Skip to content

Commit

Permalink
move section on how to use key attestations in proof types
Browse files Browse the repository at this point in the history
  • Loading branch information
paulbastian committed Nov 18, 2024
1 parent 12c59a3 commit a798e6e
Showing 1 changed file with 6 additions and 1 deletion.
7 changes: 6 additions & 1 deletion openid-4-verifiable-credential-issuance-1_0.md
Original file line number Diff line number Diff line change
Expand Up @@ -868,7 +868,12 @@ This specification defines the following proof types:
* `ldp_vp`: A W3C Verifiable Presentation object signed using the Data Integrity Proof [@VC_Data_Integrity] as defined in [@VC_DATA_2.0] or [@VC_DATA] is used for proof of possession. When a `proof_type` parameter in a `proof` object is set to `ldp_vp`, it MUST also contain an `ldp_vp` parameter that includes a [W3C Verifiable Presentation](https://www.w3.org/TR/vc-data-model-2.0/#presentations-0) defined in (#ldp-vp-proof-type). When a `proofs` object is using a `ldp_vp` proof type, it MUST include an `ldp_vp` parameter with its value being an array of [W3C Verifiable Presentations](https://www.w3.org/TR/vc-data-model-2.0/#presentations-0), where each of these W3C Verifiable Presentation is formed as defined in (#ldp-vp-proof-type).
* `attestation`: A JWT [@!RFC7519] representing a key attestation without using a proof of possession of the cryptographic key material that is being attested. When a `proof_type` parameter in a `proof` object is set to `attestation`, the object MUST also contain an `attestation` parameter that includes a JWT as defined in (#attestation-proof-type).

There are two ways to convey key attestation(s) of the cryptographic key material during Credential issuance. For details, see (#keyattestation).
There are two ways to convey key attestations (as defined in (#keyattestation)) of the cryptographic key material during Credential issuance:

- The Wallet uses the `jwt` proof type in the Credential Request to create a proof of possession of the key and adds the key attestation in the JOSE header.
- The Wallet uses the `attestation` proof type in the Credential Request with the key attestation without a proof of possession of the key itself.

Depending on the Wallet's implementation, the `attestation` may avoid unnecessary End-User interaction during Credential issuance, as the key itself does not necessarily need to perform signature operations.

Additional proof types MAY be defined and used.

Expand Down

0 comments on commit a798e6e

Please sign in to comment.