Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

make credential_signing_alg_values_supported type and values format specific #460

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

make credential_signing_alg_values_supported type and values format specific #460

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f4a0d73
fix: made type and values for credential_signing_alg_values_supported…
awoie Feb 7, 2025
56dc116
fix: fixed typo
awoie Feb 7, 2025
b18cb5d
fix: updated metadata example for mdocs
awoie Feb 7, 2025
30f6af2
fix: removed .DS_Store
awoie Feb 7, 2025
3794c61
fix: improved language
awoie Feb 7, 2025
40061fb
fix: editorial fix
awoie Feb 7, 2025
7d026a1
fix: editrial fix
awoie Feb 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion examples/credential_metadata_mso_mdoc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,10 @@
"cose_key"
],
"credential_signing_alg_values_supported": [
"ES256", "ES384", "ES512"
-7, -8
],
"credential_signing_crv_values_supported": [
1, 2, 3, 256, 257, 258, 259, 6, 7
],
"display": [
{
Expand Down
31 changes: 22 additions & 9 deletions openid-4-verifiable-credential-issuance-1_0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -960,7 +960,7 @@ The Credential Issuer MUST validate that the JWT used as a proof is actually sig

The Credential Issuer SHOULD issue a Credential for each cryptographic public key specified in the `attested_keys` claim within the `key_attestation` parameter.

Cryptographic algorithm names used in the `proof_signing_alg_values_supported` Credential Issuer metadata parameter for this proof type SHOULD be one of those defined in [@IANA.JOSE].
Cryptographic algorithm identifiers used in the `proof_signing_alg_values_supported` Credential Issuer metadata parameter for this proof type are case sensitive strings and SHOULD be one of those defined in [@IANA.JOSE].

Below is a non-normative example of a `proof` parameter (with line breaks within values for display purposes only):

Expand Down Expand Up @@ -1025,7 +1025,7 @@ When a W3C Verifiable Presentation as defined by [@VC_DATA_2.0] or [@VC_DATA] si

The Credential Issuer MUST validate that the W3C Verifiable Presentation used as a proof is actually signed with a key in the possession of the Holder.

Cryptographic algorithm names used in the `proof_signing_alg_values_supported` Credential Issuer metadata parameter for this proof type SHOULD be one of those defined in [@LD_Suite_Registry].
Cryptographic algorithm identifiers used in the `proof_signing_alg_values_supported` Credential Issuer metadata parameter for this proof type are case sensitive strings and SHOULD be one of those signature suite identifiers defined in [@LD_Suite_Registry].

Below is a non-normative example of a `proof` parameter:

Expand Down Expand Up @@ -1447,9 +1447,9 @@ This specification defines the following Credential Issuer Metadata parameters:
* `format`: REQUIRED. A JSON string identifying the format of this Credential, i.e., `jwt_vc_json` or `ldp_vc`. Depending on the format value, the object contains further elements defining the type and (optionally) particular claims the Credential MAY contain and information about how to display the Credential. (#format-profiles) contains Credential Format Profiles introduced by this specification.
* `scope`: OPTIONAL. A JSON string identifying the scope value that this Credential Issuer supports for this particular Credential. The value can be the same across multiple `credential_configurations_supported` objects. The Authorization Server MUST be able to uniquely identify the Credential Issuer based on the scope value. The Wallet can use this value in the Authorization Request as defined in (#credential-request-using-type-specific-scope). Scope values in this Credential Issuer metadata MAY duplicate those in the `scopes_supported` parameter of the Authorization Server.
* `cryptographic_binding_methods_supported`: OPTIONAL. Array of case sensitive strings that identify the representation of the cryptographic key material that the issued Credential is bound to, as defined in (#credential-binding). Support for keys in JWK format [@!RFC7517] is indicated by the value `jwk`. Support for keys expressed as a COSE Key object [@!RFC8152] (for example, used in [@!ISO.18013-5]) is indicated by the value `cose_key`. When the Cryptographic Binding Method is a DID, valid values are a `did:` prefix followed by a method-name using a syntax as defined in Section 3.1 of [@!DID-Core], but without a `:`and method-specific-id. For example, support for the DID method with a method-name "example" would be represented by `did:example`.
* `credential_signing_alg_values_supported`: OPTIONAL. Array of case sensitive strings that identify the algorithms that the Issuer uses to sign the issued Credential. Algorithm names used are determined by the Credential Format and are defined in (#format-profiles).
* `credential_signing_alg_values_supported`: OPTIONAL. Array of algorithm identifiers that the Issuer uses to sign the issued Credential. Algorithm identifier types and values used are determined by the Credential Format and are defined in (#format-profiles).
* `proof_types_supported`: OPTIONAL. Object that describes specifics of the key proof(s) that the Credential Issuer supports. This object contains a list of name/value pairs, where each name is a unique identifier of the supported proof type(s). Valid values are defined in (#proof-types), other values MAY be used. This identifier is also used by the Wallet in the Credential Request as defined in (#credential-request). The value in the name/value pair is an object that contains metadata about the key proof and contains the following parameters defined by this specification:
* `proof_signing_alg_values_supported`: REQUIRED. Array of case sensitive strings that identify the algorithms that the Issuer supports for this proof type. The Wallet uses one of them to sign the proof. Algorithm names used are determined by the key proof type and are defined in (#proof-types).
* `proof_signing_alg_values_supported`: REQUIRED. Array of algorithm identifiers that the Issuer supports for key proofs. The Wallet uses one of them to sign the proof. Algorithm identifier types and values are determined by the key proof type and are defined in (#proof-types).
* `key_attestations_required`: OPTIONAL. Object that describes the requirement for key attestations as described in (#keyattestation), which the Credential Issuer expects the Wallet to send within the proof of the Credential Request. If the Credential Issuer does not require a key attestation, this parameter MUST NOT be present in the metadata. If both `key_storage` and `user_authentication` parameters are absent, the `key_attestations_required` parameter may be empty, indicating a key attestation is needed without additional constraints.
* `key_storage`: OPTIONAL. Array defining values specified in (#keyattestation-apr) accepted by the Credential Issuer.
* `user_authentication`: OPTIONAL. Array defining values specified in (#keyattestation-apr) accepted by the Credential Issuer.
Expand Down Expand Up @@ -1922,6 +1922,15 @@ regulation), the Credential Issuer should properly authenticate the Wallet and e
</front>
</reference>

<reference anchor="IANA.COSE" target="https://www.iana.org/assignments/cose/cose.xhtml">
<front>
<title>CBOR Object Signing and Encryption (COSE)</title>
<author>
<organization>IANA</organization>
</author>
</front>
</reference>

<reference anchor="OpenID4VP" target="https://openid.net/specs/openid-4-verifiable-presentations-1_0.html">
<front>
<title>OpenID for Verifiable Presentations</title>
Expand Down Expand Up @@ -2074,7 +2083,7 @@ When the `format` value is `jwt_vc_json`, the entire Credential Offer, Authoriza

#### Credential Issuer Metadata {#server-metadata-jwt-vc-json}

Cryptographic algorithm names used in the `credential_signing_alg_values_supported` parameter SHOULD be one of those defined in [@IANA.JOSE].
Cryptographic algorithm identifiers used in the `credential_signing_alg_values_supported` parameter are case sensitive strings and SHOULD be one of those JWS algorithm names defined in [@IANA.JOSE].

The following additional Credential Issuer metadata parameters are defined for this Credential Format for use in the `credential_configurations_supported` parameter, in addition to those defined in (#credential-issuer-parameters).

Expand Down Expand Up @@ -2124,7 +2133,7 @@ Note: Data Integrity used to be called Linked Data Proofs, hence the "ldp" in th

#### Credential Issuer Metadata {#server-metadata-ldp-vc}

Cryptographic algorithm names used in the `credential_signing_alg_values_supported` parameter SHOULD be one of those defined in [@LD_Suite_Registry].
Cryptographic algorithm identifiers used in the `credential_signing_alg_values_supported` parameter are case sensitive strings and SHOULD be one of those signature suite identifiers defined in [@LD_Suite_Registry].

The following additional Credential Issuer metadata parameters are defined for this Credential Format for use in the `credential_configurations_supported` parameter, in addition to those defined in (#credential-issuer-parameters):

Expand Down Expand Up @@ -2190,12 +2199,14 @@ The Credential Format Identifier is `mso_mdoc`. This refers to the Mobile Securi

### Credential Issuer Metadata {#server-metadata-mso-mdoc}

Cryptographic algorithm names used in the `credential_signing_alg_values_supported` parameter SHOULD be one of those defined in [@!ISO.18013-5].
Cryptographic algorithm identifiers used in the `credential_signing_alg_values_supported` parameter are numeric values and SHOULD be one of those COSE algorithm values defined in [@IANA.COSE].

The following additional Credential Issuer metadata parameters are defined for this Credential Format for use in the `credential_configurations_supported` parameter, in addition to those defined in (#credential-issuer-parameters).

* `doctype`: REQUIRED. String identifying the Credential type, as defined in [@!ISO.18013-5].
* `claims`: OPTIONAL. An array of claims description objects as defined in (#claims-description-issuer-metadata).
* `credential_signing_crv_values_supported`: OPTIONAL. Array of cryptographic curve identifiers that the Issuer uses with one of the algorithms listed in `credential_signing_alg_values_supported` to sign the issued Credential. Curve identifier types and values used are numeric values and SHOULD be one of those COSE eliptic curve values defined in [@IANA.COSE]. Note that `credential_signing_crv_values_supported` MAY be used if one of the algorithms in `credential_signing_alg_values_supported` supports multiple curves.


The following is a non-normative example of an object containing the `credential_configurations_supported` parameter for Credential Format `mso_mdoc`:

Expand Down Expand Up @@ -2230,7 +2241,7 @@ The Credential Format Identifier is `dc+sd-jwt`.

### Credential Issuer Metadata {#server-metadata-sd-jwt-vc}

Cryptographic algorithm names used in the `credential_signing_alg_values_supported` parameter SHOULD be one of those defined in [@IANA.JOSE].
Cryptographic algorithm identifiers used in the `credential_signing_alg_values_supported` parameter are case sensitive strings and SHOULD be one of those JWS algorithm names defined in [@IANA.JOSE].

The following additional Credential Issuer metadata parameters are defined for this Credential Format for use in the `credential_configurations_supported` parameter, in addition to those defined in (#credential-issuer-parameters).

Expand Down Expand Up @@ -2756,7 +2767,9 @@ The technology described in this specification was made available from contribut

-16

*
* make type and values for credential_signing_alg_values_supported format specific
* change algorithm identifiers for credential_signing_alg_values_supported to COSE algorithm values for mdocs
* add credential_signing_crv_values_supported to mdoc format

-15

Expand Down