How should a signed request (JAR) using `x509_san_dns` but also including a `did` in the kid be interpreted?
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 112
- Forks
- 38
- Avg merge
- 12d 19h
- Merged PRs (30d)
- 4
Description
E.g for OID4VCI I see for key attestations there's an issue whether x5c, kid and jwk needs to be mutually exclusive (https://github.com/openid/OpenID4VCI/issues/417).
We initially required this approach for JAR as well, however we saw quite some implementations using both x5c and kid, so we loosened it so that kid can be combined with x5c or jwk, but ONLY if kid is not a did.
Now we also ran into implementations that include x5c and kid (which is a did), pointing to the same key, while x509_san_dns is used.
Some guidance would be appreciated. Should the request only include one of these header values? Should we loosen our implementations, and only look at what is described by the client_id_scheme?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the JAR and x509_san_dns guidance described in this issue, then compare the related OpenID4VCI issue 417. The work is done when the project has an agreed interpretation of requests combining x5c, kid, jwk, and a DID, including whether implementations should enforce exclusivity or follow client_id_scheme.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100