Repository navigation
Conversation
|
We need to touch that part anyway for 1.1 I believe (and check versions / remove some entries if there were no breaking changes)? Should this change be only scoped for 1.0 for the time being and we do a pass of the non-final specs part for 1.1 before final? |
|
Discussed in call. We may need to update to 16, but only after making sure there aren't normative inconsistencies. |
jogu
left a comment
There was a problem hiding this comment.
There's still an inconsistency as the normative references section now references draft 16. We need to update the normative references to be draft 10, unless there's a later draft that has no normative changes in which change we can update both places to that later version.
|
Does @jogu 's concern only applies to the following sentence and section 2 vs 4? I don't understand the concern. is it still there if now the PR points to -16 and not -10?
|
@c2bo do you see any problems with merging this PR now and we can revisit 1.1 before publication again |
fine by me and I believe Brent opened a new issue for that |
| ##### Step 1: SD-JWT VC Processing | ||
|
|
||
| - A receiver (holder or verifier) of an SD-JWT VCLD applies the processing rules outlined in Section 4 of [@!I-D.ietf-oauth-sd-jwt-vc], including verifying signatures, validity periods, status information, etc. | ||
| - A receiver (holder or verifier) of an SD-JWT VCLD applies the processing rules outlined in Section 2 of [@!I-D.ietf-oauth-sd-jwt-vc], including verifying signatures, validity periods, status information, etc. |
There was a problem hiding this comment.
| - A receiver (holder or verifier) of an SD-JWT VCLD applies the processing rules outlined in Section 2 of [@!I-D.ietf-oauth-sd-jwt-vc], including verifying signatures, validity periods, status information, etc. | |
| - A receiver (holder or verifier) of an SD-JWT VCLD applies the processing rules outlined in Section 2.4 of [@!I-D.ietf-oauth-sd-jwt-vc], including verifying signatures, validity periods, status information, etc. |
There was a problem hiding this comment.
I agree that section 2.4 is the better reference. Section 2.4 also references the validation rules in section 2.5, so scoping it down like this makes it easier to find the rules without being too specific.
| ##### Step 1: SD-JWT VC Processing | ||
|
|
||
| - A receiver (holder or verifier) of an SD-JWT VCLD applies the processing rules outlined in Section 4 of [@!I-D.ietf-oauth-sd-jwt-vc], including verifying signatures, validity periods, status information, etc. | ||
| - A receiver (holder or verifier) of an SD-JWT VCLD applies the processing rules outlined in Section 2 of [@!I-D.ietf-oauth-sd-jwt-vc], including verifying signatures, validity periods, status information, etc. |
There was a problem hiding this comment.
| - A receiver (holder or verifier) of an SD-JWT VCLD applies the processing rules outlined in Section 2 of [@!I-D.ietf-oauth-sd-jwt-vc], including verifying signatures, validity periods, status information, etc. | |
| - A receiver (holder or verifier) of an SD-JWT VCLD applies the processing rules outlined in Section 2.4 of [@!I-D.ietf-oauth-sd-jwt-vc], including verifying signatures, validity periods, status information, etc. |
awoie
left a comment
There was a problem hiding this comment.
thanks. we should use 2.4 instead of 2.
| * SIOPv2 draft -13 [@!SIOPv2] | ||
| * Selective Disclosure for JWTs (SD-JWT) draft -22 [@!I-D.ietf-oauth-selective-disclosure-jwt] | ||
| * SD-JWT-based Verifiable Credentials (SD-JWT VC) draft -09 [@!I-D.ietf-oauth-sd-jwt-vc] | ||
| * SD-JWT-based Verifiable Credentials (SD-JWT VC) draft -16 [@!I-D.ietf-oauth-sd-jwt-vc] |
There was a problem hiding this comment.
Draft 16 contains at least one breaking change ( https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-16.html#name-document-history ):
Change lang to locale. While lang is more accurate, locale is what has traditionally been used in OpenID Connect and later related specs.
so I don't think we can just update to -16, unless people can think of language we can add that could explain this as not really being a breaking change.
There may be other breaking changes too, I didn't review the full history.
The alternative is to figure out how to make the normative references section of the draft refer to draft 10 (or the latest version that doesn't contain breaking changes). I don't know how we get mmarkdown/xml2rfc to reference a specific IETF draft rather than the latest one - probably we would need to create a manual reference instead of relying on the automatic [@!I-D.ietf-oauth-sd-jwt-vc] syntax.
|
Below are some notable differences between draft 10 and draft 16 of the SD-JWT VC spec that could potentially present an issue.
|
I will also note that ETSI references -13. Because SD-JWT VC is probably most relevant for EUDI, and EUDI implementers will need to use -13, we should probably also use -13, or update to -16/-17 (next week) already. Between -13 and -16/-17 there shouldn't be any breaking changes. |
|
After discussion in the WG today, we don't like it, but we should point to the latest version of SD-JWT VC and move forward. |
Relevant minutes for references: https://lists.openid.net/pipermail/openid-specs-digital-credentials-protocols/Week-of-Mon-20260713/001320.html The WG can't just decide "we're going to make breaking changes in an errata". As I mentioned here #726 (comment) we really need to explain and justify why we're making a breaking change in an errata update (including making clear what behaviour we expect implementations with/without the errata update to have), and some of the explanation is likely to be guidance to implementers/ecosystems that needs to go into the specification text.
Can you expand on this point please? A registry of what? [Actually I think that question is answered by the minutes - I don't think a registry solves any of this problem - I believe it's a registry of credential format identifiers like dc+sd-jwt etc - but the registry still has to stay 'dc+sd-jwt' means "SD-JWT VC draft 18" and can't change the meaning of that value ever.) |
|
Discussion in the group today: perhaps a breaking change in this circumstance might be necessary, and allowable under the need to address errata. If we go down this route, we need to be very explicit about the changes. |
|
WG discussion (chair hat on) multiple options:
-> preferred direction seems to be option 1.
what does conformance mean? need to provide clarity:
|
|
Discussed today, @Sakurann please adjust this PR according to option 1. Make sure to mention wallet and verifier requirements. |
|
Discussed today, still waiting for @Sakurann to update the PR |
| The `dc+sd-jwt` Credential Format Identifier identifies an IETF SD-JWT VC independently | ||
| of the version of [@!I-D.ietf-oauth-sd-jwt-vc] used to issue it. | ||
|
|
There was a problem hiding this comment.
As above
| The `dc+sd-jwt` Credential Format Identifier identifies an IETF SD-JWT VC independently | |
| of the version of [@!I-D.ietf-oauth-sd-jwt-vc] used to issue it. |
jogu
left a comment
There was a problem hiding this comment.
I don't think the "we should be explicit that this is a potential breaking change compared to the first version of 1.0" part at #726 (comment) has been captured in the spec yet. Maybe something like 'Verifiers or Wallets compliant with older versions may not accept/correctly process credentials compliant with newer versions of SD-JWT VC." (that's not a very good wording but hopefully the intent is kind of clear).
|
Discussed in call. The group felt it would be better to avoid normative language and instead have guidance for the verifier: "You should ask for SD-JWT VC 1.0, but you may not get it, up to you if that's acceptable or not." |
|
Discussed in Group today: The strong feeling in the group is we say as little as possible beyond pointing to the RFC for SD-JWT-VC |
| - the `nonce` claim MUST be the value of `nonce` from the Authorization Request; | ||
| - the `aud` claim MUST be the value of the Client Identifier, except for requests over the DC API where it MUST be the Origin prefixed with `origin:`, as described in (#dc_api_response). | ||
|
|
||
| An SD-JWT Credential is expected to match the final version of [@!I-D.ietf-oauth-sd-jwt-vc]. Any differences to previous drafts are out of scope for this specification and are negotiated by the Credential Issuer, Holder and Verifier. |
There was a problem hiding this comment.
| An SD-JWT Credential is expected to match the final version of [@!I-D.ietf-oauth-sd-jwt-vc]. Any differences to previous drafts are out of scope for this specification and are negotiated by the Credential Issuer, Holder and Verifier. | |
| An SD-JWT Credential is expected to match the latest version of [@!I-D.ietf-oauth-sd-jwt-vc]. Any differences to previous drafts are out of scope for this specification and are negotiated by the Credential Issuer, Holder and Verifier. |
| A Wallet's inability to determine the version of [@!I-D.ietf-oauth-sd-jwt-vc] | ||
| that the Issuer used to issue a Credential of the `dc+sd-jwt` Credential Format | ||
| MUST NOT, on that basis alone, cause the Wallet to treat the Credential as | ||
| non-matching or to withhold it from a response it would otherwise return to the | ||
| Verifier. All other conditions for returning a Credential, including satisfying | ||
| the DCQL query and obtaining the required End-User authorization apply. | ||
|
|
||
| A Verifier MUST be prepared to receive a Credential of the `dc+sd-jwt` Credential | ||
| Format that was issued under a version of [@!I-D.ietf-oauth-sd-jwt-vc] other than | ||
| the one it expects. A Verifier MAY respond with an error if it cannot process the | ||
| received version. Doing so is a local processing decision and does not render the | ||
| Wallet's response non-conformant. | ||
|
|
There was a problem hiding this comment.
Update this section, once we agreed on top
| The Credential Format Identifier is `dc+sd-jwt`. | ||
| The Credential Format Identifier is `dc+sd-jwt`. | ||
|
|
||
| The `dc+sd-jwt` Credential Format Identifier identifies an IETF SD-JWT VC independently |
There was a problem hiding this comment.
I wonder if this section should be merged with the new text underneath
| - the `nonce` claim MUST be the value of `nonce` from the Authorization Request; | ||
| - the `aud` claim MUST be the value of the Client Identifier, except for requests over the DC API where it MUST be the Origin prefixed with `origin:`, as described in (#dc_api_response). | ||
|
|
||
| An SD-JWT Credential is expected to match the final version of [@!I-D.ietf-oauth-sd-jwt-vc]. Any differences to previous drafts are out of scope for this specification and are negotiated by the Credential Issuer, Holder and Verifier. |
There was a problem hiding this comment.
As I mentioned at the end of the WG call today, I really don't know how to apply this statement in the test suite. The test suite needs to have a selected version to test received credentials against and to generate credentials that are compliant to. Does the working group want two different test suites, one for HAIP 1.0 Final with VP 1.0 Final and a different one for HAIP 1.0 with VP 1.0 Errata? That doesn't sound like a good / intended outcome.
Additionally regardless of whether we use 'latest' or 'final' I don't see how we can publish an errata until SD-JWT VC is published as an RFC; if we publish the errata and then a new version of SD-JWT VC is published that's just a moving target for testing and for implementors.
|
Hello, I'm commenting as a Verifier implementer targeting EUDI deployments. I support the move to non-normative guidance here, and I agree with @Sakurann 's point that many wallets genuinely cannot tell which SD-JWT VC revision they hold. Mandating a revision would create non-conformance that wallets have no way to avoid. What I would like to raise is that the current wording leaves Verifier behaviour undefined in a context where the references already conflict :
So a Verifier operating in that context cannot derive a defensible expectation from the references as they stand, and the note as drafted does not help it decide. Three narrow requests, all compatible with keeping this non-normative:
If revision pinning belongs in HAIP rather than in VP core, I am happy to take that part there instead. A profile-level pin seems like the right place for it, and HAIP is already in the EUDI reference set. |
| * OpenID Federation 1.0 draft -43 [@!OpenID.Federation] | ||
| * SIOPv2 draft -13 [@!SIOPv2] | ||
| * Selective Disclosure for JWTs (SD-JWT) draft -22 [@!I-D.ietf-oauth-selective-disclosure-jwt] | ||
| * SD-JWT-based Verifiable Credentials (SD-JWT VC) draft -09 [@!I-D.ietf-oauth-sd-jwt-vc] | ||
| * SD-JWT-based Verifiable Credentials (SD-JWT VC) draft -19 [@!I-D.ietf-oauth-sd-jwt-vc] | ||
| * Fully-Specified Algorithms for JOSE and COSE draft -13 [@!I-D.ietf-jose-fully-specified-algorithms] |
There was a problem hiding this comment.
Discussed in Group, need to remove all except SIOPv2, as all the rest are final (or will be by the time we publish).
@jogu will open an issue to track the possibility of removing normative reference to SIPOv2
There was a problem hiding this comment.
Issue for thinking about removing SOIPv2 normative reference: #810
There was a problem hiding this comment.
why not remove SIOP too.
|
Discussed today: for testing concerns, tests shouldn't fail but should result in warnings. We adjusted normative language. |
|
Verifier implementer again, now that the text has settled around @paulbastian's proposal. Two things on that sentence, from a deployed Verifier's point of view. On "latest" vs "final" : for anyone already in production "latest" is the harder of the two. It means the version the spec expects moves every time a new draft is posted, with no event to plan a release around. "final" at least gives one. On "are negotiated by the Credential Issuer, Holder and Verifier" : negotiated through what ? |
| * OpenID Federation 1.0 draft -43 [@!OpenID.Federation] | ||
| * SIOPv2 draft -13 [@!SIOPv2] | ||
| * Selective Disclosure for JWTs (SD-JWT) draft -22 [@!I-D.ietf-oauth-selective-disclosure-jwt] |
There was a problem hiding this comment.
| * OpenID Federation 1.0 draft -43 [@!OpenID.Federation] | |
| * SIOPv2 draft -13 [@!SIOPv2] | |
| * Selective Disclosure for JWTs (SD-JWT) draft -22 [@!I-D.ietf-oauth-selective-disclosure-jwt] | |
| * SIOPv2 draft -13 [@!SIOPv2] |
| * Selective Disclosure for JWTs (SD-JWT) draft -22 [@!I-D.ietf-oauth-selective-disclosure-jwt] | ||
| * SD-JWT-based Verifiable Credentials (SD-JWT VC) draft -09 [@!I-D.ietf-oauth-sd-jwt-vc] | ||
| * SD-JWT-based Verifiable Credentials (SD-JWT VC) draft -19 [@!I-D.ietf-oauth-sd-jwt-vc] | ||
| * Fully-Specified Algorithms for JOSE and COSE draft -13 [@!I-D.ietf-jose-fully-specified-algorithms] |
There was a problem hiding this comment.
| * Fully-Specified Algorithms for JOSE and COSE draft -13 [@!I-D.ietf-jose-fully-specified-algorithms] |
fixes #659 by changing typo in sd-jwt-vc version