Missing security considerations on MITM, cloning etc.

[awoie]

We should add to the security considerations section that the VCDM does not prevent from MITM, replay and cloning attacks. This applies to online and offline use cases. The VCDM does not have any mechanisms to allow a verifier to understand whether the presented VC belongs to the holder.

[awoie]

We should probably point out that this is typically handled by securing mechanisms or contextual claims matching, e.g., picture matching, identifier matching etc. Contextual claims matching requires additional vocabs that are out of scope of the core data model.

[decentralgabe]

+1 to pointing to this being handled by securing mechanisms. As part of this it may be worth opening issues on existing securing mechanisms to make sure this is covered.

[iherman]

The issue was discussed in a meeting on 2023-07-12

• no resolutions were taken

View the transcript

5.2. Missing security considerations on MITM, cloning etc. (issue vc-data-model#1138)

See github issue vc-data-model#1138.

Brent Zundel: missing security considerations... seems post CR.

Manu Sporny: +1 to after CR.

Brent Zundel: who will be assigned?

Gabe Cohen: I can take it.