Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add data integrity verifiable presentation as proof of possession #66

Merged
merged 23 commits into from
Dec 10, 2023
Merged

add data integrity verifiable presentation as proof of possession #66

Show file tree
Hide file tree
Changes from 22 commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
3105147
mv PR from bitbucket
F-Node-Karlsruhe Sep 4, 2023
1229a6d
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Sep 7, 2023
d8e5b75
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Oct 5, 2023
fc8f7bb
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Oct 5, 2023
fe57bdc
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Oct 5, 2023
3e03794
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Oct 5, 2023
93c20c8
capitalize Data Integrity
F-Node-Karlsruhe Oct 5, 2023
b429a35
use verification identifier instead of DID
F-Node-Karlsruhe Oct 16, 2023
0f232ac
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Oct 17, 2023
0c01973
Update examples/credential_request_ldp_vc_vp.json
F-Node-Karlsruhe Oct 17, 2023
8efb27b
generalize ldp proof type
F-Node-Karlsruhe Oct 27, 2023
985a499
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Oct 30, 2023
6c227fa
mv example to to request section
F-Node-Karlsruhe Oct 31, 2023
2bdde85
Merge branch 'openid:main' into di-vp-pop
F-Node-Karlsruhe Oct 31, 2023
65b2736
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Nov 2, 2023
e682253
rename DI to data_Integrity
F-Node-Karlsruhe Nov 2, 2023
5dbe826
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Nov 2, 2023
9e31825
restructure presentation definition
F-Node-Karlsruhe Nov 2, 2023
6a2dba6
specify object type of ldp_vp
F-Node-Karlsruhe Nov 2, 2023
0b2cbfe
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Nov 2, 2023
c62bc00
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Dec 1, 2023
79a3d0b
Merge branch 'main' into di-vp-pop
F-Node-Karlsruhe Dec 1, 2023
c659579
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Dec 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions examples/credential_request_ldp_vc_vp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
{
"format": "ldp_vc",
"credential_definition": {
"@context": [
"https://www.w3.org/2018/credentials/v1",
"https://www.w3.org/2018/credentials/examples/v1"
],
"type": [
"VerifiableCredential",
"UniversityDegreeCredential"
],
"credentialSubject": {
"degree": {
"type": {}
}
}
},
"proof": {
"proof_type": "ldp_vp",
"ldp_vp": {
"@context": [
"https://www.w3.org/ns/credentials/v2",
"https://www.w3.org/ns/credentials/examples/v2"
],
"type": [
"VerifiablePresentation"
],
"holder": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
"proof": [
{
"type": "DataIntegrityProof",
"cryptosuite": "eddsa-2022",
"proofPurpose": "authentication",
"verificationMethod": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro#z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
"created": "2023-03-01T14:56:29.280619Z",
"challenge": "82d4cb36-11f6-4273-b9c6-df1ac0ff17e9",
"domain": "did:web:audience.company.com",
"proofValue": "z5hrbHzZiqXHNpLq6i7zePEUcUzEbZKmWfNQzXcUXUrqF7bykQ7ACiWFyZdT2HcptF1zd1t7NhfQSdqrbPEjZceg7"
}
]
}
}
}
122 changes: 122 additions & 0 deletions openid-4-verifiable-credential-issuance-1_0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -774,6 +774,7 @@ This specification defines the following values for the `proof_type` property:

* `jwt`: A JWT [@!RFC7519] is used as proof of possession. When `proof_type` is `jwt`, a `proof` object MUST include a `jwt` claim containing a JWT defined in (#jwt-proof-type).
* `cwt`: A CWT [@!RFC8392] is used as proof of possession. When `proof_type` is `cwt`, a `proof` object MUST include a `cwt` claim containing a CWT defined in (#cwt-proof-type).
* `ldp_vp`: A W3C Verifiable Presentation object signed using the Data Integrity Proof as defined in [@VC_DATA_2.0] or [@VC_DATA], and where the proof of possession MUST be done in accordance with [@Data_Integrity]. When `proof_type` is set to `ldp_vp`, the `proof` object MUST include a `ldp_vp` claim containing a [W3C Verifiable Presentation](https://www.w3.org/TR/vc-data-model-2.0/#presentations-0) defined in (#ldp_vp-proof-type).

#### `jwt` Key Proof Type {#jwt-proof-type}

Expand Down Expand Up @@ -837,6 +838,49 @@ Here is another example JWT not only proving possession of a private key but als
}
```

#### `ldp_vp` Key Proof Type {#ldp_vp-proof-type}

When a W3C Verifiable Presentation as defined by [@VC_DATA_2.0] or [@VC_DATA] signed using Data Integrity is used as Key Proof, it MUST contain the following elements:

* `holder`: OPTIONAL. MUST be equivalent to the controller identifier (e.g. DID) for the `verificationMethod` value identified by the `proof.verificationMethod` property.

* `proof`: REQUIRED. The proof body of a W3C Verifiable Presentation.
* `domain`: REQUIRED (string). The value of this claim MUST be the Credential Issuer Identifier.
* `challenge`: REQUIRED when the Credential Issuer has provided a `c_nonce`. MUST NOT be used otherwise. String, where the value is a server-provided `c_nonce`. It MUST be present when the Wallet received server-provided `c_nonce`.

The Credential Issuer MUST validate that the `proof` is actually signed with a key in possession of the Holder.
F-Node-Karlsruhe marked this conversation as resolved.
Show resolved Hide resolved

Below is a non-normative example of a `proof` parameter:

```json
{
"proof_type": "ldp_vp",
"ldp_vp": {
"@context": [
"https://www.w3.org/ns/credentials/v2",
"https://www.w3.org/ns/credentials/examples/v2"
],
"type": [
"VerifiablePresentation"
],
"holder": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
"proof": [
{
"type": "DataIntegrityProof",
"cryptosuite": "eddsa-2022",
"proofPurpose": "authentication",
"verificationMethod": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro#z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
"created": "2023-03-01T14:56:29.280619Z",
"challenge": "82d4cb36-11f6-4273-b9c6-df1ac0ff17e9",
"domain": "did:web:audience.company.com",
"proofValue": "z5hrbHzZiqXHNpLq6i7zePEUcUzEbZKmWfNQzXcUXUrqF7bykQ7ACiWFyZdT2HcptF1zd1t7NhfQSdqrbPEjZceg7"
}
]
}
}

```

#### `cwt` Key Proof Type {#cwt-proof-type}

The CWT MUST contain the following elements:
Expand Down Expand Up @@ -1398,6 +1442,79 @@ TBD
</front>
</reference>

<reference anchor="VC_DATA_2.0" target="https://www.w3.org/TR/vc-data-model-2.0">
<front>
<title>Verifiable Credentials Data Model 2.0</title>
<author fullname="Manu Sporny">
<organization>Digital Bazaar</organization>
</author>
<author fullname="Orie Steele">
<organization>Transmute</organization>
</author>
<author fullname="Oliver Terbu">
<organization>Spruce Systems, Inc.</organization>
</author>
<author fullname="Grant Noble">
<organization>ConsenSys</organization>
</author>
<author fullname="Gabe Cohen">
<organization>Block</organization>
</author>
<author fullname="Michael B. Jones">
<organization>independent</organization>
</author>
<author fullname="Dave Longley">
<organization>Digital Bazaar</organization>
</author>
<author fullname="Daniel C. Burnett">
<organization>ConsenSys</organization>
</author>
<author fullname="Brent Zundel">
<organization>Evernym</organization>
</author>
<author fullname="Kyle Den Hartog">
<organization>MATTR</organization>
</author>
<author fullname="David Chadwick">
<organization>University of Kent</organization>
</author>
<date day="15" month="Aug" year="2023"/>
</front>
</reference>

<reference anchor="Data_Integrity" target="https://w3c.github.io/vc-data-integrity/">
<front>
<title>Verifiable Credential Data Integrity 1.0</title>
<author fullname="Manu Sporny">
<organization>Digital Bazaar</organization>
</author>
<author fullname="Dave Longley">
<organization>Digital Bazaar</organization>
</author>
<author fullname="Greg Bernstein">
<organization>Invited Expert</organization>
</author>
<author fullname="Dmitri Zagidulin">
<organization>Invited Expert</organization>
</author>
<author fullname="Sebastian Crane">
<organization>Invited Expert</organization>
</author>
<date day="31" month="Aug" year="2023"/>
</front>
</reference>

<reference anchor="RFC6750" target="https://www.rfc-editor.org/rfc/rfc6750">
<front>
<title>The OAuth 2.0 Authorization Framework: Bearer Token Usage</title>
<author fullname="Dick Hardt">
<organization>Independent</organization>
</author>
<author fullname="Michael B. Jones">
<organization>Microsoft</organization>
</author>
<date month="October" year="2012"/>
</front>
F-Node-Karlsruhe marked this conversation as resolved.
Show resolved Hide resolved
<reference anchor="USASCII">
<front>
<title>Coded Character Set -- 7-bit American Standard Code for Information Interchange</title>
Expand Down Expand Up @@ -1799,6 +1916,7 @@ The following is a non-normative example of a Credential Offer of Credential for

<{{examples/credential_offer_ldp_vc.json}}


#### Authorization Details {#authorization_ldp_vc}

The following additional claims are defined for authorization details of type `openid_credential` and this Credential format.
Expand All @@ -1825,6 +1943,10 @@ The following is a non-normative example of a Credential Request with Credential

<{{examples/credential_request_ldp_vc.json}}

The following is a non-normative example of a Credential request with the key proof type `ldp_vp`:

<{{examples/credential_request_ldp_vc_vp.json}}

#### Credential Response

The value of the `credential` claim in the Credential Response MUST be a JSON object. Credentials of this format MUST NOT be re-encoded.
Expand Down
Loading