search

w3c / vc-data-model

W3C Verifiable Credentials v2.0 Specification
https://w3c.github.io/vc-data-model/
Other
298 stars 106 forks source link

Add mechanism to cryptographically secure non-credential VP properties (contexts etc) #1360

Open dmitrizagidulin opened 11 months ago

dmitrizagidulin commented 11 months ago

(Extracting from issue #1265, as requested on the previous call.) Verifiable Presentations need a way to cryptographically secure externally linked resources (such as @contexts) that is similar to the VC relatedResources/digestSRI mechanism.

dmitrizagidulin commented 11 months ago

My proposal - we add the relatedResources field to the VP data model. (That is, extend the domain of the relatedResources field to be either VC or VP.)

OR13 commented 11 months ago

this is not an issue for vc-jose-cose, additional claims can be present, and if not understood they are ignored.

in the context of rdf, they get assigned "issuer dependent terms".

OR13 commented 11 months ago

@dmitrizagidulin that functionality is still supported by what I said... and it still needs to be interpreted consistently by issuers and verifiers to be useful.

dmitrizagidulin commented 11 months ago

@OR13 I agree that schema-wise, it's not an issue for jose/cose serializations. However, we should still highlight its use in VPs, so that verifiers interpret it consistently

iherman commented 11 months ago

The issue was discussed in a meeting on 2023-11-28

View the transcript #### 1.2. Add mechanism to cryptographically secure non-credential VP properties (contexts etc) (issue vc-data-model#1360) _See github issue [vc-data-model#1360](https://github.com/w3c/vc-data-model/issues/1360)._ **Dmitri Zagidulin:** We want to be able to lock these down cryptographically. … We have only added this for verifiable credentials. … But not for related resources. … We need to do this for VPs. **Brent Zundel:** Can the solution be as simple as saying "this section also refers to VPs". **Manu Sporny:** Do you mean "related resources"? … I can volunteer to write a PR for this. > *Joe Andrieu:* correct. id we need to secure contexts we should do that. arbitrary resources is a layer violation. > *Phillip Long:* pdl-asu has joined #vcwg-special. > *Joe Andrieu:* happy to review pr.
msporny commented 11 months ago

PR #1370 has been raised to address this issue. This issue will be closed once issue #1370 has been merged.

msporny commented 11 months ago

PR #1370 has failed to gain consensus.

iherman commented 11 months ago

The issue was discussed in a meeting on 2023-12-13

View the transcript #### 2.3. Add mechanism to cryptographically secure non-credential VP properties (contexts etc) (issue vc-data-model#1360) _See github issue [vc-data-model#1360](https://github.com/w3c/vc-data-model/issues/1360)._ **Brent Zundel:** add mechanism to secure presentation metadata, related to related resource stuff. … separated from enveloped credentials. … seems like we tried, and now its time to decide to close the issue... if it stays open, it will be labeled future work. **Dmitri Zagidulin:** I recommend we label future work. … this seems important, but we should leave a roadmarker for the future us. **Brent Zundel:** unless there is objection, I will label as future work. … I will remove the before CR label, and unassign manu.
iherman commented 7 months ago

The issue was discussed in a meeting on 2024-04-03

View the transcript #### 2.1. Add mechanism to cryptographically secure non-credential VP properties (contexts etc) (issue vc-data-model#1360) _See github issue [vc-data-model#1360](https://github.com/w3c/vc-data-model/issues/1360)._ **Manu Sporny:** we deferred this to a future WG. **Gabe Cohen:** ok. no worries there. … current issues don't seem pressing. there are two PRs. **Manu Sporny:** can we turn to status list issues?