search

Sphereon-Opensource / SIOP-OID4VP

Self Issued OpenID Provider v2 (SIOP) with optional OpenID for Verifiable Presentations (OpenID4VP)
77 stars 25 forks source link

rp.verifyAuthenticationResponseJwt #16

Closed siacomuzzi closed 1 year ago

siacomuzzi commented 2 years ago

Hi,

I'm wondering if the rp.verifyAuthenticationResponseJwt is taking into account the integrity of the VCs included into the VP. For example, to detect a possible scenario where a (malicious) holder has changed some attributes of the VC (like credentialSubject) before submit the VP to the relying party (verifier).

Thank you

nklomp commented 2 years ago

Hi @siacomuzzi Right now they are not. Current version of the SIOP package is still in an alpha stage. We are actually working on it for the next few weeks to get it more to a beta stage, as well to update it to the latest SIOPv2 and OIDC4VP specs. We will certainly make provisions in the form of callbacks to verify VPs and thus VCs with whatever library of choice for VCs

nklomp commented 1 year ago

v0.3.0 has callback support for verification