Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add data integrity verifiable presentation as proof of possession #66

Merged
merged 23 commits into from
Dec 10, 2023
Merged

add data integrity verifiable presentation as proof of possession #66

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
3105147
mv PR from bitbucket
F-Node-Karlsruhe Sep 4, 2023
1229a6d
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Sep 7, 2023
d8e5b75
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Oct 5, 2023
fc8f7bb
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Oct 5, 2023
fe57bdc
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Oct 5, 2023
3e03794
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Oct 5, 2023
93c20c8
capitalize Data Integrity
F-Node-Karlsruhe Oct 5, 2023
b429a35
use verification identifier instead of DID
F-Node-Karlsruhe Oct 16, 2023
0f232ac
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Oct 17, 2023
0c01973
Update examples/credential_request_ldp_vc_vp.json
F-Node-Karlsruhe Oct 17, 2023
8efb27b
generalize ldp proof type
F-Node-Karlsruhe Oct 27, 2023
985a499
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Oct 30, 2023
6c227fa
mv example to to request section
F-Node-Karlsruhe Oct 31, 2023
2bdde85
Merge branch 'openid:main' into di-vp-pop
F-Node-Karlsruhe Oct 31, 2023
65b2736
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Nov 2, 2023
e682253
rename DI to data_Integrity
F-Node-Karlsruhe Nov 2, 2023
5dbe826
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Nov 2, 2023
9e31825
restructure presentation definition
F-Node-Karlsruhe Nov 2, 2023
6a2dba6
specify object type of ldp_vp
F-Node-Karlsruhe Nov 2, 2023
0b2cbfe
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Nov 2, 2023
c62bc00
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Dec 1, 2023
79a3d0b
Merge branch 'main' into di-vp-pop
F-Node-Karlsruhe Dec 1, 2023
c659579
Update openid-4-verifiable-credential-issuance-1_0.md
F-Node-Karlsruhe Dec 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions examples/credential_request_ldp_vc_vp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
{
"format": "ldp_vc",
"credential_definition": {
"@context": [
"https://www.w3.org/2018/credentials/v1",
"https://www.w3.org/2018/credentials/examples/v1"
],
"type": [
"VerifiableCredential",
"UniversityDegreeCredential"
],
"credentialSubject": {
"degree": {
"type": {}
}
}
},
"proof": {
"proof_type": "ldp_vp",
"ldp_vp": {
"@context": [
"https://www.w3.org/ns/credentials/v2",
"https://www.w3.org/ns/credentials/examples/v2"
],
"type": [
"VerifiablePresentation"
],
"holder": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
"proof": [
{
"type": "DataIntegrityProof",
"cryptosuite": "eddsa-2022",
"proofPurpose": "authentication",
"verificationMethod": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro#z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
"created": "2023-03-01T14:56:29.280619Z",
"challenge": "82d4cb36-11f6-4273-b9c6-df1ac0ff17e9",
"domain": "did:web:audience.company.com",
"proofValue": "z5hrbHzZiqXHNpLq6i7zePEUcUzEbZKmWfNQzXcUXUrqF7bykQ7ACiWFyZdT2HcptF1zd1t7NhfQSdqrbPEjZceg7"
}
]
}
}
}
111 changes: 111 additions & 0 deletions openid-4-verifiable-credential-issuance-1_0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -735,6 +735,7 @@ This specification defines the following values for the `proof_type` property:

* `jwt`: A JWT [@!RFC7519] is used as proof of possession. When `proof_type` is `jwt`, a `proof` object MUST include a `jwt` claim containing a JWT defined in (#jwt-proof-type).
* `cwt`: A CWT [@!RFC8392] is used as proof of possession. When `proof_type` is `cwt`, a `proof` object MUST include a `cwt` claim containing a CWT defined in (#cwt-proof-type).
* `ldp_vp`: A verifiable presentation signed using the Data Integrity Proof defined in [@VC_DATA_2.0] or [@VC_DATA], and where the proof of possession MUST be done in accordance with [@DI]. When `proof_type` is set to `ldp_vp`, the `proof` object MUST include a `ldp_vp` claim containing a [verifiable presentation](https://www.w3.org/TR/vc-data-model-2.0/#presentations-0) defined in (#ldp_vp-proof-type).
F-Node-Karlsruhe marked this conversation as resolved.
Show resolved Hide resolved
F-Node-Karlsruhe marked this conversation as resolved.
Show resolved Hide resolved

#### `jwt` Key Proof Type {#jwt-proof-type}

Expand Down Expand Up @@ -798,6 +799,50 @@ Here is another example JWT not only proving possession of a private key but als
}
```

#### `ldp_vp` Key Proof Type {#ldp_vp-proof-type}

The verifiable presentation as defined by [@VC_DATA_2.0] or [@VC_DATA] signed using Data Integrity that are used as Key Proofs MUST contain the following elements:
F-Node-Karlsruhe marked this conversation as resolved.
Show resolved Hide resolved

* in the presentation itself,
F-Node-Karlsruhe marked this conversation as resolved.
Show resolved Hide resolved
* `holder`: OPTIONAL. MUST be equivalent to the verificationMethod identifier (e.g. DID) in the `proof.verificationMethod` property.
F-Node-Karlsruhe marked this conversation as resolved.
Show resolved Hide resolved

* in the proof body,
F-Node-Karlsruhe marked this conversation as resolved.
Show resolved Hide resolved
* `domain`: REQUIRED (string). The value of this claim MUST be the Credential Issuer Identifier.
* `challenge`: REQUIRED (string). The value type of this claim MUST be a string, where the value is a server-provided `c_nonce`. It MUST be present when the Wallet received server-provided `c_nonce`.
F-Node-Karlsruhe marked this conversation as resolved.
Show resolved Hide resolved

The Credential Issuer MUST validate that the `proof` is actually signed with a key in possession of the Holder.
F-Node-Karlsruhe marked this conversation as resolved.
Show resolved Hide resolved

Below is a non-normative example of a `proof` parameter:

```json
{
"proof_type": "ldp_vp",
"ldp_vp": {
"@context": [
"https://www.w3.org/ns/credentials/v2",
"https://www.w3.org/ns/credentials/examples/v2"
],
"type": [
"VerifiablePresentation"
],
"holder": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
"proof": [
{
"type": "DataIntegrityProof",
"cryptosuite": "eddsa-2022",
"proofPurpose": "authentication",
"verificationMethod": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro#z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
"created": "2023-03-01T14:56:29.280619Z",
"challenge": "82d4cb36-11f6-4273-b9c6-df1ac0ff17e9",
"domain": "did:web:audience.company.com",
"proofValue": "z5hrbHzZiqXHNpLq6i7zePEUcUzEbZKmWfNQzXcUXUrqF7bykQ7ACiWFyZdT2HcptF1zd1t7NhfQSdqrbPEjZceg7"
}
]
}
}

```

#### `cwt` Key Proof Type {#cwt-proof-type}

The CWT MUST contain the following elements:
Expand Down Expand Up @@ -1374,6 +1419,68 @@ TBD
</front>
</reference>

<reference anchor="VC_DATA_2.0" target="https://www.w3.org/TR/vc-data-model-2.0">
<front>
<title>Verifiable Credentials Data Model 2.0</title>
<author fullname="Manu Sporny">
<organization>Digital Bazaar</organization>
</author>
<author fullname="Orie Steele">
<organization>Transmute</organization>
</author>
<author fullname="Oliver Terbu">
<organization>Spruce Systems, Inc.</organization>
</author>
<author fullname="Grant Noble">
<organization>ConsenSys</organization>
</author>
<author fullname="Gabe Cohen">
<organization>Block</organization>
</author>
<author fullname="Michael B. Jones">
<organization>independent</organization>
</author>
<author fullname="Dave Longley">
<organization>Digital Bazaar</organization>
</author>
<author fullname="Daniel C. Burnett">
<organization>ConsenSys</organization>
</author>
<author fullname="Brent Zundel">
<organization>Evernym</organization>
</author>
<author fullname="Kyle Den Hartog">
<organization>MATTR</organization>
</author>
<author fullname="David Chadwick">
<organization>University of Kent</organization>
</author>
<date day="15" month="Aug" year="2023"/>
</front>
</reference>

<reference anchor="DI" target="https://w3c.github.io/vc-data-integrity/">
<front>
<title>Verifiable Credential Data Integrity 1.0</title>
<author fullname="Manu Sporny">
<organization>Digital Bazaar</organization>
</author>
<author fullname="Dave Longley">
<organization>Digital Bazaar</organization>
</author>
<author fullname="Greg Bernstein">
<organization>Invited Expert</organization>
</author>
<author fullname="Dmitri Zagidulin">
<organization>Invited Expert</organization>
</author>
<author fullname="Sebastian Crane">
<organization>Invited Expert</organization>
</author>
<date day="31" month="Aug" year="2023"/>
</front>
</reference>

<reference anchor="RFC6750" target="https://www.rfc-editor.org/rfc/rfc6750">
<front>
<title>The OAuth 2.0 Authorization Framework: Bearer Token Usage</title>
Expand Down Expand Up @@ -1788,6 +1895,10 @@ The following is a non-normative example of a Credential Offer of type `ldp_vc`:

<{{examples/credential_offer_ldp_vc.json}}

For better suiting the W3C Data Integrity Proof ecosystem the following non-normative example displays a Credential request with the proof of possession type set to `ldp_vp`, using a verifiable presentation.

<{{examples/credential_request_ldp_vc_vp.json}}

F-Node-Karlsruhe marked this conversation as resolved.
Show resolved Hide resolved
#### Authorization Details {#authorization_ldp_vc}

The following additional claims are defined for authorization details of type `openid_credential` and this Credential format.
Expand Down