openid / openid/OpenID4VC-HAIP
text around self-signed certificates / excluding trust anchor not present in wallet attestation section
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 57
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0.html#section-4.4.1 doesn't contain these two items:
- The X.509 certificate of the trust anchor MUST NOT be included in the x5c JOSE header of the key attestation.
- The X.509 certificate signing the key attestation MUST NOT be self-signed.
which I think we include everywhere else we mention the x5c Jose header. I think we probably intended these to be the case in this case too.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with section 4.4.1 of the linked OpenID4VC High Assurance Interoperability Profile and compare its x5c JOSE header wording with the other places that mention x5c. The section is done when it explicitly includes both exclusions: no trust-anchor certificate in the key-attestation x5c header and no self-signed certificate for the key attestation.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100