Open peppelinux opened 1 month ago
Note that a VC may be carried as printed material (e.g., a barcode). In other words, a VC does not need to be digital, nor does holding it require the use of a digital wallet.
a qr code is digital no matter the medium here are the terms in other specs. -- i would not try to change word definitions to match some protocol, but how it really works in the real world. Guardian = a human or role that has statutory capability to control access to the subject’s credentials and other data. (See below) Holder = the person who has control of the phone and of access to the wallet and credentials on the wallet. Subject = the identified person (or persona) that the credential is issued to, maybe the Holder or another User as well. User = In this report the user can be any of the Holder, Verifier agent, Subject or other person in authorized possession of the Phone to complete the consent process. Verifier = the entity that receives and determines if the subject attribute data is sufficient Wallet = code running on the phone that will protect PII or authentication secrets and can collect consent and register accesses.
The current definition of "Holder" in the OpenID4VP specifications states:
This definition, while succinct, lacks clarity on the technical aspects of who or what constitutes a "Holder" in practical scenarios, especially when considering the interaction between the user and their digital wallet.
Points for Clarification:
User vs. User+Wallet as Holder
Role of the Wallet
Combined Entity as Holder
Suggested Revision
To address these points, I propose revising the definition of "Holder" to better articulate the relationship and roles of the user and the wallet. The revised definition could read:
All this issue description can be summarized with the question <<Really, who is the Holder?>>