Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert changes from PR #251 #278

Merged
merged 5 commits into from
Dec 2, 2024
Merged

Revert changes from PR #251 #278

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e378335
fix: reverted changes in PR#251
awoie Dec 2, 2024
0485c0a
fix: change doc history entry
awoie Dec 2, 2024
12f7436
Update draft-ietf-oauth-sd-jwt-vc.md
awoie Dec 2, 2024
458615a
Update draft-ietf-oauth-sd-jwt-vc.md
awoie Dec 2, 2024
87714e3
Merge branch 'main' into awoie/revert-pr-251
bc-pi Dec 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 39 additions & 1 deletion draft-ietf-oauth-sd-jwt-vc.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -343,7 +343,7 @@ obtain the public key using JWT VC Issuer Metadata as defined in (#jwt-vc-issuer
- X.509 Certificates: If the recipient supports X.509 Certificates and the `iss` value contains an HTTPS URI, the recipient MUST
1. obtain the public key from the end-entity certificate of the certificates from the `x5c` header parameter of the Issuer-signed JWT and validate the X.509 certificate chain accordingly, and
2. ensure that the `iss` value matches a `uniformResourceIdentifier` SAN entry of the end-entity certificate or that the domain name in the `iss` value matches the `dNSName` SAN entry of the end-entity certificate.

- DID Document Resolution: If a recipient supports DID Document Resolution and if the `iss` value contains a DID [@W3C.DID], the recipient MUST retrieve the public key from the DID Document resolved from the DID in the `iss` value. In this case, if the `kid` JWT header parameter is present, the `kid` MUST be a relative or absolute DID URL of the DID in the `iss` value, identifying the public key.
Separate specifications or ecosystem regulations MAY define rules complementing the rules defined above, but such rules are out of scope of this specification. See (#ecosystem-verification-rules) for security considerations.

If a recipient cannot validate that the public verification key corresponds to the `iss` value of the Issuer-signed JWT, the SD-JWT VC MUST be rejected.
Expand Down Expand Up @@ -1204,6 +1204,43 @@ recommendations in (#robust-retrieval) apply.
</front>
</reference>

<reference anchor="W3C.DID" target="https://www.w3.org/TR/did-core/">
<front>
<author initials="M." surname="Sporny" fullname="Manu Sporny">
<organization>
<organizationName>Digital Bazaar</organizationName>
</organization>
</author>
<author initials="D." surname="Longley" fullname="Dave Longley">
<organization>
<organizationName>Digital Bazaar</organizationName>
</organization>
</author>
<author initials="M." surname="Sabadello" fullname="Markus Sabadello">
<organization>
<organizationName>Danube Tech</organizationName>
</organization>
</author>
<author initials="D." surname="Reed" fullname="Drummond Reed">
<organization>
<organizationName>Evernym/Avast</organizationName>
</organization>
</author>
<author initials="O." surname="Steele" fullname="Orie Steele">
<organization>
<organizationName>Transmute</organizationName>
</organization>
</author>
<author initials="C." surname="Allen" fullname="Christopher Allen">
<organization>
<organizationName>Blockchain Commons</organizationName>
</organization>
</author>
<title>Decentralized Identifiers (DIDs) v1.0</title>
<date day="19" month="July" year="2022"/>
</front>
</reference>

<reference anchor="W3C.VCDM" target="https://www.w3.org/TR/vc-data-model-2.0/">
<front>
<author initials="M." surname="Sporny" fullname="Manu Sporny">
Expand Down Expand Up @@ -1533,6 +1570,7 @@ for their contributions (some of which substantial) to this draft and to the ini

-07

* Revert change from previous release that removed explicit mention of DIDs in the Issuer-signed JWT Verification Key Validation section
* Remove the requirement to insert a .well-known part for vct URLs
* fix section numbering in SD-JWT references to align with the latest -14 version

Expand Down
Loading