eu-digital-identity-wallet / eudi-lib-jvm-openid4vci-kt

Implementation of OpenID for Verifiable Credential Issuance protocol (wallet's role) in Kotlin
Apache License 2.0
18 stars 8 forks source link

Support attestation-based client authentication #281

Closed babisRoutis closed 1 month ago

babisRoutis commented 2 months ago

PR aims (hopefully) to support attestation-base client (wallet) authentication.

Closes #304

babisRoutis commented 1 month ago

Attestation based client authentication states that

Implementers should be aware that the design of this authentication mechanism deliberately allows for a Client Instance to re-use a single Client Attestation JWT in multiple interactions/requests with an Authorization Server, whilst producing a fresh Client Attestation PoP JWT. Client deployments should consider this when determining the validity period for issued Client Attestation JWTs as this ultimately controls how long a Client Instance can re-use a single Client Attestation JWT.

To my understanding, the highlighted phrase means that library should produce a new PoP JWT with each interaction. For instance, in a typical HAIP scenario

Those two interactions, will use different PoP JWT, yet bound to the same client attestation JWT.