Add more detail to DID Authentication section. #18

msporny · 2022-08-07T16:44:27Z

This PR adds more detail around the DID Authentication section, including adding the didMethod and cryptosuite values.

Preview | Diff

dlongley

Thanks!

index.html

dlongley · 2022-08-07T17:50:30Z

index.html

+listed, the value MUST be an array of string values and each string value
+MUST be a string containing the DID Method name. Listing multiple values
+expresses that the <a>verifier</a> would accept any DID Method listed. Valid
+example values include: <code>"key"</code> and <code>["key", "web"]</code>.


I would support making this always be an array instead to ease some concerns from other implementers around native type handling in some languages. I'm fine either way.

In the open/decentralized ecosystem, I believe the common pattern will be for Verifiers to accept multiple types of DID methods, so +1 to always having this as an array.

Ok, I'll make this change and merge it into this PR.

might it make sense to make the didMethod array contain objects, instead of just strings? There's a very good chance that various DID methods require multiple parameters for a given method. (For example, how Veres One DID method has a testnet vs main, cryptonyms vs not, etc).

We discussed this on the 2022-08-09 telecon. The group seemed to have consensus around the didMethod value always being an array. The group didn't object to renaming didMethod to acceptedMethods to ensure that the contents of the array is always a set of objects. Each object MUST contain at least an entry for method and MAY contain other parameters that are specific to the DID Method.

Fixed in d939bad.

index.html

mavarley · 2022-08-08T12:50:34Z

index.html

+An optional string value that conveys a cryptography suite that MUST be
+used by the <a>holder</a> to generate a cryptographic proof. Valid example
+values include: <code>"eddsa-2022"</code>, <code>"ecdsa-2022"</code> and
+<code>"bbs-2022"</code>.


Why is this only a single option? Wouldn't verifiers support multiple crypto suites?

nvm, seen below that a request may contain multiple DIDAuth requests.

Yeah, I went back and forth on this. There is a combinatoric concern here with listing all the DID Methods and all the cryptosuites, making it an NxN selection, which then gets more multidimensional if we have other "possible things you could do". I'm suggesting that we start with a single value and then depend on the ability to send multiple queries (some of them optional) to suggest the support for multiple cryptosuites. The downside there, of course, is if you support multiple cryptosuites, you have a new query for every cryptosuite. I expect that we might just have to make this an array in time, and if that's the case, we should just do it now... but the counter-argument to that is to make it painful to support more than a handful of cryptosuites to force an increase in interop!

In the end, I expect that we'll probably have to support an array of cryptosuites here.

Maybe we should just start with an array of cryptosuites? To match the array of did methods?

We discussed this on the 2022-08-09 telecon. @dlongley suggested that we rename the value to acceptedCryptosuites and make the value an array of objects where we could parameterize each cryptosuite. Each object MUST contain a cryptosuite property and MAY contain other cryptosuite-specific parameters.

Fixed in e7c4a51.

index.html

Co-authored-by: Dave Longley <dlongley@digitalbazaar.com> Co-authored-by: Mike Varley <mavarley@gmail.com>

dmitrizagidulin · 2022-08-09T20:15:20Z

Should we add a (temporary) warning that the VC v2 context doesn't exist yet, and that this is forward-looking?

dmitrizagidulin

👍 from me (though see my comment about didMethod, cryptosuite and the context warning)

index.html

TallTed · 2022-08-09T20:23:21Z

index.html

+supported by the <a>verifier</a>. If only one DID Method is listed, the value
+MUST be a string containing the DID Method name. If more than one DID Method is
+listed, the value MUST be an array of string values and each string value
+MUST be a string containing the DID Method name. Listing multiple values


Suggested change

MUST be a string containing the DID Method name. Listing multiple values

MUST be a string containing a DID Method name. Listing multiple values

index.html

David-Chadwick · 2022-08-09T20:30:13Z

Here is how OIDC4VCI provides proof of possession of the DID before issuing the VC to that did. It requires the proof type parameter and optionally the proof parameter. Currently only the jwt proof type is specified, and it must contain the iss, aud, iat and nonce (or possibly jti instead) claims. Here is an example taken from the spec

"proof":"{
  "proof_type": "jwt",
  "jwt": "eyJraWQiOiJkaWQ6ZXhhbXBsZTplYmZlYjFmNzEyZWJjNmYxYzI3NmUxMmVjMjEva2V5cy8
  xIiwiYWxnIjoiRVMyNTYiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJzNkJoZFJrcXQzIiwiYXVkIjoiaHR
  0cHM6Ly9zZXJ2ZXIuZXhhbXBsZS5jb20iLCJpYXQiOiIyMDE4LTA5LTE0VDIxOjE5OjEwWiIsIm5vbm
  NlIjoidFppZ25zbkZicCJ9.ewdkIkPV50iOeBUqMXCC_aZKPxgihac0aW9EkL1nOzM"
}

Where the jwt unencoded and without the signature comprises

{
  "alg": "ES256",
  "typ": "JWT",
  "kid":"did:example:ebfeb1f712ebc6f1c276e12ec21/keys/1"
}.
{
  "iss": "s6BhdRkqt3",
  "aud": "https://server.example.com",
  "iat": 1659145924,
  "nonce": "tZignsnFbp"
}

Co-authored-by: Ted Thibodeau Jr <tthibodeau@openlinksw.com>

msporny · 2022-08-14T19:13:32Z

Multiple reviews, changes requested and made, no objections in 7 days, merging.

msporny added 3 commits August 7, 2022 12:33

Update DID Authentication introduction and examples.

2fcee65

Add normative details on DID Authentication query format.

0edf045

Update complex DID Authentication use case to add did:key.

e753bd0

msporny requested a review from dlongley as a code owner August 7, 2022 16:44

msporny mentioned this pull request Aug 7, 2022

Specify DIDAuthentication protocol in more detail w3c-ccg/vc-api#296

Closed

dlongley approved these changes Aug 7, 2022

View reviewed changes

Add DID Authentication Response Format section.

f1a5e97

mavarley reviewed Aug 8, 2022

View reviewed changes

index.html Outdated Show resolved Hide resolved

mavarley reviewed Aug 8, 2022

View reviewed changes

index.html Outdated Show resolved Hide resolved

mavarley reviewed Aug 8, 2022

View reviewed changes

index.html Show resolved Hide resolved

Fix grammar in DID Authentication section.

0889042

Co-authored-by: Dave Longley <dlongley@digitalbazaar.com> Co-authored-by: Mike Varley <mavarley@gmail.com>

msporny force-pushed the msporny-didauth-detail branch from 94598a2 to 0889042 Compare August 8, 2022 13:03

dmitrizagidulin approved these changes Aug 9, 2022

View reviewed changes

TallTed reviewed Aug 9, 2022

View reviewed changes

index.html Outdated Show resolved Hide resolved

TallTed reviewed Aug 9, 2022

View reviewed changes

index.html Outdated Show resolved Hide resolved

TallTed reviewed Aug 9, 2022

View reviewed changes

index.html Outdated Show resolved Hide resolved

TallTed reviewed Aug 9, 2022

View reviewed changes

index.html Outdated Show resolved Hide resolved

TallTed reviewed Aug 9, 2022

View reviewed changes

index.html Outdated Show resolved Hide resolved

TallTed reviewed Aug 9, 2022

View reviewed changes

index.html Outdated Show resolved Hide resolved

jandrieu mentioned this pull request Aug 9, 2022

Add language clarifying the security implications of the 'domain' property in DID Authentication w3c-ccg/vc-api#300

Closed

msporny and others added 3 commits August 14, 2022 14:34

Implement object descriptors for DID Methods.

d939bad

Apply fixes to DID Authentication from @TallTed.

8340869

Co-authored-by: Ted Thibodeau Jr <tthibodeau@openlinksw.com>

Add object descriptors for cryptosuites.

e7c4a51

msporny force-pushed the msporny-didauth-detail branch from 32f3fdb to e7c4a51 Compare August 14, 2022 19:12

msporny merged commit c9a4fe9 into main Aug 14, 2022

msporny deleted the msporny-didauth-detail branch August 14, 2022 19:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add more detail to DID Authentication section. #18

Add more detail to DID Authentication section. #18

msporny commented Aug 7, 2022 •

edited by pr-preview bot

dlongley left a comment

dlongley Aug 7, 2022 •

edited

mavarley Aug 8, 2022

msporny Aug 8, 2022

dmitrizagidulin Aug 9, 2022

msporny Aug 9, 2022

msporny Aug 14, 2022 •

edited

mavarley Aug 8, 2022

mavarley Aug 8, 2022

msporny Aug 8, 2022 •

edited

dmitrizagidulin Aug 9, 2022

msporny Aug 9, 2022

msporny Aug 14, 2022

dmitrizagidulin commented Aug 9, 2022

dmitrizagidulin left a comment

TallTed Aug 9, 2022

David-Chadwick commented Aug 9, 2022 •

edited by msporny

msporny commented Aug 14, 2022

	MUST be a string containing the DID Method name. Listing multiple values
	MUST be a string containing a DID Method name. Listing multiple values

Add more detail to DID Authentication section. #18

Add more detail to DID Authentication section. #18

Conversation

msporny commented Aug 7, 2022 • edited by pr-preview bot

dlongley left a comment

Choose a reason for hiding this comment

dlongley Aug 7, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

msporny Aug 14, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

msporny Aug 8, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dmitrizagidulin commented Aug 9, 2022

dmitrizagidulin left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

David-Chadwick commented Aug 9, 2022 • edited by msporny

msporny commented Aug 14, 2022

msporny commented Aug 7, 2022 •

edited by pr-preview bot

dlongley Aug 7, 2022 •

edited

msporny Aug 14, 2022 •

edited

msporny Aug 8, 2022 •

edited

David-Chadwick commented Aug 9, 2022 •

edited by msporny