italia / eudi-wallet-it-docs

Italian EUDI Wallet Technical Specifications
Creative Commons Zero v1.0 Universal
56 stars 20 forks source link

[Relying Party Solution] Clarification requests Presentation Submission #376

Closed Zicchio closed 2 months ago

Zicchio commented 3 months ago

The latest specification slightly modify the shape of a vp token released from a Wallet Instance toward a Relying. For reference, I am talking about thiss block of specs.

https://github.com/italia/eudi-wallet-it-docs/blob/e58ad09fa241c2f3f459f803564bf60e59eba2f6/docs/en/remote-flow.rst?plain=1#L379-L496

Upon initial inspection, there are two details that to me are unclear.

(1) In the key binding JWT used as a proof of possession of the cnf key, it is stated that https://github.com/italia/eudi-wallet-it-docs/blob/e58ad09fa241c2f3f459f803564bf60e59eba2f6/docs/en/remote-flow.rst?plain=1#L493-L494

Am I correct in assuming that this nonce is the same nonce presented in the Request Object defined here? https://github.com/italia/eudi-wallet-it-docs/blob/e58ad09fa241c2f3f459f803564bf60e59eba2f6/docs/en/remote-flow.rst?plain=1#L304-L305

If so, why is it stated that "[...] How this value is obtained is up to the protocol used and out of scope of this specification."?

(2) The non normative example of the presentation submission contains paths https://github.com/italia/eudi-wallet-it-docs/blob/e58ad09fa241c2f3f459f803564bf60e59eba2f6/docs/en/remote-flow.rst?plain=1#L416 and https://github.com/italia/eudi-wallet-it-docs/blob/e58ad09fa241c2f3f459f803564bf60e59eba2f6/docs/en/remote-flow.rst?plain=1#L421 what is .vp in the path referencing here? Is it simply a placeholder?

peppelinux commented 3 months ago

according to https://github.com/italia/eudi-wallet-it-docs/pull/251

vp_tokens is an array which entry are not anymore vp jwt

@m-basili is going to align all the presentation definition examples contained in the specs in milestone 0.8.0

peppelinux commented 3 months ago

@Zicchio it seems that the isexample about prensetation_definition is fixed in v 0.8.0, see:

https://github.com/italia/eudi-wallet-it-docs/blob/versione-corrente/examples/presentation-definition.json

while the way the nonce is described is taken directly from the SD-JWT specs, here:

https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/