openid / openid/OpenID4VC-HAIP
Requirements for JWK in key attestation `attested_keys`
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 57
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
The exact fields present in a JWK is a frequent cause of interoperability problems.
We don't currently appear to have an language (in VCI or HAIP) that says whether kid, use, alg are required to be sent, so issuers & wallets are likely to make different assumption.
I'm not fully thought it through but in the general case people seem to like it when kid is present so we might want to at least mandate that in HAIP.
If we're not going to mandate it then it would probably be good to be clear that implementations need to tolerate kid being absent.
Whatever we do decide to say should probably apply to the jwk in the openid4vci-proof+jwt header.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the relevant VCI and HAIP language for JWKs in key attestation and the openid4vci-proof+jwt header. Decide whether kid, use, and alg are required, and document how implementations should behave when kid is absent; done means the requirement is stated consistently in both contexts.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100