Move credential format specific details into per-format annexes - #57
Open
jogu wants to merge 7 commits into
Open
Move credential format specific details into per-format annexes#57jogu wants to merge 7 commits into
jogu wants to merge 7 commits into
Conversation
Structure agreed at the 2026-08-31 meeting: one normative annex per credential format, with a generic extension point so other documents can define further formats. - New "Credential Formats" clause: the protocol is format agnostic, a "credential format definition" shall specify the ten items from #36, and the main body no longer names any format or annex. - New annexes for ISO mdoc and SD-JWT VC with identical headings in the order of the #21/#22 checklists; existing format text moves there. - format_extensions and CredentialItem.data become CDDL sockets ($formatExtensions, $CredentialData); the undefined ZkDocument / zkFormatExtensions alternatives go away. - ISO/IEC 18013-5, RFC 9901 and draft-ietf-oauth-sd-jwt-vc added to Normative references. - SD-JWT VC format identifier is now dc+sd-jwt; vc+sd-jwt as a mimetype means a w3c vc encoded in sd-jwt; vp uses dc+sd-jwt. New text added by this PR: case-sensitive credential_type matching; mdoc elements may be issuer- or device-signed; mdoc issuer identifiers match the AKI of a certificate in the IssuerAuth x5chain; KB-JWT may be omitted only when support_no_cryptographic_binding is true; for mdocs that flag maps to nonKeyBoundSupported from the 18013-5 second edition DIS text (#56). Left "To be completed": value matching (#9), transaction data (#4), SessionTranscript derivation and KB-JWT nonce/aud (#10), non-X.509 issuer identification for SD-JWT VC. Raised separately: array elements in path (#52), vct inheritance (#53), mdoc alg value names and matching rule (#54) There's now no mention of ZKP responses - that's already recorded in #17 closes #21, #22, #36
|
📄 Editor's Copy preview Preview of 324cb2c; updated on every push. For review only — the official specifications are published at https://openid.net/specs/ |
Contributor
Author
|
Joseph presented this on today's PR. Oliver & Martijn agreed to review. The CDDL socket syntax wasn't familiar to people on the call and maybe we want to consider other options, but that's editorial and as it is may be more readable to AIs. |
The SD-JWT VC annex only said the x509_ref values are compared against the x5c chain, without saying what outcome satisfies the request. Use the same rule as the mdoc annex.
The previous text let the wallet drop the KB-JWT from a key-bound SD-JWT VC whenever support_no_cryptographic_binding was true. That is a downgrade the mdoc annex does not permit (a key-bound mdoc always carries DeviceSigned) and OpenID4VP does not permit either. Tie the permission to the absence of cnf, matching the mdoc rule.
IssuerSignedItems is not a structure in ISO/IEC 18013-5; the standard has IssuerSignedItem entries under IssuerNameSpaces and DeviceSignedItems under DeviceNameSpaces.
The mdoc annex introduction presented its list as the structures the annex refers to, but omitted IssuerAuth, the MSO, KeyAuthorizations, IssuerNameSpaces, DeviceNameSpaces and DeviceSignedItems, all used later in the annex. The SD-JWT VC annex uses the x5c header, which comes from RFC 7515 rather than the SD-JWT documents.
The annexes say format carries the same value as credential_format, but the main-body table did not connect the field to the extension point.
The note that an mDL is always key-bound also relies on the unpublished second edition text, so move the editor's note ahead of it and say it covers both.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Structure agreed at the 2026-08-31 meeting: one normative annex per credential format, with a generic extension point so other documents can define further formats.
New text added by this PR: case-sensitive credential_type matching; mdoc elements may be issuer- or device-signed; mdoc issuer identifiers match the AKI of a certificate in the IssuerAuth x5chain; KB-JWT may be omitted only when support_no_cryptographic_binding is true; for mdocs that flag maps to nonKeyBoundSupported from the 18013-5 second edition DIS text (#56).
Left "To be completed": value matching (#9), transaction data (#4), SessionTranscript derivation and KB-JWT nonce/aud (#10), non-X.509 issuer identification for SD-JWT VC.
Raised separately: array elements in path (#52), vct inheritance (#53), mdoc alg value names and matching rule (#54)
There's now no mention of ZKP responses - that's already recorded in #17
closes #21, #22, #36