post quantum / PQC - how to do migration to post quantum signing with oid4vp over redirects
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 112
- Forks
- 38
- Avg merge
- 12d 19h
- Merged PRs (30d)
- 4
Description
It's not clear to me how you would do a gradual migration to post quantum signing with oid4vp for signing requests - the verifier needs to make the decision about whether it signs with a pre or post quantum alg, and it has to do that at a time it doesn't know if the wallet supports post quantum or not. There's no defined way to send multi signatures or multiple requests when using OID4VP over redirects.
(For DC API I believe this is fine, sending a multisigned request is possible, and failing that I think sending 2 requests is possible - though I'm not sure if 2 entries inside a DC API request can both use the same protocol identifier.)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the OID4VP signing-request flow over redirects and the issue's comparison with DC API. Determine how a verifier can discover wallet support and whether multisigned or multiple requests are possible; done means a decided, documented migration approach for pre- and post-quantum signing.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100