editorial: Credential response Encrypted, is it possibile having a nested JWT?
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 125
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
The response is an encrypted json and not a Netsted JWT, signed and then encrypted.
Is there any possibility that implementers look for having a Nested JWT? Probably not.
I would give more clarification, as OIDC with the userinfo response (or id token) made:
If the UserInfo Response is signed and/or encrypted, then the Claims are returned in a JWT and the content-type MUST be application/jwt. The response MAY be encrypted without also being signed. If both signing and encryption are requested, the response MUST be signed then encrypted, with the result being a Nested JWT, as defined in [JWT].
@sakimura @selfissued ^
Originally posted by @peppelinux in https://github.com/openid/OpenID4VCI/pull/136#discussion_r1421476039
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the issue text and the referenced discussion in pull request #136, then compare the quoted OpenID Connect UserInfo wording with the relevant OpenID4VCI editorial text. Done means the specification clearly states whether a signed-and-encrypted response is a nested JWT and gives the applicable response format and processing expectations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- json
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100