Closed OR13 closed 11 months ago
VC can be signed with JWS only without JWT claims or cnf. I guess both examples could/should be presented. One would be securing using JWS, other would be securing using JWT.
@alenhorvat your comment seems not relevant to the issue... the issue is that the text suggests cnf
will be present in the example, but it is not.
VC can be signed with JWS only without JWT claims or cnf.
In w3c vcdm v1.1 typ
MUST be JWT.
In w3c vcdm v2, see https://github.com/w3c/vc-jose-cose
I don't think your statement is accurate currently, regarding w3c vcdm... but it could be accurate regarding "other things called vcs".
I guess both examples could/should be presented. One would be securing using JWS, other would be securing using JWT.
I would expect the SD-JWT repo to only have examples that are sd-jwt
.... regardless of if they have a typ
value set that follows the JWT BCP.
I would not expect JWS to be relevant to this repo, even if its used internally by JWT or SD-JWT.
@OR13 thank you for the corrections.
Agree.
Yeah, it does say "Key Binding is applied using the Holder's public key passed in a cnf claim in the SD-JWT." right there at https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-05#appendix-A.4 so a cnf
claim should be in the example that follows. It'll show up in the example SD-JWT payload as it does in other examples.
PR #339 adds cnf
to example 4b
see, for example, https://drafts.oauth.net/oauth-selective-disclosure-jwt/bc-cnf-to-ex4b/draft-ietf-oauth-selective-disclosure-jwt.html#appendix-A.4-8
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-05#appendix-A.4
compared to https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-05#section-5.5
expected to see this: