324 changes: 265 additions & 59 deletions openid-4-verifiable-presentations-1_0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -770,7 +770,7 @@ The following is a non-normative example of the payload of the JWT used in the e

<{{examples/response/jarm_jwt_vc_json_body.json}}

## Error Response
## Error Response {#error-response}

The error response follows the rules as defined in [@!RFC6749], with the following additional clarifications:

Expand Down Expand Up @@ -969,7 +969,7 @@ The following is a non-normative example of a set of static configuration values
```


## Support for Federations/Trust Schemes
## Support for Federations/Trust Schemes {#federations}

Often Verifiers will want to request Verifiable Credentials from a Credential Issuer who is a participant of a federation, or adheres to a known trust scheme, rather than from a specific Credential Issuer, for example, a "BSc Chemistry Degree" Credential from the hypothetical "eduCreds" trust scheme rather than from a specifically named university.

Expand Down Expand Up @@ -1290,29 +1290,29 @@ In the event that another component is invoked instead of the Wallet, the End-Us
<author initials="T." surname="Lodderstedt" fullname="Torsten Lodderstedt">
<organization>German Federal Agency for Disruptive Innovation (SPRIND)</organization>
</author>
<date day="1" month="January" year="2023"/>
<date day="28" month="November" year="2023"/>
</front>
</reference>

<reference anchor="OpenID.Core" target="http://openid.net/specs/openid-connect-core-1_0.html">
<reference anchor="OpenID.Core" target="https://openid.net/specs/openid-connect-core-1_0.html">
<front>
<title>OpenID Connect Core 1.0 incorporating errata set 1</title>
<author initials="N." surname="Sakimura" fullname="Nat Sakimura">
<organization>NRI</organization>
<title>OpenID Connect Core 1.0 incorporating errata set 2</title>
<author fullname="Nat Sakimura" initials="N." surname="Sakimura">
<organization abbrev="NAT.Consulting (was at NRI)">NAT.Consulting</organization>
</author>
<author initials="J." surname="Bradley" fullname="John Bradley">
<organization>Ping Identity</organization>
<author fullname="John Bradley" initials="J." surname="Bradley">
<organization abbrev="Yubico (was at Ping Identity)">Yubico</organization>
</author>
<author initials="M." surname="Jones" fullname="Michael B. Jones">
<organization>Microsoft</organization>
<author fullname="Michael B. Jones" initials="M.B." surname="Jones">
<organization abbrev="Self-Issued Consulting (was at Microsoft)">Self-Issued Consulting</organization>
</author>
<author initials="B." surname="de Medeiros" fullname="Breno de Medeiros">
<organization>Google</organization>
<author fullname="Breno de Medeiros" initials="B." surname="de Medeiros">
<organization abbrev="Google">Google</organization>
</author>
<author initials="C." surname="Mortimore" fullname="Chuck Mortimore">
<organization>Salesforce</organization>
<author fullname="Chuck Mortimore" initials="C." surname="Mortimore">
<organization abbrev="Disney (was at Salesforce)">Disney</organization>
</author>
<date day="8" month="Nov" year="2014"/>
<date day="15" month="December" year="2023"/>
</front>
</reference>

Expand Down Expand Up @@ -1370,22 +1370,19 @@ issuers in Self-Sovereign Identity ecosystems using TRAIN</title>
</front>
</reference>

<reference anchor="OpenID-Discovery" target="https://openid.net/specs/openid-connect-discovery-1_0.html">
<reference anchor="OpenID.Registration" target="https://openid.net/specs/openid-connect-registration-1_0.html">
<front>
<title>OpenID Connect Discovery 1.0 incorporating errata set 1</title>
<author initials="N." surname="Sakimura" fullname="Nat Sakimura">
<organization>NRI</organization>
<title>OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2</title>
<author fullname="Nat Sakimura" initials="N." surname="Sakimura">
<organization abbrev="NAT.Consulting (was at NRI)">NAT.Consulting</organization>
</author>
<author initials="J." surname="Bradley" fullname="John Bradley">
<organization>Ping Identity</organization>
<author fullname="John Bradley" initials="J." surname="Bradley">
<organization abbrev="Yubico (was at Ping Identity)">Yubico</organization>
</author>
<author initials="B." surname="de Medeiros" fullname="Breno de Medeiros">
<organization>Google</organization>
<author fullname="Michael B. Jones" initials="M.B." surname="Jones">
<organization abbrev="Self-Issued Consulting (was at Microsoft)">Self-Issued Consulting</organization>
</author>
<author initials="E." surname="Jay" fullname="Edmund Jay">
<organization> Illumila </organization>
</author>
<date day="8" month="Nov" year="2014"/>
<date day="15" month="December" year="2023"/>
</front>
</reference>

Expand Down Expand Up @@ -1497,7 +1494,7 @@ issuers in Self-Sovereign Identity ecosystems using TRAIN</title>
</front>
</reference>

<reference anchor="OpenID.Federation" target="https://openid.net/specs/openid-connect-federation-1_0.html">
<reference anchor="OpenID.Federation" target="https://openid.net/specs/openid-federation-1_0.html">
<front>
<title>OpenID Federation 1.0</title>
<author fullname="R. Hedberg, Ed.">
Expand All @@ -1518,7 +1515,7 @@ issuers in Self-Sovereign Identity ecosystems using TRAIN</title>
<author fullname="Vladimir Dzhuvinov">
<organization>Connect2id</organization>
</author>
<date day="8" month="November" year="2023"/>
<date day="15" month="September" year="2024"/>
</front>
</reference>

Expand All @@ -1534,6 +1531,45 @@ issuers in Self-Sovereign Identity ecosystems using TRAIN</title>
</front>
</reference>

<reference anchor="IANA.OAuth.Parameters" target="https://www.iana.org/assignments/oauth-parameters">
<front>
<title>OAuth Parameters</title>
<author>
<organization>IANA</organization>
</author>
<date/>
</front>
</reference>

<reference anchor="IANA.MediaTypes" target="https://www.iana.org/assignments/media-types">
<front>
<title>Media Types</title>
<author>
<organization>IANA</organization>
</author>
<date/>
</front>
</reference>

<reference anchor="IANA.URI.Schemes" target="https://www.iana.org/assignments/uri-schemes">
<front>
<title>Uniform Resource Identifier (URI) Schemes</title>
<author>
<organization>IANA</organization>
</author>
<date/>
</front>
</reference>

<reference anchor="IANA.JOSE" target="https://www.iana.org/assignments/jose">
<front>
<title>JSON Object Signing and Encryption (JOSE)</title>
<author>
<organization>IANA</organization>
</author>
</front>
</reference>

# OpenID4VP profile for the W3C Digital Credentials API

This section defines a profile of OpenID4VP for use with the W3C Digital Credentials API [@!w3c.digital_credentials_api].
Expand Down Expand Up @@ -1824,7 +1860,7 @@ The following is the content of the `vp_token` parameter:

<{{examples/response/ac_vp_sd.json}}

## Mobile Documents or mdocs (ISO/IEC 18013 and ISO/IEC 23220 series)
## Mobile Documents or mdocs (ISO/IEC 18013 and ISO/IEC 23220 series) {#mdocs}

ISO/IEC 18013-5:2021 [@ISO.18013-5] defines a mobile driving license (mDL) Credential in the mobile document (mdoc) format. Although ISO/IEC 18013-5:2021 [@ISO.18013-5] is specific to mobile driving licenses (mDLs), the Credential format can be utilized with any type of Credential (or mdoc document types). The ISO/IEC 23220 series has extracted components from ISO/IEC 18013-5:2021 [@ISO.18013-5] and ISO/IEC TS 18013-7 [@ISO.18013-7] that are common across document types to facilitate the profiling of the specification for other document types. The core data structures are shared between ISO/IEC 18013-5:2021 [@ISO.18013-5], ISO/IEC 23220-2 [@ISO.23220-2], ISO/IEC 23220-4 [@ISO.23220-4] which are encoded in CBOR and secured using COSE_Sign1.

Expand Down Expand Up @@ -2001,68 +2037,237 @@ Note: The `nonce` and `aud` are set to the `nonce` of the request and the Client

# IANA Considerations

## Response Types
## OAuth Authorization Endpoint Response Types Registry

This specification registers the following `response_type` values
in the IANA "OAuth Authorization Endpoint Response Types" registry [@IANA.OAuth.Parameters]
established by [@!RFC6749].

### vp_token

* Response Type Name: `vp_token`
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Specification Document(s): https://openid.net/specs/openid-4-verifiable-presentations-1_0.html
* Specification Document(s): (#response) of this specification

### vp_token id_token

* Response Type Name: `vp_token id_token`
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Specification Document(s): https://openid.net/specs/openid-4-verifiable-presentations-1_0.html
* Specification Document(s): (#response) of this specification

Note: Plan to register the following Response Types in the [OAuth Authorization Endpoint Response Types IANA Registry](https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#endpoint).
## OAuth Parameters Registry

## Media Types
### application/verifier-attestation+jwt {#va_media_type}
This specification registers the following OAuth parameters
in the IANA "OAuth Parameters" registry [@IANA.OAuth.Parameters]
established by [@!RFC6749].

### presentation_definition

* Name: `presentation_definition`
* Parameter Usage Location: authorization request
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#vp_token_request) of this specification

### presentation_definition_uri

* Name: `presentation_definition_uri`
* Parameter Usage Location: authorization request
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#vp_token_request) of this specification

### client_metadata

* Name: `client_metadata`
* Parameter Usage Location: authorization request
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#vp_token_request) of this specification

### request_uri_method

* Name: `request_uri_method`
* Parameter Usage Location: authorization request
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#vp_token_request) of this specification

### wallet_nonce

* Name: `wallet_nonce`
* Parameter Usage Location: authorization request, token response
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#request_uri_method_post) of this specification

### response_uri

* Name: `response_uri`
* Parameter Usage Location: authorization request
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#response_mode_post) of this specification

### vp_token

* Name: `vp_token`
* Parameter Usage Location: authorization response, token response
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#response-parameters) of this specification

### presentation_submission

* Name: `presentation_submission`
* Parameter Usage Location: authorization response, token response
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#response-parameters) of this specification

### expected_origins

* Name: `expected_origins`
* Parameter Usage Location: authorization request
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#browser_api_request) of this specification

## OAuth Extensions Error Registry

The Internet media type for a Verifier Attestation JWT is `application/verifier-attestation+jwt`.
This specification registers the following errors
in the IANA "OAuth Extensions Error" registry [@IANA.OAuth.Parameters]
established by [@!RFC6749].

Type name: : `application`
### vp_formats_not_supported

Subtype name: : `verifier-attestation+jwt`
* Name: `vp_formats_not_supported`
* Usage Location: authorization endpoint, token endpoint
* Protocol Extension: OpenID for Verifiable Presentations
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#error-response) of this specification

### invalid_presentation_definition_uri

* Name: `invalid_presentation_definition_uri`
* Usage Location: authorization endpoint, token endpoint
* Protocol Extension: OpenID for Verifiable Presentations
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#error-response) of this specification

### invalid_presentation_definition_reference

Required parameters: : n/a
* Name: `invalid_presentation_definition_reference`
* Usage Location: authorization endpoint, token endpoint
* Protocol Extension: OpenID for Verifiable Presentations
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#error-response) of this specification

Optional parameters: : n/a
### invalid_request_uri_method

* Name: `invalid_request_uri_method`
* Usage Location: authorization endpoint
* Protocol Extension: OpenID for Verifiable Presentations
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#error-response) of this specification

### wallet_unavailable

* Name: `wallet_unavailable`
* Usage Location: authorization endpoint, token endpoint
* Protocol Extension: OpenID for Verifiable Presentations
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#error-response) of this specification

Encoding considerations: : Compact Serialization as defined in [@!RFC7519].
## OAuth Authorization Server Metadata Registry

Security considerations: : See Security Considerations in in [@!RFC7519].
This specification registers the following authorization server metadata parameters
in the IANA "OAuth Authorization Server Metadata" registry [@IANA.OAuth.Parameters]
established by [@!RFC8414].

Interoperability considerations: : n/a
### presentation_definition_uri_supported

- Published specification: : TODO
- Applications that use this media type: : Applications that issue, present,
verify verifier attestation VCs.
- Additional information:
* Metadata Name: `presentation_definition_uri_supported`
* Metadata Description: Boolean value specifying whether the Wallet supports the transfer of presentation_definition by reference
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#as_metadata_parameters) of this specification

### vp_formats_supported

* Metadata Name: `vp_formats_supported`
* Metadata Description: An object containing a list of name/value pairs, where the name is a string identifying a Credential format supported by the Wallet
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#as_metadata_parameters) of this specification

## OAuth Dynamic Client Registration Metadata Registry

This specification registers the following client metadata parameters
in the IANA "OAuth Dynamic Client Registration Metadata" registry [@IANA.OAuth.Parameters]
established by [@!RFC7591].

### vp_formats

* Client Metadata Name: `vp_formats`
* Client Metadata Description: Boolean value specifying whether the Wallet supports the transfer of presentation_definition by reference
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#client_metadata_parameters) of this specification


## Media Types Registry

This section registers the following media type [@RFC2046]
in the IANA "Media Types" registry <xref target="IANA.MediaTypes"/>
in the manner described in [@RFC6838].

### application/verifier-attestation+jwt {#va_media_type}

The media type for a Verifier Attestation JWT is `application/verifier-attestation+jwt`.

* Type name: `application`
* Subtype name: `verifier-attestation+jwt`
* Required parameters: n/a
* Optional parameters: n/a
* Encoding considerations: Uses JWS Compact Serialization as defined in [@!RFC7515].
* Security considerations: See Security Considerations in in [@!RFC7519].
* Interoperability considerations: n/a
* Published specification: (#verifier_attestation_jwt) of this specification
* Applications that use this media type: Applications that issue, present, verify verifier attestation VCs
* Additional information:
- Magic number(s): n/a
- File extension(s): n/a
- Macintosh file type code(s): n/a
- Person & email address to contact for further information: TBD
- Intended usage: COMMON
- Restrictions on usage: none
- Author: tbd <TODO@email.com>
- Change controller: OpenID Foundation
* Person & email address to contact for further information: TBD
* Intended usage: COMMON
* Restrictions on usage: none
* Author: Oliver Terbu, oliver.terbu@mattr.global
* Change controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net

## JSON Web Signature and Encryption Header Parameters Registry {#jose_header}

This specification registers the following JWS header parameter
in the IANA "JSON Web Signature and Encryption Header Parameters" registry [@IANA.JOSE]
established by [@!RFC7515].

## JWS Headers
### JWT {#jose_header}
This specification registers the following JWS header name in the IANA "JSON Web Signature and Encryption Header Parameters" registry established by [@!RFC7515].
### jwt

* Header Parameter Name: `jwt`
* Header Parameter Description: This header contains a JWT. Processing rules MAY depend on the `typ` header value of the respective JWT.
* Header Parameter Usage Location: JWS
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Specification Document(s): (#verifier_attestation_jwt)
* Specification Document(s): (#verifier_attestation_jwt) of this specification

## Uniform Resource Identifier (URI) Schemes Registry

This specification registers the following URI scheme
in the IANA "Uniform Resource Identifier (URI) Schemes" registry [@IANA.URI.Schemes].

### openid4vp

* URI Scheme: `openid4vp`
* Description: Custom scheme used for wallet invocation
* Status: Provisional
* Well-Known URI Support: -
* Change Controller: OpenID Foundation Artifact Binding Working Group - openid-specs-ab@lists.openid.net
* Reference: (#openid4vp-profile) of this specification

# Acknowledgements {#Acknowledgements}

We would like to thank Richard Barnes, Paul Bastian, Vittorio Bertocci, Christian Bormann, John Bradley, Brian Campbell, Gabe Cohen, David Chadwick, Andrii Deinega, Giuseppe De Marco, Mark Dobrinic, Daniel Fett, Pedro Felix, George Fletcher, Timo Glasta, Mark Haine, Fabian Hauck, Roland Hedberg, Joseph Heenan, Alen Horvat, Andrew Hughes, Jacob Ideskog, Edmund Jay, Michael B. Jones, Tom Jones, Judith Kahrer, Takahiko Kawasaki, Gaurav Khot, Niels Klomp, Ronald Koenig, Markus Kreusch, Adam Lemmon, Daniel McGrogan, Jeremie Miller, Kenichi Nakamura, Rolson Quadras, Nat Sakimura, Arjen van Veen, Jan Vereecken, David Waite, Jacob Ward for their valuable feedback and contributions to this specification.

# Notices

Copyright (c) 2023 The OpenID Foundation.
Copyright (c) 2024 The OpenID Foundation.

The OpenID Foundation (OIDF) grants to any Contributor, developer, implementer, or other interested party a non-exclusive, royalty free, worldwide copyright license to reproduce, prepare derivative works from, distribute, perform and display, this Implementers Draft or Final Specification solely for the purposes of (i) developing specifications, and (ii) implementing Implementers Drafts and Final Specifications based on such documents, provided that attribution be made to the OIDF as the source of the material, but that such attribution does not indicate an endorsement by the OIDF.

Expand All @@ -2076,6 +2281,7 @@ The technology described in this specification was made available from contribut

* Clarified what can go in the `client_metadata` parameter
* Fixed #227: Enabled non-breaking extensibility.
* Fixed #383: Completed IANA Considerations section.

-21

Expand Down