openid / openid/OpenID4VC-HAIP
Remove requirement for iss in wallet attestations
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 57
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
Attestaiton-Based Client Authentication says regarding the Client Attestation JWT:
iss: REQUIRED. The iss (issuer) claim MUST contains a unique identifier for the entity that issued the JWT. In the absence of an application profile specifying otherwise, compliant applications MUST compare issuer values using the Simple String Comparison method defined in Section 6.2.1 of [RFC3986].
As HAIP decides to mandate x5c for wallet attestation and this is what would be referenced for trust management, the iss value becomes obsolete and HAIP could say that iss can be omitted.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the cited Client Attestation JWT requirements in Attestation-Based Client Authentication and the HAIP requirements for x5c-based trust management. Update the relevant HAIP specification text so it clearly states whether the iss claim may be omitted, then verify that the wording is consistent with the profile's trust model.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100