From c5741bde8be1e92c14de5380cdd0f5c1a9ad5219 Mon Sep 17 00:00:00 2001
From: Orie Steele
This section
- provides guidance on how to use JSON [[RFC7159]] claimsets with JWT registered claims to construct
+ provides guidance on how to use JSON [[RFC7159]] claimsets with JWT registered claims to construct
a JWT that can be mapped to a verifiable credential. This section also describes
how to use content types and token types to distinguish different representations of verifiable credentials.
+In order to complete the verification process,
+a verifier needs to obtain the cryptographic keys used to secure the
+credential.
+
+There are several different ways to discover the issuers
+and holders
+verification keys.
+
+ When present in the Protected Header, or
+ the Protected Claimset members present in
+ IANA Assignments for JSON Web Token (JWT) and
+ IANA Assignments for JSON Object Signing and Encryption (JOSE)
+ are to be interpreted according to the associcated specifications referenced by IANA.
+
+Registered claims that are present in either the Protected Header,
+or the Claimset can be used to help
+verifiers discover verification keys.
+
+If
+If
+
+If Verifiable Credentials Data Model
Securing JSON
Securing JSON-LD VCs with COSE
+
+
+Key Discovery
+ Registered Claim Names
+ kid
+ kid
is present in the Protected Header,
+a verifier can use this parameter
+to obtain a JSON Web Key to use in the
+verification process.
+ iss
+ iss
is present in the Protected Header,
+a verifier can use this parameter
+to obtain a JSON Web Key to use in the
+verification process.
+ iss
is present in the JWT Claims ,
+a verifier can use this parameter
+to obtain a JSON Web Key to use in the
+verification process.
+ kid
is also present, it is expected to be useful to distinguish the specific key used.
+
+If cnf
is present in the Protected Header,
+a verifier can use this parameter
+to obtain a JSON Web Key to use in the
+verification process.
+
+
+If cnf
is present in the JWT Claims ,
+a verifier can use this parameter
+to obtain a JSON Web Key to use in the
+verification process.
+
kid
is also present, it is expected to be useful to distinguish the specific key used.
+
+ +The working group is currently exploring how +Defining Well-Known Uniform Resource Identifiers (URIs) +could be leveraged to assist a verifiers in discoverying verification keys for +issuers +and holders. +
+iss
, kid
, alg
, iat
, exp
and cnf
.
-The registered claim names vc
and vp
MUST NOT be present as header parameters.
+The registered claims names vc
and vp
MUST NOT be present as header parameters.
When present, members of the header are to be interpreted and processed according to @@ -360,7 +451,7 @@
The [[VC-DATA-MODEL]] describes the approach taken by JSON Web Tokens to securing claimsets as applying an external proof
.
The describes the approach taken by JSON Web Tokens to securing claimsets as applying an external proof
.
The normative statements in Securing Verifiable Credentials apply to
securing application/vc+ld+json
and application/vp+ld+json
as application/vc+ld+jwt
and application/vp+ld+jwt
.
@@ -419,6 +510,7 @@
Issuers, Holders and Verifiers MUST ignore all claimsets that have no integrity protection.
iss
, sub
, iat
, nbf
,
- exp
, jti
, and aud
as registered claims.
+ exp
, jti
, and aud
as Registered claims.
- When present in the Protected Header, or - the Protected Claimset members present in - IANA Assignments for JSON Web Token (JWT) and - IANA Assignments for JSON Object Signing and Encryption (JOSE) - are to be interpreted according to the associcated specifications referenced by IANA. +When present in the Protected Header, or +the Protected Claimset members present in +IANA Assignments for JSON Web Token (JWT) and +IANA Assignments for JSON Object Signing and Encryption (JOSE) +are to be interpreted according to the associcated specifications referenced by IANA.
Registered claims that are present in either the Protected Header,
From 07427cb47bc043010441ed8b553930e68a7de966 Mon Sep 17 00:00:00 2001
From: Orie Steele JSON Web Token Header Parameters
This includes but is not limited to: iss
, kid
, alg
, iat
, exp
and cnf
.
-The registered claims names vc
and vp
MUST NOT be present as header parameters.
+The registered claim names vc
and vp
MUST NOT be present as header parameters.
When present, members of the header are to be interpreted and processed according to
From ea70a52cafa594075bc99b8b8519e65270237e45 Mon Sep 17 00:00:00 2001
From: Orie Steele Key Discovery
credential.
-There are several different ways to discover the issuers -and holders -verification keys. +There are several different ways to discover the verification keys of +the issuers +and holders.
-When present in the Protected Header, or -the Protected Claimset members present in +When found in the Protected Header, or +the Protected Claimset, members present in IANA Assignments for JSON Web Token (JWT) and IANA Assignments for JSON Object Signing and Encryption (JOSE) -are to be interpreted according to the associcated specifications referenced by IANA. +are to be interpreted according to the associated specifications referenced by IANA.
Registered claims that are present in either the Protected Header,
From dad4ff708ef26e23337a5f243f9058ad7f78281a Mon Sep 17 00:00:00 2001
From: Orie Steele Registered Claim Names
are to be interpreted according to the associated specifications referenced by IANA.
-Registered claims that are present in either the Protected Header, +Registered claims that are present in either +the Protected Header or the Claimset can be used to help verifiers discover verification keys.
From 79e45d1e8cc80730ca2af0c568cace8271c51250 Mon Sep 17 00:00:00 2001 From: Orie Steele
-If cnf
is present in the Protected Header,
+If cnf
is present in the Protected Header
+or the JWT Claims ,
a verifier can use this parameter
to obtain a JSON Web Key to use in the
verification process.
-
-If cnf
is present in the JWT Claims ,
-a verifier can use this parameter
-to obtain a JSON Web Key to use in the
-verification process.
-
kid
is also present, it is expected to be useful to distinguish the specific key used.
The describes the approach taken by JSON Web Tokens to securing claimsets as applying an external proof
.
The describes the approach taken by JSON Web Tokens to secure claimsets as applying an external proof
.
The normative statements in Securing Verifiable Credentials apply to
securing
The working group is currently exploring how
Defining Well-Known Uniform Resource Identifiers (URIs)
-could be leveraged to assist a verifiers in discoverying verification keys for
+could be leveraged to assist a verifier in discovering verification keys for
issuers
and holders.
-If
-
-If application/vc+ld+json
and application/vp+ld+json
as application/vc+ld+jwt
and application/vp+ld+jwt
.
From aeb49e2e7fe9c49042d1c67eceffa9f9429d4ec6 Mon Sep 17 00:00:00 2001
From: Orie Steele Example Mapping
iss
, sub
, iat
, nbf
,
- exp
, jti
, and aud
as Registered claims.
+ exp
, jti
, and aud
as registered claims.
Well Known URIs
kid
iss
iss
is present in the Protected Header,
+If iss
is present in the Protected Header
+or the JWT Claims ,
a verifier can use this parameter
to obtain a JSON Web Key to use in the
verification process.
iss
is present in the JWT Claims ,
-a verifier can use this parameter
-to obtain a JSON Web Key to use in the
-verification process.
- kid
is also present, it is expected to be useful to distinguish the specific key used.
-If kid
is also present, it is expected to be useful to distinguish the specific key used.
+If kid
is also present in the
+Protected Header, it is expected to be useful to
+distinguish the specific key used.
-If kid
is also present, it is expected to be useful to distinguish the specific key used.
+If kid
is also present in the
+Protected Header, it is expected to be
+useful to distinguish the specific key used.
+ There are a few issues related to clarification of optionality and behavior of + registered claims. +
There are a few issues related to clarification of optionality and behavior of registered claims. -
+ The working group is still discussing how to close many related issues. +
+ + + + + + + +In order to complete the verification process, a verifier needs to obtain the cryptographic keys used to secure the