[S2S]: Replay Protection
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 125
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
@c2bo - "I might be wrong, but given the current definitions, how are we guaranteeing freshness / preventing replay - I don't see an issuer provided input currently (since sessionID is potentially long-lasting)?"
Opening Issue to tracking freshness property of the signatures in the protocol. Currently it makes use of wallet-generated randomness and then, by design, does not require freshness for things like device keys, verification data etc.
originally in https://github.com/openid/OpenID4VCI/pull/753/changes#r3516024417
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the current protocol definitions and the discussion in PR #753, especially the cited review comment. Clarify the freshness and replay-protection requirements for signatures, then document the resulting protocol change and its acceptance criteria.
Written by the indexing model from the issue text.
Assessment
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100