defined in IANA media type registry for images (https://www.iana.org/assignments/media-types/media-types.xhtml#image).
* `display`: OPTIONAL. An array of objects, where each object contains display properties of a certain claim in the Credential for a certain language. Below is a non-exhaustive list of valid parameters that MAY be included:
* `name`: OPTIONAL. String value of a display name for the claim.
* `locale`: OPTIONAL. String value that identifies language of this object represented as language tag values defined in BCP47 [@!RFC5646]. There MUST be only one object for each language identifier.
* `order`: OPTIONAL. An array of `claims.display.name` values that lists them in the order they should be displayed by the Wallet.
Sakurann marked this conversation as resolved.
Show resolved Hide resolved
Sakurann marked this conversation as resolved.
Show resolved Hide resolved

The following is a non-normative example of an object comprising `credentials_supported` parameter of Credential format `vc+sd-jwt`.
Sakurann marked this conversation as resolved.
Show resolved Hide resolved

<{{examples/credential_metadata_sd_jwt_vc.json}}

### Credential Offer
Sakurann marked this conversation as resolved.
Show resolved Hide resolved

The following is a non-normative example of a Credential Offer of Credential format `vc+sd-jwt`.

<{{examples/credential_offer_sd_jwt_vc.json}}

### Authorization Details {#authorization_vc_sd-jwt}

The following additional claims are defined for authorization details of type `openid_credential` and this Credential format.

* `credential_definition`: REQUIRED. JSON object containing the detailed description of the Credential type. It MUST contain at least `vct` property as defined in (#server_metadata_vc_sd-jwt). It MAY contain `claims` property as defined in (#server_metadata_vc_sd-jwt).

The following is a non-normative example of an authorization details object with Credential format `vc+sd-jwt`.

<{{examples/authorization_details_sd_jwt_vc.json}}

### Credential Request

The following additional parameters are defined for Credential Requests and this Credential format.

* `credential_definition`: REQUIRED. JSON object containing the detailed description of the Credential type. It MUST contain at least `vct` property as defined in (#server_metadata_vc_sd-jwt). It MAY contain `claims` property as defined in (#server_metadata_vc_sd-jwt).

The following is a non-normative example of a Credential Request with Credential format `vc+sd-jwt`.

<{{examples/credential_request_sd_jwt_vc.json}}

### Credential Response {#credential_response_jwt_vc_json}

The value of the `credential` claim in the Credential Response MUST be a JSON string that is an SD-JWT VC. Credentials of this format are already suitable for transfer and, therefore, they need not and MUST NOT be re-encoded.
Sakurann marked this conversation as resolved.
Show resolved Hide resolved
Sakurann marked this conversation as resolved.
Show resolved Hide resolved

# Document History

[[ To be removed from the final specification ]]
Expand Down