add key attestations #389
add key attestations #389
Conversation
There was a problem hiding this comment.
I like it as a first draft and added some general comments.
General question: The plan would be to describe the overall mechanism in an Appendix and reference in Credential Endpoint (additional parameter for a Credential Request) and in Credential Issuer Metadata (to signal this is required for specific credential configurations)?
There was a problem hiding this comment.
good one @paulbastian , I support and follow this work, thank you
Co-authored-by: Giuseppe De Marco <[email protected]>
|
Is it possible to add description to the PR what this PR does and which issues it touches upon? thank you |
|
I had the same question as @Sakurann as to where to put the key attestation. Moreover, if one attestation contains a list of keys, how can we provide one PoP for each key, and how to figure out which PoP corresponds to which key in the keys array. |
Co-authored-by: Christian Bormann <[email protected]>
| "iss": "<identifier of the issuer of this key attestation>", | ||
| "iat": 1516247022, |
There was a problem hiding this comment.
Isn't that an information that we could get from the key attestation certificate from the key storage/WSCD, if necessary?
I would expect a wallet to already have an internal mapping with identifiers between key attestation jwts and the location where the key resides.
Co-authored-by: Giuseppe De Marco <[email protected]>
| There are two ways to convey key attestations during Credential issuance: | ||
| - The Wallet uses the `jwt` proof type in the Credential Request to create a proof of possession of the key and adds the key attestation in the JOSE header as specified in (#jwt-proof-type). | ||
| - The Wallet uses the `attestation` proof type in the Credential Request with the key attestation without a proof of possession of the key itself as specified in (#attestation-proof-type). |
There was a problem hiding this comment.
todo: move this part to the proof type section
Add key attestation metadata as described in openid/OpenID4VCI#389, at commit openid/OpenID4VCI@7130e4f. As an aside, also add the optional nonce endpoint to the issuer metadata which has been added recently. Fix building a bunch of tests (but not all).
Closes #355
Closes #368
Closes #215
Closes #150