openid / openid/OpenID4VC-HAIP
Must trust roots use the same algorithms as leaf certificates
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 57
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
Currently the text is unclear whether trust roots must use the same algorithms as the leaf certificates.
For example:
- Root (ES384)
- Leaf (ES256) with ES384 signature from Root
- Key Attestation with ES256 signature from Leaf
- Issuer proof alg set to ["ES256"]
Would this be valid or invalid? The issuer has specified they support ES256 for the key attestation, but the trust root is ES384.
If this is invalid, that would effectively require any component that wishes to support multiple algorithms, be it for Credential, Wallet Attestation, Key Attestation, Verifier, to have a trust root per algorithm.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the requirement text concerning trust roots, leaf certificates, key attestations, and issuer proof algorithms. Determine whether the ES384 root and ES256 leaf example is valid, then clarify the specification so algorithm support across components and trust roots is unambiguous.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100