From c5741bde8be1e92c14de5380cdd0f5c1a9ad5219 Mon Sep 17 00:00:00 2001 From: Orie Steele Date: Mon, 26 Jun 2023 10:22:25 -0500 Subject: [PATCH 01/16] Add comments on key discovery --- index.html | 100 ++++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 96 insertions(+), 4 deletions(-) diff --git a/index.html b/index.html index 809913f5..4876f006 100644 --- a/index.html +++ b/index.html @@ -126,7 +126,7 @@
Verifiable Credentials Data Model

Securing JSON

This section - provides guidance on how to use JSON [[RFC7159]] claimsets with JWT registered claims to construct + provides guidance on how to use JSON [[RFC7159]] claimsets with JWT registered claims to construct a JWT that can be mapped to a verifiable credential. This section also describes how to use content types and token types to distinguish different representations of verifiable credentials.

@@ -321,6 +321,97 @@

Securing JSON-LD VCs with COSE

+ + +
+

Key Discovery

+

+In order to complete the verification process, +a verifier needs to obtain the cryptographic keys used to secure the +credential. +

+

+There are several different ways to discover the issuers +and holders +verification keys. +

+ +
+

Registered Claim Names

+

+ When present in the Protected Header, or + the Protected Claimset members present in + IANA Assignments for JSON Web Token (JWT) and + IANA Assignments for JSON Object Signing and Encryption (JOSE) + are to be interpreted according to the associcated specifications referenced by IANA. +

+

+Registered claims that are present in either the Protected Header, +or the Claimset can be used to help +verifiers discover verification keys. +

+
+

kid

+

+If kid is present in the Protected Header, +a verifier can use this parameter +to obtain a JSON Web Key to use in the +verification process. +

+
+
+

iss

+

+If iss is present in the Protected Header, +a verifier can use this parameter +to obtain a JSON Web Key to use in the +verification process. +

+

+

+If iss is present in the JWT Claims , +a verifier can use this parameter +to obtain a JSON Web Key to use in the +verification process. +

+If kid is also present, it is expected to be useful to distinguish the specific key used. +

+
+ +
+

cnf

+

+If cnf is present in the Protected Header, +a verifier can use this parameter +to obtain a JSON Web Key to use in the +verification process. +

+

+

+If cnf is present in the JWT Claims , +a verifier can use this parameter +to obtain a JSON Web Key to use in the +verification process. +

+If kid is also present, it is expected to be useful to distinguish the specific key used. +

+
+
+ +
+

Well Known URIs

+

+The working group is currently exploring how +Defining Well-Known Uniform Resource Identifiers (URIs) +could be leveraged to assist a verifiers in discoverying verification keys for +issuers +and holders. +

+
+ + +
+

JSON Web Token Header Parameters

@@ -347,7 +438,7 @@

JSON Web Token Header Parameters

This includes but is not limited to: iss, kid, alg, iat, exp and cnf.

-The registered claim names vc and vp MUST NOT be present as header parameters. +The registered claims names vc and vp MUST NOT be present as header parameters.

When present, members of the header are to be interpreted and processed according to @@ -360,7 +451,7 @@

JSON Web Token Header Parameters

Securing Verifiable Credentials

-

The [[VC-DATA-MODEL]] describes the approach taken by JSON Web Tokens to securing claimsets as applying an external proof.

+

The describes the approach taken by JSON Web Tokens to securing claimsets as applying an external proof.

The normative statements in Securing Verifiable Credentials apply to securing application/vc+ld+json and application/vp+ld+json as application/vc+ld+jwt and application/vp+ld+jwt. @@ -419,6 +510,7 @@

Securing Verifiable Credentials

Issuers, Holders and Verifiers MUST ignore all claimsets that have no integrity protection.

+
@@ -951,7 +1043,7 @@

Example Mapping