Option to include TLS certificate thumbprint/hash in signed metadata for improved MitM protection
Open
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 125
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
Analyzing Man-in-the-Middle attacks on OpenID4VP and OpenID4VCI, it seems that
- for OpenID4VP you require basically no trust in the webPKI, if the RP certificate signs the whole Authorization Request and you use additional application-level encryption
- for OpenID4VCI, the Issuer may sign its metadata, but that basically gives no protection to MitM, if you don't trust the webPKI
One of my colleagues proposed to include a TLS certificate/public key hash/thumbprint, into the signed metadata. This way the signed metadata may easily "vouch" for a TLS session. Additionally, the Issuer can very easily update the signed metadata for roll-over of TLS certificates.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the OpenID4VCI signed metadata and the MitM scenarios described in the issue. No files, tests, or entry points are named; the work is complete only after the proposal's scope, metadata representation, TLS rollover behavior, and interoperability expectations are defined.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100