DCQL queries w.r.t batches of linkable mdocs or batches of unlinkable mdocs
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 19
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
A verifier can request a holder to present two different types of digital presentation proofs:
(a) digital presentation proofs that are linkable by the same or different verifiers, or
(b) digital presentation proofs that are unlinkable by the same or different verifiers.
In the case (a), such types of digital presentation proofs can be requested by governmental agencies from a same country
where the ability to link user accounts is required.
In the case (b), such types of digital presentation proofs can be requested, if the authentication of the holder is not required by the verifier
and if the third privacy principle from ISO/IEC 29100 called 'collection limitation' is supported by the verifier.
As a consequence a verifier should be able to:
- ask what type of digital presentation proof he wishes to receive [1] and
- verify whether a received digital presentation proof match the expected type of digital presentation proof [2].
Currently, the body of the ISO/IEC 18013-5 standard does not support unlinkable mdocs and only mentions them in an Informative Annex.
See Annex E (informative) Privacy and security recommendations and Table E.1, item 10.
However, OpenID for Verifiable Presentations (OID4VP) considers verifier-to-verifier unlinkable presentations in Section 15.5,
while OpenID for Verifiable Credential Issuance (OID4VCI) supports batch credential issuance in Section 12.2.4.
To summarize, an mdoc app can manage two sets of mdoc batches:
- a set of mdocs where each of them is linkable and
- another set of mdocs where each of them is unlinkable.
A linkable mdoc can be presented several times to a set of verifiers that require linkable mdocs.
An unlinkable mdoc shall only be presented once.
Can the current documents (i.e. 18013-5 and OID4VP) supports these requirements ? Unfortunately, the answer is no.
Requirement [1]: OID4VP supports DCQL Queries but these queries do not currently allow to specify
whether linkable or unlinkable mdocs are requested by the verifier.
An additional parameter should be taken into account in the DCQL Query.
Requirement [2]: The current structure of an mdoc does not contain a parameter allowing :
- a verifier to determine whether received mdocs are indeed linkable or unlinkable, nor
- an mdoc app to determine whether a set of stored mdocs is linkable or unlinkable and
thus an mdoc app cannot provide the right type of mdoc to a verifier.
An additional parameter should be taken into account within an mdoc.
Note: While OID4VCI is outside the scope of DCHP, it should be noticed that, at this moment, an mdoc app has no possibility
to ask either a batch of linkable mdocs or a batch of unlinkable mdocs, nor to verify that received mdocs are linkable or unlinkable.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing ISO/IEC 18013-5 Annex E and Table E.1, then OID4VP Section 15.5 and the DCQL query requirements described in the issue. Determine how linkability should be requested and verified for batches of mdocs, and document the agreed changes to the relevant standards or data structures.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100