OpenID4VCs: Security & Trust Model Document

OIDF-automation commented 2 years ago

Imported from AB/Connect bitbucket: https://bitbucket.org/openid/connect/issues/1562

Original Reporter: tlodderstedt

We need a comprehensive analysis and description of the security of the OpenID4VCs protocol family, which also includes the underlying trust model. It is important to conduct the analysis end 2 end for the whole family since there are interdependencies.

Here are just some initial thoughts:

Authentic claims - signed data by a trusted issuer
trusted issuer - signed data / identification of issuer / management of trusted issuers
Prevention of copying/replay of credentials / impersonation - holder binding (cryptographic, biometric, claims-based)
Security of cryptographic holder binding - attestation of different kind
Trustworthiness of processing by wallet - 3rd party verification / confirmation
Design philosophy: issuer does the heavy lift, verifier can be sure all pre-requisites are fulfilled by wallet if there exists a credential issued by a trusted issuer (since it conforms to its policy)
Confidentially of user claims - protected cloud systems / encryption on rest, encrypted transmission
Issuance - Do we need nonce and audience in issuance?
Impersonation by attacker - authentication to wallet

‌

OIDF-automation commented 2 years ago

Imported from AB/Connect bitbucket - Original Commenter: dwc8

Specify conceptual models first.

Re: design philosophy. Keep it simple, pin down options to mimimum for viable open interworking.

OIDF-automation commented 2 years ago

Imported from AB/Connect bitbucket - Original Commenter: KristinaYasuda

there is also Issue #1556

for VP spec:

How does a verifier establish trust in a wallet, esp. its ability to handle key material securely?
presentation_submission is unsigned metadata, handle with care

‌

OIDF-automation commented 2 years ago

Imported from AB/Connect bitbucket - Original Commenter: KristinaYasuda

also #1516

OIDF-automation commented 2 years ago

Imported from AB/Connect bitbucket - Original Commenter: KristinaYasuda

also #1425

OIDF-automation commented 2 years ago

Imported from AB/Connect bitbucket - Original Commenter: josephheenan

As discussed on today’s call, response_mode=post probably opens up some reflection/open proxy style attacks, and Brian commented that the cross-device flow in general likely has more.

Sakurann commented 9 months ago

this document has been adopted here: https://github.com/openid/OpenID4VC_SecTrust

openid / OpenID4VP