openid / openid/OpenID4VC-HAIP

JSON serialization of SD-JWT VC isn't actually usable in practice

Open
#380 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Makefile
Stars
57
Forks
17
PR merge metrics
No merged PRs in 30d

Description

When defining the SD-JWT VC profile, https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0.html#section-6.1-2.1 says:

Compact serialization MUST be supported as defined in [RFC9901]. JSON serialization MAY be supported.

I think 'JSON serialization MAY be supported.' isn't a useful statement. It doesn't say who may support it. There is no defined way for verifiers to say they support it, so I think the wallet can't ever sensibly returned the JSON serialisation.

There were various discussions about this ( https://github.com/openid/OpenID4VC-HAIP/issues/31 / https://github.com/openid/OpenID4VC-HAIP/pull/46 ) - in the PR it was originally:

JSON serialization MAY be supported if required by the jurisdiction

but then got changed to drop that jurisdiction clause. JAdES-style long-term validation and issuer multisig were cited as reasons to support JSON serialization. But I can't see an interoperable way to actually do it, so deleting the 'JSON serialization MAY be supported.' might be the best outcome.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read section 6.1-2.1 of the HAIP specification and RFC9901, then review the related discussion in issue 31 and pull request 46. Determine whether JSON serialization can be advertised interoperably, and update the profile wording and related references to reflect the agreed rule.

Written by the indexing model from the issue text.

Assessment

Tech stack
json
Domain
authentication, security
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.