diff --git a/examples/credential_request_ldp_vc_vp.json b/examples/credential_request_ldp_vc_vp.json new file mode 100644 index 00000000..c07ce9b1 --- /dev/null +++ b/examples/credential_request_ldp_vc_vp.json @@ -0,0 +1,43 @@ +{ + "format": "ldp_vc", + "credential_definition": { + "@context": [ + "https://www.w3.org/2018/credentials/v1", + "https://www.w3.org/2018/credentials/examples/v1" + ], + "type": [ + "VerifiableCredential", + "UniversityDegreeCredential" + ], + "credentialSubject": { + "degree": { + "type": {} + } + } + }, + "proof": { + "proof_type": "ldp_vp", + "ldp_vp": { + "@context": [ + "https://www.w3.org/ns/credentials/v2", + "https://www.w3.org/ns/credentials/examples/v2" + ], + "type": [ + "VerifiablePresentation" + ], + "holder": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro", + "proof": [ + { + "type": "DataIntegrityProof", + "cryptosuite": "eddsa-2022", + "proofPurpose": "authentication", + "verificationMethod": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro#z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro", + "created": "2023-03-01T14:56:29.280619Z", + "challenge": "82d4cb36-11f6-4273-b9c6-df1ac0ff17e9", + "domain": "did:web:audience.company.com", + "proofValue": "z5hrbHzZiqXHNpLq6i7zePEUcUzEbZKmWfNQzXcUXUrqF7bykQ7ACiWFyZdT2HcptF1zd1t7NhfQSdqrbPEjZceg7" + } + ] + } + } +} \ No newline at end of file diff --git a/openid-4-verifiable-credential-issuance-1_0.md b/openid-4-verifiable-credential-issuance-1_0.md index d3a60c7f..bbd7ed13 100644 --- a/openid-4-verifiable-credential-issuance-1_0.md +++ b/openid-4-verifiable-credential-issuance-1_0.md @@ -774,6 +774,7 @@ This specification defines the following values for the `proof_type` property: * `jwt`: A JWT [@!RFC7519] is used as proof of possession. When `proof_type` is `jwt`, a `proof` object MUST include a `jwt` claim containing a JWT defined in (#jwt-proof-type). * `cwt`: A CWT [@!RFC8392] is used as proof of possession. When `proof_type` is `cwt`, a `proof` object MUST include a `cwt` claim containing a CWT defined in (#cwt-proof-type). +* `ldp_vp`: A W3C Verifiable Presentation object signed using the Data Integrity Proof as defined in [@VC_DATA_2.0] or [@VC_DATA], and where the proof of possession MUST be done in accordance with [@Data_Integrity]. When `proof_type` is set to `ldp_vp`, the `proof` object MUST include a `ldp_vp` claim containing a [W3C Verifiable Presentation](https://www.w3.org/TR/vc-data-model-2.0/#presentations-0) defined in (#ldp_vp-proof-type). #### `jwt` Key Proof Type {#jwt-proof-type} @@ -837,6 +838,49 @@ Here is another example JWT not only proving possession of a private key but als } ``` +#### `ldp_vp` Key Proof Type {#ldp_vp-proof-type} + +When a W3C Verifiable Presentation as defined by [@VC_DATA_2.0] or [@VC_DATA] signed using Data Integrity is used as Key Proof, it MUST contain the following elements: + + * `holder`: OPTIONAL. MUST be equivalent to the controller identifier (e.g. DID) for the `verificationMethod` value identified by the `proof.verificationMethod` property. + + * `proof`: REQUIRED. The proof body of a W3C Verifiable Presentation. + * `domain`: REQUIRED (string). The value of this claim MUST be the Credential Issuer Identifier. + * `challenge`: REQUIRED when the Credential Issuer has provided a `c_nonce`. MUST NOT be used otherwise. String, where the value is a server-provided `c_nonce`. It MUST be present when the Wallet received server-provided `c_nonce`. + +The Credential Issuer MUST validate that the `proof` is actually signed with a key in possession of the Holder. + +Below is a non-normative example of a `proof` parameter: + +```json +{ + "proof_type": "ldp_vp", + "ldp_vp": { + "@context": [ + "https://www.w3.org/ns/credentials/v2", + "https://www.w3.org/ns/credentials/examples/v2" + ], + "type": [ + "VerifiablePresentation" + ], + "holder": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro", + "proof": [ + { + "type": "DataIntegrityProof", + "cryptosuite": "eddsa-2022", + "proofPurpose": "authentication", + "verificationMethod": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro#z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro", + "created": "2023-03-01T14:56:29.280619Z", + "challenge": "82d4cb36-11f6-4273-b9c6-df1ac0ff17e9", + "domain": "did:web:audience.company.com", + "proofValue": "z5hrbHzZiqXHNpLq6i7zePEUcUzEbZKmWfNQzXcUXUrqF7bykQ7ACiWFyZdT2HcptF1zd1t7NhfQSdqrbPEjZceg7" + } + ] + } + } + +``` + #### `cwt` Key Proof Type {#cwt-proof-type} The CWT MUST contain the following elements: @@ -1417,6 +1461,68 @@ TBD + + + Verifiable Credentials Data Model 2.0 + + Digital Bazaar + + + Transmute + + + Spruce Systems, Inc. + + + ConsenSys + + + Block + + + independent + + + Digital Bazaar + + + ConsenSys + + + Evernym + + + MATTR + + + University of Kent + + + + + + + + Verifiable Credential Data Integrity 1.0 + + Digital Bazaar + + + Digital Bazaar + + + Invited Expert + + + Invited Expert + + + Invited Expert + + + + + Coded Character Set -- 7-bit American Standard Code for Information Interchange @@ -1818,6 +1924,7 @@ The following is a non-normative example of a Credential Offer of Credential for <{{examples/credential_offer_ldp_vc.json}} + #### Authorization Details {#authorization_ldp_vc} The following additional claims are defined for authorization details of type `openid_credential` and this Credential format. @@ -1844,6 +1951,10 @@ The following is a non-normative example of a Credential Request with Credential <{{examples/credential_request_ldp_vc.json}} +The following is a non-normative example of a Credential request with the key proof type `ldp_vp`: + +<{{examples/credential_request_ldp_vc_vp.json}} + #### Credential Response The value of the `credential` claim in the Credential Response MUST be a JSON object. Credentials of this format MUST NOT be re-encoded.