Move credential format specific details into per-format annexes - #57
Open
jogu wants to merge 7 commits into
Open
Move credential format specific details into per-format annexes#57jogu wants to merge 7 commits into
jogu wants to merge 7 commits into
Conversation
Structure agreed at the 2026-08-31 meeting: one normative annex per credential format, with a generic extension point so other documents can define further formats. - New "Credential Formats" clause: the protocol is format agnostic, a "credential format definition" shall specify the ten items from #36, and the main body no longer names any format or annex. - New annexes for ISO mdoc and SD-JWT VC with identical headings in the order of the #21/#22 checklists; existing format text moves there. - format_extensions and CredentialItem.data become CDDL sockets ($formatExtensions, $CredentialData); the undefined ZkDocument / zkFormatExtensions alternatives go away. - ISO/IEC 18013-5, RFC 9901 and draft-ietf-oauth-sd-jwt-vc added to Normative references. - SD-JWT VC format identifier is now dc+sd-jwt; vc+sd-jwt as a mimetype means a w3c vc encoded in sd-jwt; vp uses dc+sd-jwt. New text added by this PR: case-sensitive credential_type matching; mdoc elements may be issuer- or device-signed; mdoc issuer identifiers match the AKI of a certificate in the IssuerAuth x5chain; KB-JWT may be omitted only when support_no_cryptographic_binding is true; for mdocs that flag maps to nonKeyBoundSupported from the 18013-5 second edition DIS text (#56). Left "To be completed": value matching (#9), transaction data (#4), SessionTranscript derivation and KB-JWT nonce/aud (#10), non-X.509 issuer identification for SD-JWT VC. Raised separately: array elements in path (#52), vct inheritance (#53), mdoc alg value names and matching rule (#54) There's now no mention of ZKP responses - that's already recorded in #17 closes #21, #22, #36
|
📄 Editor's Copy preview Preview of 324cb2c; updated on every push. For review only — the official specifications are published at https://openid.net/specs/ |
Contributor
Author
|
Joseph presented this on today's PR. Oliver & Martijn agreed to review. The CDDL socket syntax wasn't familiar to people on the call and maybe we want to consider other options, but that's editorial and as it is may be more readable to AIs. |
The SD-JWT VC annex only said the x509_ref values are compared against the x5c chain, without saying what outcome satisfies the request. Use the same rule as the mdoc annex.
The previous text let the wallet drop the KB-JWT from a key-bound SD-JWT VC whenever support_no_cryptographic_binding was true. That is a downgrade the mdoc annex does not permit (a key-bound mdoc always carries DeviceSigned) and OpenID4VP does not permit either. Tie the permission to the absence of cnf, matching the mdoc rule.
IssuerSignedItems is not a structure in ISO/IEC 18013-5; the standard has IssuerSignedItem entries under IssuerNameSpaces and DeviceSignedItems under DeviceNameSpaces.
The mdoc annex introduction presented its list as the structures the annex refers to, but omitted IssuerAuth, the MSO, KeyAuthorizations, IssuerNameSpaces, DeviceNameSpaces and DeviceSignedItems, all used later in the annex. The SD-JWT VC annex uses the x5c header, which comes from RFC 7515 rather than the SD-JWT documents.
The annexes say format carries the same value as credential_format, but the main-body table did not connect the field to the extension point.
The note that an mDL is always key-bound also relies on the unpublished second edition text, so move the editor's note ahead of it and say it covers both.
awoie
reviewed
Sep 13, 2026
|
|
||
| ISO/IEC 18013-5, *Personal identification — ISO-compliant driving licence — Part 5: Mobile driving licence (mDL) application* | ||
|
|
||
| IETF RFC 9901, *Selective Disclosure for JSON Web Tokens (SD-JWT)*, <https://www.rfc-editor.org/rfc/rfc9901> |
Contributor
There was a problem hiding this comment.
This is the title in RFC9901.
Suggested change
| IETF RFC 9901, *Selective Disclosure for JSON Web Tokens (SD-JWT)*, <https://www.rfc-editor.org/rfc/rfc9901> | |
| IETF RFC 9901, *Selective Disclosure for JSON Web Tokens*, <https://www.rfc-editor.org/rfc/rfc9901> |
awoie
reviewed
Sep 13, 2026
|
|
||
| # SD-JWT VC Credential Format {#annex-sd-jwt-vc} | ||
|
|
||
| This annex defines how the protocol specified in this document is used with SD-JWT VCs as defined in draft-ietf-oauth-sd-jwt-vc (SD-JWT VC), which builds on RFC 9901 (SD-JWT). It does not redefine the format: the structures referred to in this annex (Issuer-signed JWT, Disclosure, Key Binding JWT (KB-JWT), and the `vct`, `iss` and `cnf` claims) are defined in those documents; the `x5c` JOSE header is defined in RFC 7515 (JWS). |
Contributor
There was a problem hiding this comment.
Please include RFC 7515 in references.
awoie
requested changes
Sep 13, 2026
| ```cddl | ||
| $CredentialData /= Document | ||
|
|
||
| Document = bstr ; CBOR-encoded ISO/IEC 18013-5 Document structure |
Contributor
There was a problem hiding this comment.
Not sure if this correct. A byte string containing an encoded map is not the same type as the map. Note that further up, we define Document as defined in ISO 18013-5 with docType etc map elements.
Contributor
|
Furthermore, we might need to create an issue to fix the toolchain (not necessarily in this PR) because the word document numbers the annexes as ordinary clauses, e.g., "13 ISO mdoc Credential Format". |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Structure agreed at the 2026-08-31 meeting: one normative annex per credential format, with a generic extension point so other documents can define further formats.
New text added by this PR: case-sensitive credential_type matching; mdoc elements may be issuer- or device-signed; mdoc issuer identifiers match the AKI of a certificate in the IssuerAuth x5chain; KB-JWT may be omitted only when support_no_cryptographic_binding is true; for mdocs that flag maps to nonKeyBoundSupported from the 18013-5 second edition DIS text (#56).
Left "To be completed": value matching (#9), transaction data (#4), SessionTranscript derivation and KB-JWT nonce/aud (#10), non-X.509 issuer identification for SD-JWT VC.
Raised separately: array elements in path (#52), vct inheritance (#53), mdoc alg value names and matching rule (#54)
There's now no mention of ZKP responses - that's already recorded in #17
closes #21, #22, #36