openid / openid/OpenID4VP

DCQL - can a verifier request selectively disclosable fields that may or may not be present in the VC

Open
#688 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
112
Forks
38
Avg merge
12d 19h
Merged PRs (30d)
4

Description

Can a DCQL query be constructed for the following scenario?

  • An mdoc document type with around 50-ish data elements out of which around 40 are optional (issuers may or may not include them in the VC).
  • This document type is used by tens of different issuers. Each issuer could use a different combination of optional fields.
  • Furthermore, even within one issuer different combinations could be used depending on what data on the holder of the document the issuer has available. This is all to say that there are essentially unlimited amount of combinations - a combinatorial blowout.
  • The verifiers need to request all the data that the holder has available.

Based on section 6.4.1 the answer seems to be no. Am I correct or have I overlooked something?

  • If the verifier provides no claims query, then the wallet must not present any data as all data elements in mdoc format seem to be selectively disclosable. Specification states: "The Wallet MUST return only the claims that are mandatory to present"
  • If verifier adds all data elements to the claims query the wallet can only respond if it has all the claims available: "If the Wallet cannot deliver all claims requested by the Verifier according to these rules, it MUST NOT return the respective Credential."
  • One idea on how to solve this would be to add different combinations of claims_sets to the query ordering them by the amount of information requested. However, this idea is not workable due to the combinatorial blowout

While the scenario I've described here is quite specific, if my assumptions are correct, it seems to point to larger issue that DCQL does not work well with optional data if those fields are selectively disclosable. In previous drafts, I believe, it was possible to request credentials solely by doctype/namespace.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read section 6.4.1 and the DCQL claims query and claims_sets rules cited in the issue. Determine whether a verifier can request all available optional, selectively disclosable mdoc fields without enumerating combinations, then document the answer or the specification gap.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, documentation, security
Issue type
Documentation
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.