Response Encryption : Why HPKE without JSON envelope

The encryption for The Digital Credential Response should be specified in detail to ensure interoperability. Since the API is one-shot and doesn’t allow for negotiation, there should be a single encryption method. Negotiation would lead to privacy leaks.

Why HPKE ?

• HPKE is format-agnostic, unlike JARM, which is JWT-specific. This means that when used in transmission modes where JWT isn’t appropriate, a different encryption mechanism is needed.
• JARM requires the transmission of all authenticated information, including APU, and AVP headers. However, there are security benefits in not sending all information and providing it on both sides.
• The JSON envelope adds complexity that provides little value when HPKE is used.
• HPKE as a mechanism has support on native platform libraries.
• In constrained environments like UICC, SE, etc., dealing with JSON structures can be very challenging.

Review the Digital Credential Response encryption discussion, focusing first on the stated HPKE, JARM, and JSON-envelope tradeoffs. Done means the interoperability requirements and single encryption approach are specified in sufficient detail; no file or test is named in the payload.