Requirements on how the holder binding (proof) JWK is translated into the credential?
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 125
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
This issue came up with our own issuer and wallet where the wallet started including a kid in the JWK provided to the issuer. This kid is used to identify the key being used to create presentations for the credential.
Our issuer did not use the JWK fully as provided, but instead used a subset of the fields (the important public key material needed to verify a presentation, for which the kid is not needed) and used that as the cnf/deviceKey value.
Should issuers use the JWK provided by the holder (or the wallet provider through an attestation) directly for the credential (in case of mdoc translate it to a COSE key), or can a wallet not expect properties like kid to be kept in the issued credential (cnf/deviceKey)?
If so, maybe some requirements should be added to require this? Alternatively we could store the kid somewhere else outside the credential.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the issue's question about preserving the holder-provided JWK, including kid, when translating it to cnf/deviceKey and to an mdoc COSE key. Resolve whether the specification should require direct preservation or define another location for kid; done means the requirement and handling are stated unambiguously.
Written by the indexing model from the issue text.
Assessment
- Domain
- cryptography, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100