verifier_attestation and verifier_attestations....

[Sakurann]

In the spec, we currently have verifier_attestation client identifier scheme and a container to pass RP registration cert is also called verifier_attestations. we should rename one of them...?

[babisRoutis]

Having implemented both, indeed the usage of the same term creates confusion.

To my understanding the client identifier scheme is used (as the rest of the schemes) to authenticate verifier to the wallet.
whereas the verifier_attestations can be used by the wallet to take authorization decisions (What can the verifier request from the wallet).

Perhaps verifier_assertions instead verifier_attestations or even assertions

[Sakurann]

i like suggested direction but verifier_assertions and verifier_attestations sounds pretty similar too..

[Sakurann]

WG discussion:

• rename verifier_attestation (client identifier prefix) to verifier_jwt

[jogu]

I think the issue with renaming verifier_attestation to verifier_jwt is it refers to the "Verifier Attestation JWT" section, which defines the "application/verifier-attestation+jwt". I'm not sure a mimetype application/verifier+jwt is good, and not renaming these things seems like it still leaves a lot of scope for confusion.

Other ideas (in no particular order):

1. Rename verifier_attestation client id prefix to verifier_authentication_attestation
2. Rename verifier_attestation client id prefix to client_attestation (it's kind of an oauth layer thing rather than an OID4VP things, but this risks confusion with https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/ perhaps)
3. Remove verifier_attestation client id prefix from 1.0, readd later. (or re-add something that builds on top of https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/ ?)
4. Rename verifier_attestations to verifier_data_attestations
5. Rename verifier_attestations to verifier_info_attestations
6. Rename verifier_attestations to verifier_context_attestations
7. Rename verifier_attestations to verifier_metadata_attestations

[c2bo]

I am leaning towards 3 if that is an option tbh. I don't think I've seen this scheme used anywhere?

[Sakurann]

@aaronpk would you have any concerns with option 2 in Joseph's comment and the client id prefix client_attestation?

[aaronpk]

It does seem like a client_attestation prefix would refer to https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/

[Sakurann]

@jogu why is there no option to change verifier-attestation_jwt jwt type?

[tplooker]

I'm in favour of option 3 also.