`iss` in Key Proof, conditionally required or generally optional?
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 125
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
There were different interpretations during the LSP interop event whether the iss element in key proof (both jwt and cwt) is conditionally required or generally optional?
In Section 7.2.1.1. (and 7.2.1.3.) it says:
iss: OPTIONAL (string). The value of this claim MUST be the client_id of the Client making the Credential request. This claim MUST be omitted if the access token authorizing the issuance call was obtained from a Pre-Authorized Code Flow through anonymous access to the token endpoint.
Is there a reason to make it optional in the case the client_id is known to the issuer?
I would prefer to change it to REQUIRED when ..., MUST NOT ... (as has been done elsewhere)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing Sections 7.2.1.1 and 7.2.1.3 in the OpenID4VCI draft, focusing on the normative wording for the iss claim in JWT and CWT key proofs. Compare the optional and conditionally required interpretations, then determine whether the specification should consistently require or omit iss in the stated access-token case.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100