Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: add recommedation about public key used in the jwt proof #267

Merged
merged 5 commits into from
May 10, 2024
Merged

chore: add recommedation about public key used in the jwt proof #267

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9c0e6bd
chore: add recommedation about public key used in the jwt proof
peppelinux Apr 16, 2024
0d6aa2f
Update docs/en/pid-eaa-issuance.rst
peppelinux Apr 16, 2024
f866709
Update docs/en/pid-eaa-issuance.rst
peppelinux Apr 16, 2024
2d62c56
fix: remove DPoP / jwt proof binding
peppelinux Apr 19, 2024
82548a2
Mart Aarma added in the acknowledgments section
peppelinux Apr 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/en/contribute.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ implementation profile and to the initial set of implementations.
- Kristina Yasuda
- Leif Johansson
- Lorenzo Cerini
- Mart Aarma
- Marta Sciunnach
- Michele Silletti
- Nicola Saitto
Expand Down
7 changes: 6 additions & 1 deletion docs/en/pid-eaa-issuance.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -322,6 +322,11 @@ The ``client_assertion`` is signed using the private key that is created during

**PID/(Q)EAA Credential Schema and Status registration:** The PID/(Q)EAA Provider MUST register all the issued Credentials for their later revocation, if needed.

peppelinux marked this conversation as resolved.
Show resolved Hide resolved

.. note::

It is RECOMMENDED that the public key contained in the ``jwt_proof`` be specifically generated for the requested Credential (fresh cryptographic key) to ensure that different issued Credentials do not share the same public key, thereby remaining unlinkable to each other.

.. code-block::

POST /credential HTTP/1.1
Expand Down Expand Up @@ -892,7 +897,7 @@ The JWT proof type MUST contain the following parameters for the JOSE header and
- It MUST be set to `openid4vci-proof+jwt`.
- `[OIDC4VCI. Draft 13] <https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html>`_, [:rfc:`7515`], [:rfc:`7517`].
* - **jwk**
- Representing the public key chosen by the Wallet Instance, in JSON Web Key (JWK) [:rfc:`7517`] format that the PID/(Q)EAA shall be bound to, as defined in Section 4.1.3 of [:rfc:`7515`]. The ``jwk`` value MUST be equal to the same public key that is generated for the DPoP.
- Representing the public key chosen by the Wallet Instance, in JSON Web Key (JWK) [:rfc:`7517`] format that the PID/(Q)EAA shall be bound to, as defined in Section 4.1.3 of [:rfc:`7515`].
- `[OIDC4VCI. Draft 13] <https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html>`_, [:rfc:`7515`], [:rfc:`7517`].

.. list-table::
Expand Down
Loading