How to convey RP metadata to be shown to the user?

Wallet gets information from:

• request

• cert

• well-known

• Logo seems important, but not a blocker

• bare minimum information is

  • name
  • logo
  • privacy terms

• What do we show if request is multi-signed?

  • include hash of [name,logo,privacy_tos] in cert to avoid duplicate logos
  • put [name,logo,privacy_tos] in request, match to hash in cert

request

• potentially self-asserted, phishing issue?

cert

• secure but potentially cumbersome
• could only include a hash as optimization for multi-signed requests
• this is what eIDAS does (but doesn't have a logo in there yet)

well-known

• requires network calls, problems if not fetched in time
• potentially self-asserted, phishing issue?
• doesn't work for offline flows

Summary

Cert seems the least problematic solution
todo:

1. define mechanism in VP
2. define x509 extension

Start by comparing the request, certificate, and well-known metadata paths described in the issue, including the multi-signed request case. Review the existing VP and X.509 structures, then define the mechanism and extension once the phishing, offline, and network-fetch tradeoffs are resolved; done means both TODOs have an agreed specification.