openid / openid/OpenID4VP

Handling DCQL Queries Without the claims Field

Open
#764 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
112
Forks
38
Avg merge
12d 19h
Merged PRs (30d)
4

Description

How should a Wallet correctly handle a DCQL query in which the claims parameter is omitted from the credential query?

Case 1: mso_mdoc
{
  "dcql_query": {
    "credentials": [
      {
        "id": "query_0",
        "format": "mso_mdoc",
        "meta": {
          "doctype_value": "eu.europa.ec.eudi.pid.1"
        }
      }
    ]
  },
  "nonce": "136075ef-8f35-469e-8e11-5ebdced7317e",
  "request_uri_method": "get",
  "profile": "openid4vp",
  "authorization_request_uri": "openid4vp://"
}

How should this request be handled for an mso_mdoc credential?

Should the Wallet return a DeviceResponse containing the IssuerAuth, including its protected header and signature, but without any issuer-signed namespaces or data elements?

In other words, should the nameSpaces object be empty or omitted while the issuer authentication data is still included?

or do not return any credentials at all?

Case 2: dc+sd-jwt
{
  "dcql_query": {
    "credentials": [
      {
        "id": "query_0",
        "format": "dc+sd-jwt",
        "meta": {
          "vct_values": [
            "urn:eudi:pid:1"
          ]
        }
      }
    ]
  },
  "nonce": "b58bc78e-5063-46ee-82df-e6ef27d93c69",
  "request_uri_method": "get",
  "profile": "openid4vp",
  "authorization_request_uri": "openid4vp://"
}

How should this request be handled for a dc+sd-jwt credential?

Should the Wallet return:

  • the issuer-signed JWT, including its header, payload, and signature;
  • the Key Binding JWT, including its header, payload, and signature;
  • no disclosures?

Should the issuer-signed JWT payload remain unchanged, while only the disclosures are omitted? Or are any parts of the SD-JWT presentation expected to be empty when no claims are explicitly requested?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing the two DCQL examples and the expected mso_mdoc and dc+sd-jwt presentation contents described in the issue. Document the decided behavior for omitted claims, including whether issuer authentication or signed JWTs remain present and whether namespaces or disclosures are empty or omitted.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, security
Issue type
Documentation
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.