diff --git a/openid-4-verifiable-credential-issuance-1_0.md b/openid-4-verifiable-credential-issuance-1_0.md index d3a60c7f..6540d37a 100644 --- a/openid-4-verifiable-credential-issuance-1_0.md +++ b/openid-4-verifiable-credential-issuance-1_0.md @@ -1300,7 +1300,7 @@ The Wallet is supposed to detect signs of fraudulent behavior related to the Cre If an adversary is able to get hold of a key proof defined in (#proof_types), the adversary could get a Credential issued that is bound to a key pair controlled by the victim. -Note: For the attacker to be able to present to the Verifier a Credential bound to a replayed Key Proof, the attacker also needs to obtain the victim's private key. To limit this, servers are RECOMMENDED to check how the Wallet protects the private keys, using mechanisms such as Key Based Client Authentication defined in [@I-D.looker-oauth-attestation-based-client-auth]. +Note: For the attacker to be able to present to the Verifier a Credential bound to a replayed Key Proof, the attacker also needs to obtain the victim's private key. To limit this, servers are RECOMMENDED to check how the Wallet protects the private keys, using mechanisms such as Key Based Client Authentication defined in [@!I-D.ietf-oauth-attestation-based-client-auth]. `nonce` parameter is the primary countermeasure against key proof replay. To further narrow down the attack vector, the Credential Issuer SHOULD bind a unique `nonce` parameter to the respective Access Token. @@ -1434,9 +1434,12 @@ TBD Microsoft - Microsoft + Self-Issued Consulting + + + sprind.org - + @@ -1570,21 +1573,18 @@ TBD OpenID for Verifiable Presentations - ConsenSys Mesh + Mattr - yes.com + sprind.org Microsoft - - Convergence.tech - Mattr - + @@ -1625,31 +1625,143 @@ TBD Connect2id - + + + + OAuth Parameters + + IANA + + + + + + + + Media Types + + IANA + + + + # IANA Considerations ## Sub-Namespace Registration -This section registers the value "urn:ietf:params:oauth:grant-type:pre-authorized_code" in the IANA "OAuth URI" registry established by "An IETF URN Sub-Namespace for OAuth" [@!RFC6755]. +This specification registers the following URN in the IANA "OAuth URI" registry [@!IANA.OAuth.Parameters] established by [@!RFC6755]. * URN: urn:ietf:params:oauth:grant-type:pre-authorized_code * Common Name: Pre-Authorized Code -* Change Controller: AB/Connect Working Group - openid-specs-ab@lists.openid.net -* Specification Document: (#token_request) of this document +* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - openid-specs-digital-credentials-protocols@lists.openid.net +* Reference: (#token_request) of this spedification + +## OAuth Parameters Registry + +This specification registers the following parameter names in the IANA "OAuth Parameters" registry [@!IANA.OAuth.Parameters] established by [@!RFC6749]. + +* Parameter Name: wallet_issuer +* Parameter Usage Location: authorization request +* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - openid-specs-digital-credentials-protocols@lists.openid.net +* Reference: (#credential-authz-request) of this specification + +* Parameter Name: user_hint +* Parameter Usage Location: authorization request +* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - openid-specs-digital-credentials-protocols@lists.openid.net +* Reference: (#credential-authz-request) of this specification + +* Parameter Name: issuer_state +* Parameter Usage Location: authorization request +* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - openid-specs-digital-credentials-protocols@lists.openid.net +* Reference: (#credential-authz-request) of this specification + +* Parameter Name: pre-authorized_code +* Parameter Usage Location: token request +* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - openid-specs-digital-credentials-protocols@lists.openid.net +* Reference: (#token_request) of this specification + +* Parameter Name: tx_code +* Parameter Usage Location: token request +* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - openid-specs-digital-credentials-protocols@lists.openid.net +* Reference: (#token_request) of this specification + +* Parameter Name: c_nonce +* Parameter Usage Location: token response +* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - openid-specs-digital-credentials-protocols@lists.openid.net +* Reference: (#token-response) of this specification + +* Parameter Name: c_nonce_expires_in +* Parameter Usage Location: token response +* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - openid-specs-digital-credentials-protocols@lists.openid.net +* Reference: (#token-response) of this specification + +## OAuth Dynamic Client Registration Metadata Registry + +This specification registers the following client metadata name in the IANA "OAuth Dynamic Client Registration Metadata" registry [@!IANA.OAuth.Parameters] established by [@!RFC7591]. + +* Client Metadata Name: credential_offer_endpoint +* Client Metadata Description: Credential Offer Endpoint +* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - openid-specs-digital-credentials-protocols@lists.openid.net +* Reference: (#credential_offer_endpoint) of this specification + ## Well-Known URI Registry -This specification registers the well-known URI defined in (#credential-issuer-wellknown) in the IANA Well-Known URI registry defined in RFC 5785 [@!RFC5785]. +This specification registers the following well-known URI in the IANA "Well-Known URI" registry established by [@!RFC5785]. * URI suffix: openid-credential-issuer -* Change controller: AB/Connect Working Group - openid-specs-ab@lists.openid.net +* Change controller: OpenID Foundation Digital Credentials Protocols Working Group - openid-specs-digital-credentials-protocols@lists.openid.net * Specification document: (#credential-issuer-wellknown) of this document * Related information: (none) +## Media Types Registry + +This specification registers the following media types in the IANA "Media Types" registry [@!IANA.MediaTypes] in the manner described in [@!RFC6838]. + +* Type name: `application` +* Subtype name: `openid4vci-proof+jwt` +* Required parameters: n/a +* Optional parameters: n/a +* Encoding considerations: Uses JWS Compact Serialization, as specified in [@!RFC7515]. +* Security considerations: See the Security Considerations in [@!RFC7519]. +* Interoperability considerations: n/a +* Published specification: (#jwt-proof-type) of this specification +* Applications that use this media type: Applications that issue and store verifiable credentials +* Additional information: + - Magic number(s): n/a + - File extension(s): n/a + - Macintosh file type code(s): n/a +* Person & email address to contact for further information: Torsten Lodderstedt, torsten@lodderstedt.net +* Intended usage: COMMON +* Restrictions on usage: none +* Author: Torsten Lodderstedt, torsten@lodderstedt.net +* Change controller: OpenID Foundation Digital Credentials Protocols Working Group - openid-specs-digital-credentials-protocols@lists.openid.net +* Provisional registration? No + +* Type name: `application` +* Subtype name: `openid4vci-proof+cwt` +* Required parameters: n/a +* Optional parameters: n/a +* Encoding considerations: Binary CBOR, as specified in [@!RFC9052] +* Security considerations: See the Security Considerations in [@!RFC8392]. +* Interoperability considerations: n/a +* Published specification: (#cwt-proof-type) of this specification +* Applications that use this media type: Applications that issue and store verifiable credentials +* Additional information: + - Magic number(s): n/a + - File extension(s): n/a + - Macintosh file type code(s): n/a +* Person & email address to contact for further information: Torsten Lodderstedt, torsten@lodderstedt.net +* Intended usage: COMMON +* Restrictions on usage: none +* Author: Torsten Lodderstedt, torsten@lodderstedt.net +* Change controller: OpenID Foundation Digital Credentials Protocols Working Group - openid-specs-digital-credentials-protocols@lists.openid.net +* Provisional registration? No + # Acknowledgements {#Acknowledgements} We would like to thank Paul Bastian, Vittorio Bertocci, Christian Bormann, John Bradley, Brian Campbell, Gabe Cohen, David Chadwick, Andrii Deinega, Giuseppe De Marco, Mark Dobrinic, Daniel Fett, Pedro Felix, George Fletcher, Timo Glasta, Mark Haine, Fabian Hauck, Roland Hedberg, Joseph Heenan, Alen Horvat, Andrew Hughes, Jacob Ideskog, Edmund Jay, Michael B. Jones, Tom Jones, Judith Kahrer, Takahiko Kawasaki, Niels Klomp, Ronald Koenig, Markus Kreusch, Adam Lemmon, Daniel McGrogan, Jeremie Miller, Kenichi Nakamura, Rolson Quadras, Nat Sakimura, Oliver Terbu, Arjen van Veen, David Waite, Jacob Ward for their valuable feedback and contributions to this specification.