You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: draft-ietf-oauth-sd-jwt-vc.md
+17-32Lines changed: 17 additions & 32 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -238,37 +238,28 @@ registry as defined in [@!RFC7519].
238
238
239
239
The following registered JWT claims are used within the SD-JWT component of the SD-JWT VC and MUST NOT be included in the Disclosures, i.e., cannot be selectively disclosed:
240
240
241
-
*`iss`
242
-
* OPTIONAL. As defined in [@!RFC7519, section 4.1.1] this claim explicitly indicates the Issuer of the Verifiable Credential
241
+
*`iss`: OPTIONAL. As defined in [@!RFC7519, section 4.1.1] this claim explicitly indicates the Issuer of the Verifiable Credential
243
242
when it is not conveyed by other means (e.g., the subject of the end-entity certificate of an `x5c` header).
244
-
*`nbf`
245
-
* OPTIONAL. The time before which the Verifiable Credential MUST NOT be
243
+
*`nbf`: OPTIONAL. The time before which the Verifiable Credential MUST NOT be
246
244
accepted before validating. See [@!RFC7519] for more information.
247
-
*`exp`
248
-
* OPTIONAL. The expiry time of the Verifiable Credential after which the
245
+
*`exp`: OPTIONAL. The expiry time of the Verifiable Credential after which the
249
246
Verifiable Credential is no longer valid. See [@!RFC7519] for more
250
247
information.
251
-
*`cnf`
252
-
* OPTIONAL unless cryptographic Key Binding is to be supported, in which case it is REQUIRED. Contains the confirmation method identifying the proof of possession key as defined in [@!RFC7800]. It is RECOMMENDED that this contains a JWK as defined in Section 3.2 of [@!RFC7800]. For proof of cryptographic Key Binding, the KB-JWT in the presentation of the SD-JWT MUST be secured by the key identified in this claim.
253
-
*`vct`
254
-
* REQUIRED. The type of the Verifiable Credential, e.g.,
248
+
*`cnf`: OPTIONAL unless cryptographic Key Binding is to be supported, in which case it is REQUIRED. Contains the confirmation method identifying the proof of possession key as defined in [@!RFC7800]. It is RECOMMENDED that this contains a JWK as defined in Section 3.2 of [@!RFC7800]. For proof of cryptographic Key Binding, the KB-JWT in the presentation of the SD-JWT MUST be secured by the key identified in this claim.
249
+
*`vct`: REQUIRED. The type of the Verifiable Credential, e.g.,
255
250
`https://credentials.example.com/identity_credential`, as defined in (#type-claim).
256
-
*`vct#integrity`
257
-
* OPTIONAL. The hash of the Type Metadata document to provide integrity as defined in (#document-integrity).
258
-
*`status`
259
-
* OPTIONAL. The information on how to read the status of the Verifiable
251
+
*`vct#integrity`: OPTIONAL. The hash of the Type Metadata document to provide integrity as defined in (#document-integrity).
252
+
*`status`: OPTIONAL. The information on how to read the status of the Verifiable
260
253
Credential. See [@!I-D.ietf-oauth-status-list]
261
254
for more information. When the `status` claim is present and using the `status_list` mechanism, the associated Status List Token MUST be in JWT format.
262
255
263
256
The following registered JWT claims are used within the SD-JWT component of the SD-JWT VC and MAY be included in Disclosures, i.e., can be selectively disclosed:
264
257
265
-
*`sub`
266
-
* OPTIONAL. The identifier of the Subject of the Verifiable Credential.
258
+
*`sub`: OPTIONAL. The identifier of the Subject of the Verifiable Credential.
267
259
The Issuer MAY use it to provide the Subject
268
260
identifier known by the Issuer. There is no requirement for a binding to
269
261
exist between `sub` and `cnf` claims.
270
-
*`iat`
271
-
* OPTIONAL. The time of issuance of the Verifiable Credential. See
262
+
*`iat`: OPTIONAL. The time of issuance of the Verifiable Credential. See
272
263
[@!RFC7519] for more information.
273
264
274
265
#### Public and Private JWT claims
@@ -445,15 +436,12 @@ An error response uses the applicable HTTP status code value.
445
436
This specification defines the following JWT VC Issuer Metadata configuration
446
437
parameters:
447
438
448
-
*`issuer`
449
-
* REQUIRED. The Issuer identifier, which MUST be identical to the `iss`
439
+
*`issuer`: REQUIRED. The Issuer identifier, which MUST be identical to the `iss`
450
440
value in the JWT.
451
-
*`jwks_uri`
452
-
* OPTIONAL. URL string referencing the Issuer's JSON Web Key (JWK) Set
441
+
*`jwks_uri`: OPTIONAL. URL string referencing the Issuer's JSON Web Key (JWK) Set
453
442
[@!RFC7517] document which contains the Issuer's public keys. The value of
454
443
this field MUST point to a valid JWK Set document.
455
-
*`jwks`
456
-
* OPTIONAL. Issuer's JSON Web Key Set [@!RFC7517] document value, which
444
+
*`jwks`: OPTIONAL. Issuer's JSON Web Key Set [@!RFC7517] document value, which
457
445
contains the Issuer's public keys. The value of this field MUST be a JSON
458
446
object containing a valid JWK Set.
459
447
@@ -569,16 +557,12 @@ to the one in the `vct#integrity` claim in the SD-JWT VC payload,
569
557
The Type Metadata document MUST be a JSON object. The following properties are
570
558
defined:
571
559
572
-
*`vct`
573
-
* REQUIRED. The verifiable credential type described by this type metadata document.
574
-
*`name`
575
-
* OPTIONAL. A human-readable name for the type, intended for developers reading
560
+
*`vct`: REQUIRED. The verifiable credential type described by this type metadata document.
561
+
*`name`: OPTIONAL. A human-readable name for the type, intended for developers reading
576
562
the JSON document.
577
-
*`description`
578
-
* OPTIONAL. A human-readable description for the type, intended for
563
+
*`description`: OPTIONAL. A human-readable description for the type, intended for
579
564
developers reading the JSON document.
580
-
*`extends`
581
-
* OPTIONAL. A URI of another type that this type extends, as described in
565
+
*`extends`: OPTIONAL. A URI of another type that this type extends, as described in
582
566
(#extending-type-metadata).
583
567
*`display`: An array of objects containing display information for the type, as described
584
568
in (#display-metadata). This property is OPTIONAL.
@@ -1645,6 +1629,7 @@ for their contributions (some of which substantial) to this draft and to the ini
1645
1629
* Require `x5c` to be in the protected header
1646
1630
* Clarify presentations of SD-JWT VC do not require KB
1647
1631
* Updated/expanded example for Type Metadata
1632
+
* Be more consistent with style for lists of claims/parameters/properties
1648
1633
* Update PID example to make clear that it is not normative
0 commit comments