From bcc04a705b42328dfa370589d1c9b96791072e70 Mon Sep 17 00:00:00 2001 From: Michel Abdalla <90608873+michelabdalla-dfinity@users.noreply.github.com> Date: Wed, 21 Dec 2022 09:37:05 +0100 Subject: [PATCH] Attribute sharing - Added details and examples for the message flows (#11) --- diagrams/attribute-flow-details.png | Bin 0 -> 38403 bytes topics/attribute-sharing.md | 485 +++++++++++++++++++++++++++- 2 files changed, 473 insertions(+), 12 deletions(-) create mode 100644 diagrams/attribute-flow-details.png diff --git a/diagrams/attribute-flow-details.png b/diagrams/attribute-flow-details.png new file mode 100644 index 0000000000000000000000000000000000000000..855ab4cf8ce71f0c9fc99562df30eb18ed2021ba GIT binary patch literal 38403 zcmcG$by!v1`ZhWdBqbIgDiX3tl@_HzLIFv!kWK{=DQO9jR-_aV5CjPk6hWlBk(QPY z1!<)FJaggu`>yMJ=lkPa=Q`~D?#;WHYtAvpc*Ya=eLo{mLrsC4l%5np5OO6&c})bt zuS5{M7Ggs9MC!N;e1H(#mr<2Lkn9k$U8AG$?`KRDHB}MBl>}0#tS>maJ4Qe`lnj@&2#H`lGAqz)5IvW zt!wkT=*)Snu9QphzZ4Vx63VJ#l`Wzr_9>Xy%;w}65h?LEy_$Acf(QO=-!2%nvKV-J zCcDLkF719%`s?wj`<9|(PS)J$@Xoe`ZbI>+kuvww^78URypLV+U0q$064t=m>`{`o^se9DIVq({C z>9KOuf1Ku$zsh~tx$nt39SsH(jNtBO#82<0aZB$R&0>lFrQq8tuJy%fJvnK26@&Kn zo@D=ib4!c%l)#*PY(PN6Edde^ESBE;QZU`oD~qyv`Xn&cnmUP~6lJFHOyS#U!lQ#* z>esc`F+YX0KP0^mjb5VN-FuQEbraq`;&AYILYMLl7oS#}cba3EPdx97R^ZS}>QC)R z%AGTzje1oz(sn{Te&oeyg{Y?g6`13*xM$|TOkKHpj}GqpP%EFl?X#=h4@%KX^lnS_ z8^a2ZJXqi{VUaO{f2bX?SZw;?cMOHrM?bmyzvIn%96i}Pe4i@Z=+wCi`eqXX(<46lQt$&9Qj&v3ICae2R# z;>foM<@0d8vWYrB22+?@_nVIGQQtAdc|-nXCwm3*g&)hX7~g=0z^5*S*Y0(43JFC_Ny}5|EzH} zNY2@j@FSZ$TS;d&_#eCOZPZttaZrS1qw!Nh$9?SW@R`KLr z@%%JKSghS~72IfvN%;Md5wKRHk%6pA>pV)_A5Y=__(uS5ff@Jj7r9@+x~i#ic^~y6 zSwfuSP{ZO!4J(bE%~7nB$)%n`Ap5j@R-?~ao7K}F)z1Q90HQn;{^%vQG@PkpEaycE zgd<3Xs0tcQ;Wrxi0H*1zg9waw!W$j0XbMc_=P&A*(yLiu zuhHOU&!XhpB2|^F92kr4j7D5tRe+6;uODjM$rQfuDk_Kb*Phw|n=`W*ZGXFg3lW#7GL8;sb70 z{CoQb(QOVJO%op2^ED%0KK5$Uw`X9LV~1DdZ&Vn84aU@dsSAURLOy%j1h%!NzbtIp zbGT6_ezVA(I~spR)|!8c5DbnLHvo!H@22%?>T7dOI3H>FwGa^U{EAFR@!|K3ao;mK z6)Xt@$6or4ff1g{76`elr{Cy+KHKQ<*|%=#;e+b|bG^nG)I{~t>6SxqS0WYoG-BKe zXmJj^P{Q}FG5R$H2D{M0zpBsh!wOyX!C42}+hH$wJLM<|HU}==`+vgy(Wy%lR>V!g zm&1qL)amv5(oV%CNvr8UZug3b6sG)L-e;K^4Y-kCFz!alGcnJ>Ke9NS}q*4{TLI0{<<&!TwajMWBHI%P)z&CAjyJ$OS=(!+1j^9r+Y3lTgL?Dv_=`g84k z*RR*pbGxn;^RBMVvve6v=ToHQCt6iGqH<f8- zr()*C$*kx<`6xufQ#PXsz?S4Nt{RfGFTYAHWeHm=ZIb^!rJC2NAo4o~b#JDq( z_Q{e*Sae^WMXsXC&tnyFt926F{AHyMWcBKC@(^iJhwG$13E?vTrvk)MfyVWl=f)Nm zq+Sp!T-~IA*xqXiF2}zTofwW+@YWF(V#e(54bJ@b&ULVI zDPFqM5j|>s*_d^ceYLCc1R?9z-te9xBAmGALfr8v-8vY}EHYMHG2VIb;L#N=^MEd9 zlLn7fR#D`gPMVzZ?5&Kc@rlUyMI|aKUgBcKHDk5brTam*)-1uLsMlv92!pikkA8(mKpC1A@@{8?k75L)dSuoS!5aUC`)I@f4?0y7_-u+M6tRzKKHyS`iav8e8M zDXb?EoZ)Ml`tREZYR53*U@sJ%~FNWCwz(9+!0#JZ3pY3(`$rX-3C?rbMMC|mTj{G zf?ecQ_IaMGkW?q_bUG0)KQv%Ymo5v|k09asbm#g?zF5gYn&9B}f_TQ%8w6~K7PX{~ zWZT)|MVpc(wwEVj{C9XmTnH$y>>pW~I;t8Z`W{vaOQDyS_LuL(oYd!4jnUCz;dh;< zZ5DRZK79Nv16BmKmQ;}3^^rgF49~?YGa=&Gt0t7N;l?^=%Ewju>oxu5$L5cu@q-stoYgOZn)FV+?a5>06Y^(1*o_)-9mZy5VhJfHGVZeZ&e~VLe zP}5rj&)}~!q%gqoYqQ-La(k(a&s3iAg1_ob@(3dRWd+XCgC{fpYY1V1H>=mQswH;h z*z85&@-1;O@p_I^U;z%z)U9Q+?P`Sk9%Uw%ZaRH`#XLbYMC17isIzh5qK!ViR1sYg71b*l z?YN=tzZPTBxe$NTQyLNz)B}r3KwiQdi{G~{p%Eu#L1WR$maDPBicQ1GI=S;bN4H(`fWhOi)>heidCB!FwTnn9R zb2X_{l`R2p{3(QAxQAGo%?c8=SsEISU6IwPwD@?)5nuXZ#>PVz$HO(BIPBGhy7^vk zoM(vY+m2_xI+Ji9^zyE;$6g(IMzW{S%xU_0x@)IjmXY6rH!=SG;?($}yW8*jmEFto zLKv{$u;jV5s&&0bDT^)RhQjXdG&d=IkAz{!YDQRD>9okjk2W8FVqy0sYV%r)Do1r? z>6`JTUl93X^ZHu**KVG(J!6@FE2$W}E?`Sx(^Z{K47G^AzwE9!xI#>+X;{HtUGg{c zfKo}kknRXHQjn2nU(4Z)Et4zbp)pP$Kh;8C7wM;6`Xpy|dM;^SZqcRJ`UiROY^u*Cj(0W{-LFh1>raSzx9Hi_;m|@H50Qr@azX z-k#eZcG_f~+7*p#m_8X>?_(Cuq+jIRUbB%|bfo*@iTY1dHfKsXXuh}INi6!EbSot9 zoERz04Ayq7)6sg)!4?0(EPbZ_)Z!FcSzxxFAH5XJ57(2Ds*l@E9A6%J4%fr_8gD!@Ka%><2>avXe-+(tMMbGP&j|^-TN19mW%@h+ zNyog%jx(ES!NoxF9Z%cZ!w+mp*)zQW8FmxQqn6it}bNNg{?Q~JX0Mj{Yl*!#o4I@j!oRTh!9 zVkFPht(~2%aRuq{uQIO!{9b^$-~Bd2CX9_-F`sW4qb04;YGtGe*P*a~{}ig17a#xH zD%?LYPSbP2B8Cn7-b6$9mGF2ScVg5N5hbC*$fuvL@2v@LlwQ5tYWe$OPymFNhAYIS z1*$EdjFoo`Kh0Hz3MKYY>-1Z2zqr(oImab_!}{ZULHd@XY1|pwlueMb`;r`YoqWXgB%zKo&%oK?kd z3H#pJ^_+`4yB$9SA&%^qt-OP~zZW-mpI;Kvv-ozZH6`dJwLcG;T;v>yRV6f9n)cs`MO{dG@9!Qf_Kx8nJxvF?qLsSvmO`!5;= zI@oHfwB#eaY;3I_JgS9@+Vecm>TCJlo`TsiHll33i@kG4*NzaJN^su_n{N0X1Q^OFM zV#chYWwY^*dpA8azk9M$|GD^vYR!h5)Q-YlQ7DWN0u_uN>Vt1?r3oh_PEZbeGT+;2 zH8xfesuW>}F=v3;9gA64ezLxG!u;TG(NLsOqR4SRFL}AC341=|9Y7fzhSV0;2c#8m z7rg^A8-FbP18yi z+0ett$NIa&zp#$4LuC5moA%-T<8arzEdpqAI_{6f(9u`99ZR|n5m87UW~a=&^WEot z>T^<`@*bodcXjE%rYvL&ITMqoARcpxK@Djp&5QbY^KsM)-?#W|)k4@wI>A@fRxKy` zEy(;NY_Si_kxJGOx^s*A(DZa_mP$!Qt8Nlt5>Yl+@3-OyX92l@Y(({pb=IGy^%&ll zW$k~+&G+W)(OJK3|NK_Rb=Winc$C9!p6})N4AuF=e8D(x9;_val=SELzCJ;d)Hns+ z5iNO+iu$Ke)TXd;Sk=YczirDU)WK$KT@z!&{Pl4omLh>8r-Ch7HwNlXn6OP9E6E_` zYj}fiI!}Y2ocqHbGYMtq2jkmzZ{kVVxYbj5#cNMLNK$J4%am4qK2t&o3Ug09M z3TuK=jyDaA>z4tq*0=CF$>oz!p7L{!;^|WbFsS@okX+K>`ogm%3I!a=&esqbYyL0i zgu$KBwj{YgqjF4O#;l2ziNltOWsvJth48ss0cXc}8s8pkI$DbaU9)V6O$ZIXdI zLp>_e-3NfFId=V`NtWT$VV&@7H6_I-ZEv%v{YC5RYmNVeUzwX{x04N2ip}0kRLoRY z35EJM@{Wd2ka~tFQEWpav0R!uT>_nDQVonW$)hloTz~RaG(kkC;kfc-5yXKn7Rsb< z&+5b4$(~GV&_VE4WTe0Z({R*GlEP)xmYwDRYYEU8U{BN!k1p5h8)ADq4P+TkoUUf+ zoNR|n9i5oSRRtuEOCGL7$Ue0Cx# z-i=1YoCZcRn^0&e688KSSC*VBmZl z5#e@ymABx03i+})-|Ni8k;L+qTl?IL@#ik9Mwe86B!eGkLxIuVC&$%FR^t2YPM%&N zc5@FjuYsLLE&QdFgH#yyrB;S3Rm;V;0j zrOP&?>{iJ7uPMr#sA-8u9}o6d|B%~q@oAuWCRDRyZTH&(H{5O2CH(H+k!;+N3Wq=y zW5f7XPb9`(m*H>8#8yj5BR0u442&mS+Pz`8*@()uVI`P{DP#-Nh^Au zOPM+?rqLYm+!+4I6?fRCebKp*mM+vC1=PQZW>;M&8O3YHoSuQ7`LbWgqv7go!^DpX zE(TnRqneEbCTxLQ-3H1Q=X>3x9Od#tM%-j(0@<_7Av72z-$s5_A-Lp`vn*>;qwLA? zS>XYHl6XehBbkLgt%(!zY^R3Bf5^keG5LH5jH(;T3#Id8@1#?TWyKs_BA4+L(IEo{sL;$@JZQLt*IG)yd z`iq0YxmQd~fL?Z*h2UdUJt7;I@+O0|Fgwvr!p1+Q`AJeSvlrjk6s^k5wMl)Sj0#`~ zGNYV+nmNRq|I#M*>hq}^j@b%v0Swnn?8)@ing|dS=7M4&g(8rFHo}lTjO^k!=L@rE zkkQ~5H$Sf^%TuI*2ap+40?^J_=kL{;dY&k;WRmL;2f%$8R~L0d-YrC9h_&N7O#e_A z%P5h>*|wg}v8o;LmQu25D%!KTQ`You2OJK_8pQA#4atZvyJHSbi(e#T-1sXTb1LnH`yDVNif&c+5wV5C~fFT}0u@`#c z*L7d{`!xll+Xsg{K4&0s^S02a8WccyMV(#-=svqZkv%cZh_yQ!>F{8D!Z>UMidJAqfUfVa!nW&ClTbhYhj&Be?QFY4=f86dpqp+ex(uv`DUi+TF?WiQ zP^AffCH{VP+A_^^$DQ3aG9&`2!kR2P&BMap{L+}cq0Lba*^#2M>KOXivoN1Io(a#O z8gU%gCM zw5<$@NG*gwqwA(M$;=;B<=I|CDGVTI_SGYS(FDaJ004dx*G%j@rM2}Yz&skZ0~8J# zdiEH2X@n|b{M4{MKv-lQ?_7*Q1o7Z%q}UhoFN5kbbkS6APq7k1Aq13W;8I1kx}{Kqrh=i|e4h>U4ot6}S_ z)uK2$wsaqh{R0&Nf{=Zq!YI94)VwxFYsd3Qljt&yg8ABCpaKB*`oe`^!hFyS00jlZ zy<=7UtQy;lAeQ#!vL7|jE3X{u;GG;vrtspZ^NrDlAf_-#6M{nf0(fwJC^*~mpYGVE zteyJ@R@>c$T6w8*=L%QWhpP1x`d6|V*&Gyw@S+LC3&EmXj$VPXTH*FRF#rO-_&yI% zG=}A}>D6-@`&_&rTm6dzMZE1S0I3K6j*pDTYm-574|iyVJ7oV0C+wcvRFLIlqd+)d zj>MPuJ@+yB)+2TE1NmVG37)US7_iu=v{em57%0nQ4}ORsR~7C@b+L4a7*o$B`w(c^ ze_}jZ=zkY^9$+3$gaJ*|_vO*WOIAuo*tul*)+sQFv>rA*#F4BzGiS`5!MY^AaRj2@zz=-!^3)Ht=b;2r&+6e*fd=lM#`IdBQdt9Ubd zsaaQ~@|^91tqxlU$4bGKW%ut2h-JM~oUt({jwVpI1OE(0>~~Hq==Id$tyoh0j}YZJ zvI>_|op|sdg~Fe(lFd1M0JuC2aQMGc=5cHajBF1)%oW&ikpA8M;~8#3EfIJ;D(>lT zZE=c)mPt*N--87l1Ud=Fs;13(t69T)&Jab6Dt%OaUkeDAGb`(B-!Hi5GSmRVxY@EU zv%Mghc~VkIfF#}r%u*sDhYa!9bg%AmJZOuTj!7m9gPWT~80ko6n;?aHu zJIEx%jo=klV^o|)d1!#8s~WH@f@~B6KOJ1$H+cLs(=S5~0rU!)iZ^H2+{o1B^qYoP z=1l&Z5EH}tmDsRY1LF7D3NsqhZg5o~#HU*J6b3?7-0wE8;d7uDEq!!Gr#uWu4Bl!Xxp#?7{;tDH@ zF6>^5J1|i{q6w5gWEUQFSc_WPwN8jYxjp!yzyC<^)bQ}$Ig|*Ro(mUah^l4Nl69kG zsPl8kNLg29U&>LTr6?Yp3%^yjxZzvV)FJ+1LcgXtl~O|mWp zTtZx0p-T-kHE_Kbw|2Hrmf!QqqB|5fqOb&7kR$>fw0;Cs3BW)UFt%BvOs(59&XWg9NfYKOu}7E3~tcK7hx?@xRnNc4^7R34i|!8RL$B3 zM-CPog;q;Y15CO@A5Oghjl9;QK!W>iB9jLC9AyEr9iL+~VP^3I$3Q&nQ8W zW&ZFHO7GUOImf*fH>foW!@Y;OhFzgJq>r{QkLJ`Jj~KP>f|?4lv+L!$T>nNniFhzE z1^opAaUxJ@Nu)?ihf+Ny{Al*!_Z0#9kp&_Rw`g&6aEHe^n?eu|RdCEHtelLqn<^19 zI6eIe9$yQOKN&3fA)~w|@o=t%xFIb9ZA-Y=G2CC_*KrN=L*vW?bPFoCklPxsAmO8n1~<& zL=4p`@c-M?6w`N_B2hI8nl5mu`NO+?*ljurbZvzy$AA07?lLglV}J|WPe}tG4z#{A z!_6n!!O;rLkz&ViqqH-$jKAv(kR#xFk6{f2Ao9brypQ1HSaui>Lo~1gu)+Rakj?i~ z2wC8^JA4r#YG6YVuNCiluv&rJ!1KX;q*tH8-J6Irsu&>jnmfG*%0Q@-qE{?iT*R`{ zDWZfi{D?k<5Q5^3>D4yCpVw<-HP&n$1{k4xaNQS?9!L%({2mSO5+YOhxUJIBxAeEj zzc#xLePUPFU=Y9v|2>h@cCk4Dk3UOR&g7ZW(#emX3jl!hrpiLQ!qOPr}3sXc+9!=JmJ#nf#=@_iw^?fWgC(l5DkASMy|d~dIk?ZN#?-lVZ!#g#CcSU_6w22c53W36X%J_Zmg_=ZVuC8(3Wi@;h}xvqlDk;Yn_lP(HK*|9z$TUbCXhfP z8oL%(7~FB!0q0*o=%GEEruL>P@(C83Gn=h&(@|&DOz;%$zU0Dh9#*7BgU3jr=wJb# zleq84R3m+=>F{DHPw8TwZH|aQUsZ66pUpn9J2Eq0tGto}*#hxi*4E0LRGD4vgr@&h z$gXaBUQv_v#=ol!r2ZT!MclLW8>w27j%eMJ*kGW@7*lObEg>rxvb+cdCA{QwDz80xSEi zdJKah|7dM{(R*HB?PLNj+l?z2QR zo{4DuvLGG*8m+qQ5U5vc6QTr3n2vK)zJIr>5fIT;n0plN{F=4H_yzLUfJs2>8utp7O1WWjhPZ;FXsairjbBt(u6SYCz*pC1cXT{^CL1!LB-= z$L<8P5@V1YG3hZcRQyzZCdsy9wtfjdJ|IB!rTqeWDX~+vv-Rx)8z-gQdMO1+7B0RC z-P>URTDR&(y8QI6Vfq9+=lkB%8sOZKcR??!&huGKX;5G}D`ts;h4rNa;%Ks%g@(6_ zJq8_i*5?Nxb5Us)hyQaL1in|FpRb)>_Lkk}Pg4TD#4OF81`qJh}OWQJ& zy3Tv=0*x29ZF`}hwN9HK#xDhIK~KDJT2Pf3YRVe&SWKxiCXZd36Xb3}vLznv@)K*% z8bsmCG%bI(m#q;rfrgZCi%5~?>Yv04z~rD@@$Kki{XcvGz)#rhBYfSLg|5R8$I@>m zjoC#&_Sr!UH`N@2yJs)MFPP8F2R(-|rZs~_$)}aFF8HMyI*pjowP(pSvqWJNMN2KodoNZpAUG=bC&VeTLhTPijgFZ{s-OeI|Fe{?JnAd6%QCs|aNH8jL{Eu=$F z+{dySB24k1z++RO1SKUUQA!EYKNCO6N_n}iPo0UX?-^}kZ=^|wa+iVp3$(4(E9LI3 zGqz)?yyq`4&g9&nvBOvblm=r*Rm1(uHgKn>^&yH_coE16ZXdXudku*}Sa{6Kg0!9@ z-4HVvH_nLIP(Z1gIc^SWtQ+>{fuRj({Gw)k*-G!3v&r}cOOAW3 z(NCw@pU-*J9g=le$UK4ubn2}C7miu+_H_Ka3NJisJD)asrc2C-1_%ykg&!HZ8+&(W zXMFrziPFQTk3FmVc&Io6tsW_;JESQoYj<5_Hj`AJ!8%?Boj8Ey`9I4`MSS;2>$`{T zWmT9+kNzfvUi7HDpKl&G~5lz1kf+5*Rh-4a&1Jtc_* z=;siFg?99BeQPNnfa>GP{*_qg{bQhw0A1I%mDcgrF_-b7Tc&0Jn1_@NWgJ%t@gbKz1JR^=hqyOw z+wUq;k6X}+kZL|+t0T}Y}Hu zzt&qrWS_u}2)M{i06XpW8aKD}o!G0E_Piw;H=e)hdR%O)9pCFS8}ZA-OT71eSubbB zU}&L(!h`a97M_c>=T3c<2)WPPnC-UD=d!W+&OVH%Z3`;&8ZDmkHbBZA*uTw>bIk>` z_sQV!I=D#`K(T5(UE51iUs7(VHnQ0ER|{0~C^mBGeaE)=?e))LkprGf9++25K^}{& zKxbSSjRS8G^gI~P&~w-tyeTvhpsE8qTUAFBQX%Rro~j*?9oK&BgBckwym6e-%t31A;+v&=Ju-+>t7TQ;ZILXJ8+M?K zMRlr!`BYPvgWpGzETQleuedL(e@+dd7YO2uyNfRfetmcIT#X5j?uBB9BD}0O?j-Na zVU2*Z!YG_OP8&~4qdn%TwWV|x5D&cQto}&3hNiYVfdd&y?=z+9wRA&#qPKevKI|sb z0zXU_5@=>p1zv{c;2!ruozHxy)1rVu{&r!=89UfufqsgA647YXP3}Dk{4gHUBk}e7 zf@Ls{^#R4@7Xgb;edm}NL=;M}wz*7&@Mxz&p7m@fPKt5&LhQ zsNQ!tfVi}&%8l&AUyxcL%|}hR&%fUWH5aA-2H5>k>HUt7x=9h(Xoj%qjg?&?asu3Q zDcjXe^@NF4r+F<|$*(qm;Imb}odjS9owPF>O92x_sa7XE%d~VxtW{tS){6L?))}ko zzmc9xA3uEv+M{hSlZmeKY^d-RC^~%pgq^u=EwljyvJTMk>PqmLGB@Jcr1@*`I{8D% z2HH1claXP3r&iUf_8EY~sI$Myl)^e=#jgWm2KSTf3d0{;Rp3RpWJY^>|Y$VSp)RS1RO92*Evpvjs-5yvOYMz8vS zh;Hcn*10fslH5&z#M1;wl$yF=?LE$-C%cLU(B>Y$dt?$Wmth!AcMt{)5SVu=dxzOGmzULkFz#_Badm>qYs z^@*;V*~D~Alh_;Z9H7NJq*y_cMIaFGcb|v2lyM>=&~8A?FPitSx2+Zl*C zw~6j1S?tN=SKwpMX;^OFQ!-k( zSLO*?@|NsP7iTV{@9mEZp`e<~^e6{dX#b(;WWU{r`v&Wie2}kMe=RLt9Q`fq$$a}o z)sx|UW9t0{ZvTt*Ag4iAMxxE|R4WE8t+#})PG*AY$^4`bSx-mYlVxMpV_BM46l6eS zUvy^8Au*MXIiqa?B)$#DUlCpFdG$T)Q$H6ir|5F4n`4Hy-7fkbT2yI6jZ13VZBRn6(a}V0?ZkYhC<> zQ{_fuI zP%Q~;jtr@Qit6K28pXT(P z%}difOP8CIycnUO%@N(Xu%F(tzV6qha|t=-YldI1VSL03Br0bw4NLEvdT$ETtu^^R z3}r`a9`lovc1{9;AUFcBpl0mW`8yKBi?iEwb?C^73POa=#?H@PNa`gKJ{KwHKVSI6 z^;TS4Y{9k##I-ZP8KLntNfoK7(t5uZk$%I9>8o&ae|%Zv2mks8dSX9WbGDP*9Lh~M zpO5`=plo%QmTv#MnV$51>AUhk|6esB5|}YGF=UHYa!Y8@nza zrd(jhf^JBrUm@XL?i}l~LM7LLrpZB#ONwnFCW+Rz>`j(2`qn4AbHrpzm`Hb~ zY>mpk-7In_k|}QkwwqDpl^!0T}|+LsrS+6tHrM-6JR% zn>HP)jLP*?U=k=GXKH4=A6gAhF7R+vxM#6L_7{APgd*lN;^1Od&YCetz8G&Vcb3ZRO-(F~@ocik zhu{zR=qy(UDFK)QWx)|(&I6RS%$OT73bMqWCi1O8_TbbkAR}G^E%$DXk}X#*e|f5O zRf|`eW+3#R)qc!3@}sg zDHw(x)_#dg8Z56tH>a@r#)r@sBmse?oRPk^0S#MEI#N${%=#4Jd5V-!dO38IhQ%}2 zd-E^e;(B40USd3b^urwH>e02{%TH>J>3_)Q%stJ!Q~jQ=>1v4OPrjW!hRBkVg+Ci# z2b5!YPHX#7M@Y(Ag$N63*6zJnEe&8e3N@RNT|^_*MvVzH)}TFkUgAxhZhuZ|NZa1iDN4?RZ4=tLM$pqozG zY0bdubQoV(7Z%#QGAvWtHFlxY$yn?%pTkJ|rvPSJldz+2;4?G1SId@pvqLx)eZGkx zU+kJ7i0b-(TdSB)E~<~r2Qr+BFtpRUY7*jH`Nq6lJC7Eraae!#tXcYa-kqpBxj$Zs!wj&Rq$>4(>Ddq*TyD8vS+*S_gCF{9J=gPD4QC(ngDIF zX~OW|ciDwkxX*lrRA_U*D!38q5y)SSBP1vlK!vbemt~#VU*7f<*xaboS%yDzi}42U zekVmhjs9Gi4Ro0xJu=%k!pGKnn8W)4=?Z{KfZKylL-RZ)uDgu{0_Z|KQfbT7ehPm) zoBl^6g|Egp=I3=rX>54pl65fcP~U#|?+!OaZK!(y*ZCBAjP{)031~*!v)6$p60H8g{My|2Ukk?LB@PN7 zoynmuja#jJhA$QBzhZ&AFJDma>(9*avFvP!j&F2=sH=Bm(Erg}3P{qkH)GAh-9c^# zx}HA0gf|TxHfsE$wDwIFG^8VE>r(3OEiadKv((47V@FauesTwPjI7Jbe1d^2+k)=} zVP8^O8WBvst;f7G-_=Eqh(r*u{cu`Ddze6T7xWtITfjZV104sb{0_>j2l)>kJkia( z^{oqV3>zpnp+yqy^n!%=>cx?@(cxx1lX>x)-O*tc=%nMO`J80`IY^~Vnmu8FA&$CK~tyTUMJ8FL-ii?c#MpOR!EbH!G$f(D4%U^Y^ zUT22oRRg;+HA`h>zo;j{sr~cIqi@~ii=d%+37A2KeN;;B&Dmbcja?C4Ke#%mI{4t2!1tucPv+cGM@eGza8D98xBTwF+-o|l_FFMtdM6fI~j3Ef|PgKWfCxVbls76n-75J$37 zptVtD9PpTEUnS9EIVI$cBi3zsKw^WM4SIWgvObSg{D3u1C{GxAp7?9Z7P_RqoCN3E{SQ;vM9$vfzYnY2R`tH>1?Xx0uKz1B1jhx8+0j4|d-rV{ zB=dtMTjYrSQ?9XPv|e@hsrRSugitmH3>7F1dKYX@Pm2k5Et-oAkdB0Waa=MSNwaCQ z0pbx7qER4oK->qgC6VEQRO+FmJz${e*TVQzu2ZJp=^KC;e6}d3J*e9rj#`y0tJ=8q z>e`=Y0E;I-zO4u8SaSD>l7`}wm4lU#f*-EkkH#%6O5D^MU5>pX=v-Rj@Jp^Km$rKh zC_6q!W$TLr52b6c+zb?|5eg$U8z6nF0;C_$u!11kTx9On1RIKM_rh)2Hin!=jAma( zSw-ezs7Dh6UNC7p+{4OvuGm{RbGQal!*xj=#?&g|v4Uo#@dxwvB2N1^&d;?012H(RG`L8Ylv89!&{Q{g8K7~IM zafTd?Y6(EEH+ywoi5;^u`ZoqxpMML7J9hye3;(O?QetOr+5QiE74)(2P_-L`UEk2j`6o`%{O-b51jnE(HH8JI2j`9Cr}45%CW zAKK>FpNrK)9+?m#&j^YULWu5r;s?2({MC9x*hi2h2qxO1_7i3a%K6EPe-sTS;R{oU z^cyez2#bpO0U>SM9sF`}4u?&|%eyK9$I_uqxc8@eX>vy3QNZJCdIDz*qD(`0`8Y-8 z*>1dqED)SD8tc%WdJ3F}#KFK+CesP(QPA|r0X7GvRJ~**d>0kbf*Q%R9w%-=TOS%o zpl<{50w90dDHbXpz);8YXjB210k;mD&N1PjJ0}HzCQi0U$fDUr2~opmlSC~yse|k- z^9#$Lj*x3CkFWDMMkpmli2wit3KhqZdQi3lKlksjna$>yKrp9f5@+O*;G6Ee|2xlt z0_O0jbaS=Hdp%XqeV>!K?*ZEe^Kv68c4Chs^MUV3c17z zv~L;uDODvR2cWZy070Mi!GPBXfQ|8W@O9%WRR_K}O0QuHtk;ejmDxblhoM!0^e}eH z*Qg%wdcfRa8~(%G7iIxNt(m0d-w*>(F`LJQ^<{#H1rBb92}2K0i4GOMn2!Zr9%M(j zQI0rCgZqMH{Us!RZE15kfoTN<4N~FHya%gqmwtzVzySj}JB84y0e}w;l9>nX_aGZO zTZc}md}~N`Vqlz4JFA-z=g4nS;95~>3ADiijo@hD38@zVbg1}*Xz@fM;JyIALBH6M zioqL}Z2;LK&5apFbF?{vohX3{FmUy+RF8=kcn}JQF2er+&|3{D3It^1BMfx(-e4$z zHzyWwQ9@P<6%X`WeBAsA${3YLoggpVQc5o05bDG*REx7%iGiQoMfvk-+;#L9ROOafX^Ynul1r*E40rK`CZr%DVG9& z0T_}WvK$Eb=l^U#Yda_$@X?Xvz#$@tQ@DO5R0ep6ZMMK(*(C@nrgJ|nBDmFn1l(K! zTClH#ms_aj9z{;O+u+FHL?vktqTi(bphL0dT$)v<3iBUrD@k>rWz-2?v%FmoDYQ@k8g#2g(8OPGOn9anjGq z;^&YwWA{|M=SYMe$gR+B)s(O66 zcA{@5gfm$zh%12t35G-+6nJ0-$9oBfqjMis^g?~fx;_ZdZqUj-Nm{hqetoA1NNlm+ z337@RJpK}t_uf1ZfXWv`_K4&F&kLabtdiWJM^`LR7h=bQx)7Bvz7uGg`r5M)0eTk) zVpe!BwR;$JrgmtvSHOulfg~mh_j|pRmYjiILc3K^xuCmoRj9!U1`#5FGEj7;13E6J zTJNB;Kge=3b(clXU&e(|bmC6Kol&L=o`Y_Fus5Tj89X-`-*c^KhQ82}`!g@S@K#Qn z=CZ|Ffc_Lm1dv!1sL){Dd{NRyE2j-7R*XP7c}`kr1N0IPG=PCq{BgLJQuSb755ggO zT*AJ`N^H5h;w}ovAdctJN*y?Kls<<9wMwO>tg3zS=yEBYZHB3FwOfb&#on1T~g zut|*&*RN5yKf3?YfpHG9(kk4cIy2C(Z)Pc5-Dx zog;w68YHC9#exsJg;!V~bN-I>*9S*|EddJW`SR>4A!Nv-Et$^{FVL3KjTk8A*sqY; z0vribL9;%DYPrI4(T->m5=+9~ZUbsJU!nmiI2{0#!QeHhnKy2pyB_Lx5*YOWb*&H} z{a~S!ib@_1N>^vkx&L>t2Y7D?7`Z{`-FwwC*1TXFqsj8|@-txc52U_?nvw;6Jty{^ zeTs}Mm<_eA&yX&K;jd_Lg+|64;mdM+81Du<6@2ecZlkUdOPGECU?oc+;-6Vt56MpQ z(NzpsZf~@mgWm4@-}V4_Vg*qfc;)TjCTRKf8roYQQUl$<1RPV*es~gtE*y)1HufH2 zDj9jukO$p70!dNavcUHJm-<7tF5syjI>a6hMj-E$Pa(Y>#;~yPxzI<`IK0qFf_Gg2 zq}7#iUPM|la0*yJ9B7%bL>%BhpfhM_3RJQ>Y}s;dEryHtl|Ix+bZz|Mi{D=t?wg$h zIL1$C_cQ{n(Z!9q=g*zpqhe3_eQvzTgsIXb~!HjvLI;4yLjf(Sh zRC&eUdZs`5!f(;U0)xwV&O-)-EJ5!>5FEYWb9hVW`KUJtceP*Res6OWETyU4Ej=y}umdc@6Dwz@5;Os>CWNb`|sj=ubl3~^e=@4prZSt@~!3%je&9m zPa4 z?yEpW&fziP&V)O0E7blZL=Dg-(Jz0a4RmS$=YLJHyNbGGg;qTeRNT z42%eeQh*=L6?ub5Y!09#)6M);zv`BXwr9z>HTV`9!!ZNVhlp|0BlXOVKK#;31jG!G zcEZ)U`JTR?v#ftMm(t~Z+RUX#Y*csH5fnxm1EAvlSLIzse#-9RLFd{B1I+tN{+qq! z`$v&Ipon%(&2Bw}eRLHReK2WgV@AFjoMYGXTYCViL^!vlegBsO9JOb%Ut+imS`M-* zIiivt;!bCfA@o@h9QE4kuYV_e5Z`YbgHAj% zJ}FfHx{9852a@4D9enx2{v`nPFC#|95W_gc+XY4+jV6T=!E(gbep*^%iVsAG$ z!{qMnm8F7gpD)c!+lmrZ1wmVh4twPPI`;@Yng}pq?NW}zBY|XjolfK*hb6`L66v}d z9eW%0yvL_n-HS#8j5@+5ifD?zC_r7RdUUJ;;us+oNfQp0lQyOHejWd(wPgbq0Z*!SNgpYXiLl9njBU zWvDv?*a>CC;R*NLj3^$#vOod~8423WahUNeZAOq7hkQywj~)bc1XX8eHa`X>#1Z}x zEzr=DAZNJvFUM_=ML+)pU({;BqjTn>b<7Xm+&Yj2njJxp8?@4g?%_aT8Q2{+XR6hq zI}?CTz^aZQRn@`i72&x^rMysm%U_h0G`ZT@Wf{yvtWmkT&t&%JIqr0{`-SpHtMxRnx}3xbqE7tO7A7A^o_w`0%q1*cja3$*Z@GpLmN(@+e8z# z%NG6hm)fFmtm(sMR=J=J^c2H{XrypZ;y83DoJXQ9m5Bw2OZ$;b% z$S5?Pq=;xpwz4XFRg#vKl@Vo2M%~8u^`_79JwC_p`2F|$nTE>Ek_gtGh9R<2^|lyy)2^LXBi> zbu`?dQWpn-baWM-KAq|OhGSXUHxNo@=dj^#oBwk882cvyZI|%+56^zT=yB_l+g z!$1vm;FsUGWpqQcU>Di;OxH-kUTf`dWtz@0d_Y&m!nV}cqq*MZucRK|u;ba8y-t&Z zkNB@jrB>dE))lMl44wxqj5CgWgBJW!;=$8$A}`Q-O*duv-%?g^^tHLweO~u0M~{Vs z>87-!cfj0%TgP#|xOj(btwBA45V@Is8rtPx2mW$b1Y-##YhT3}3tjtPN;gj;UjRnS zsyCfDS;dzJnj^mRn{6QL9w_54XV=cA8RK8@d~`x@ZZq*mj0vYXoQN|=-_hPPPW*bY zXWID5hnBdK^EaxZj}PxcStHX`kQ$5YEDSA8@G%H45UOZx0!K3b7%Hbmsy6p;sk z9WLcQ37Ev_om0y0RpYMvnjI#c;w_KSZZ}jNFX{>bSrr^iW%gwiT*)tBswJFf-7rul z+Ki*j@8?WozKAl|$;+f1^T$R*<4X~4v(AhT7;Eifxq7CVKJVZCHfyILXhqWIQ^n|h zBAQP=Q|LBMRA`h~^K--eRi#5>6h$>2W%>!SI@j}^bCOVX{KrKY=O7aU55PWaJo`ug zL5+>tFkvf*3yD&XQ-xCd5^24t9t}hdmGW zMEyXYWdmfM>M>!B47(4%7Mp+m5d%b)E_BwV#;!|Xz~t~U4U&0iyrx3<)rrBoi9sBR zzQJM7v{?chU*3aabD{IT0#$)EjF6e`N~awBk5zfYv5Ho#L@^1<69R{z(I)&mv;nPs zQ3x5`jbe*81ON0c{6ajQ@u9{c=mtPI@9OO9XpQ+Tnj#PrZ4pdDo7$G>l-}T-vA50t z^4a6PfUuCW0byi$L?nVV0jm<7)o4B*DFTK-Ah%sQJUq)p)k7*$*fUbn^OTYF%9DF1 z$RwKXhw&5EMY^b7`JneK3=|;fFN}&WY^r`T*+BJ5jQLdaTYFTX;(La+)t!b^hKe-Z z)|2o4MdM;VzX*{lQVZ4)e;x}lfD%xY`=rvFB(TgF{UqKSa85Wnnxai|%gy#Smx?7HOH2*qwk#%#S*0wvz-_QM ze9bl!LWSCi3ZLgW#^b~thHpn)O?DEW^p_d%BaKIgUbpox_0sRyUTqy->Z-S))D=dZ z5SkMD4XXIRjjFNV9BqEbNRm3mt?S+5Ow^sUmVYM))GF$}H9$?Al0q-w!CZT`&9L2v zX<&Ti@{^{!Fa%Loo2R8=C5PqKSWaZ6hNSzj`@^sil}iN;J86h)ARP%+&Z?{KIb#`D z(&hqOnuu5t3LM=}%$U@wk#93LZZYc@>H-%D(M1+2wG(0>0@Ws1LDTi&-=Jxl$i9a+ zEKxO1IS3!<0x+`@;so5*MB7aD#M&KK?O&#ULh|-vG@^u~7@eHGyl%OxX}oJW;H8(T zeWl(hc+ll*k*5e*G4YcF{HG_0Nnk(iOu_@UL0x;l*J4f$qX}A?)=5C*S$N<$*I&`U z;!+H=7zE`)&Qg(wROrTnVB1q}`{mfk4CnEwmey9F2^XP?CCC|i5q%?; z0kmj@N0B`$U29Vac`OMX;^OJLR#5EEELtM^=r}F`xf>DTdLc;d0tlLIziD$<@Td`m zW9Rf!h(}4;LjQywja+kdtYdeibTnItLye+iKV4F-`|7S9vrJLP3Nv&I>1BEse zj7`6nF*ALfg~1Tf(;`N z#pRAjBf>4idEc@jOmdE{$Go%Gj}{a44b&|J^X$Epsl(=X8~OVbtuA6by8xs%GbqUz0^^T%JU)h4Uy8DBf7$bu}s1Cw-aOFCdpev6d=tVv>+5}v2=!a|%0yp(v zjyK3-1#!+b6jJhu+YZMIa#SLj$BzHXRU@cGL~*b0HZZ$_3y81FwU2ICUN9Sy6f2*6 zA9Dc>^Z}??02kO_-u)6Bt(9r1PfDA|*i1fAmB%IwO zuP=ruzT@7cURT?lt#;a8>A^nBF)b{jpz}UIJHDlRu2%^hZ0HqrX3pIKFhFWx42W)@ z<|Cx7nn5Y|)yP>xQ^zr*{on3A3PTcZ*2Z&0C5GhDCBE5q8y$}!vp4DKi`{1Ft;G32 zGPD3+bk;1xONR?t>RUDx>9@2~j*iI^psuLtXPIUmQ1(~ovjc)R&&xn~Z% zPmAH2hbaOGgdwzI#NGR#;n>BT86Cj;7fa4ELwP`l>W&_P5NYVD3~${-1bRiehu?%W zy0|3{zGLo$?rrTf#LFiSH=aZsh9p0E2fVqzr~55Pau*rdD7^ZlFF|1l??72xc27Wj zHf_N-gfk6lG*X6P;nxpknudTX3|KIXG>C@A;3Q;j3gC+BF|fq#OvW$d)t28mw7$}Q z4s;Xgy70HfN;u7g7~O8Z83`(*t-_Iws~)Oc6e%y3%8|RTJ)1p*N1lYU0KbxN9`f*g zRySHQclY(SZlklH>}70l0*V(KQd?)iuRk8HU4rPSc2A4DSqq{30|w|!Z=}F z5Tsr-S9CMM@KUsHr7a>uZh~|YpA{D=1Bjf7XATmN2Y|bycQ-o<+kuUl`!hVZ)@c!~ zsn=q!&oVL5M4gMkMIS!;Di%ww8kD~O2xa8z1)@5lhalKe%H=CG%hnfv+VUr1{3QbQZE^66L_`8d~?uO%jq zc?KJpiQQw^dO!Z~^xC%v%@cloJg|tA_uorT)j?cUVXKcnCDmzp9Aa5_VsIw%W?c`a zg{Yj6RCwA}&d#!Qx~Zjx{I7BU<#h5$Eb9OK1QyTDrFVNVx+*tE?ttC^p(8%M49(4k zc~)!fOsfF~y8C5PYn;VP-S7xch&%2;++7G`id0-R&R(a(5t|gXcck~CF}>QIX?A{? z2qKUY+H3I~F&Q6y9mN6!n_wqXIxctn-7juuJeMTTk4MPL0wZ+}Egv=E)zsU5dAZG@ zI`8IGQTF@33W*EmEwD8k^#lpDC#%x4q*fEtG9p1+`$o~u6D205a43E&lJ273!68;R z^jfUgyOk}CRduR_1#)sVA9Z1LoFM3n%hc)o{4AvZNN$vP<`u3AsVL`YoW&pFdk$lhhnZ)tseSI$y$WW$%MK>0PHA0{cw;XS;$TIEX|2bDy` zijl0g%wxot+!+51T*TJ(<#?jq`GAPHZH&nH_)&313aZegB7OwO8~jRSp+gucBYIAt zV{cwoReXGkLIlo{)O744(A?qf<=IMK+#=P7K^;ToS#*TE&_yC}M-alWF>L>9zXDBdf1ywrV|ZfqDi z875&pZ@@$WZeJ%V$44@B(9~bXeu|tIaY}PZH9rJ8#7-gkXQuK`@3UU2_(a$rq7|1_ zD1KZYsOPxKE0i`d#iYCp*yQwR!KA%|Kct#kheWOhzg~+YpHz86O|Kb@mYzD2wogDkr^C{3vEW}uDiB7;yt6sPVs?eca>lHV{wb}K1=ndkm2L{=a*2n z_qOWY`DNoh*{V8%oK?dz--a~LuS2#pl{P>;sonEBiW$MSIkH7&5(mZj*88(ZQ(AOM=HMm2I z`1{=BFC6q%k*hcpa19q_HVs0Q&!2@=5>ZV}H{aH(7#-8)b*(&|39%5TVvo+0XXFk9!(&GJ1TKMI@`5?W*# z{d-Z*X<0N5B*&Yc^D%c?$M2TPib^8tMWNq2yN?j{(1321y)45hmh}K}7nE3yj3|zO zYlEV`UouH$tX&YdkDJDnd{klIuCQ>V-m0@%SXq+mMK5#sQh{OK9Wc&hJqL)6=e`r$ zadzXZWCIA0Bme4ysr~R{Okx}5BYeF2Bc~L-6fEh9k5gEMA5qu#d6V047=`GhA&ir# z!3eAe5m0#U1b@~>w`~Uz@C1+sy14}O`p_H%tH&RWm;O&niuGL?4{>o^xoyg({b|e5 zUmu=0MDpE|T75E0cGC7xqHkJ{*ABWw>NkUn)!KLwABa-13*&X)v2LaSnVCq5 zJO7UJyq8LjB>``SB8Ceh@IxmObc$uH3jWlz+p`&YX>B~4xGE%re>8v0fU^9oZm$n- zF_|i$NrJiHbkTE9JM>xfQj;2{X+A&`Zr+w+W2I)#dc@T!C*pzJvn1>m9H20z%_|qL zEQkbe=bf02{zA7(>x~Q@Ntz@~^}1du!Xn{uK5*3hG7K1?v~lgNY0T*+D{gtc zi9|QO(DYea&?Yr7$!WMYqZ@X5+ZyKTkyNwMye~mkY8mUJ%uFVRUCOf?|Mq_$$J>FE z8H!0e^AE3PHiOA5g(TR(bp;9A<_riTHxq#&NsTZF%LdXO=lAh4!aOK{$o=U#c{6zL z@*z{5gb^6U>};GxNHug{z>^7JL{8%8-E#j%)WW)(A3yPlv-C(A%PY|pfHa()HKK#`_uSJBv|9(E5 ze0$KNe?~>ZNc_`dV1h3}1QlF=9<#Z%DES#peio%pE0~sNoX%L|pj+z1^^|VU!qT46 zDPSHjpc+g&1PoWSP44SDY4gd1z}0B`5iv+Y_^6&oHv_B>y@|eI_kJUyUxIP#Wqy0J z-?Sxgkr+BpqOKre<-`-{=EZDnpEfgP3Ni*y+z8)K>=+cp}(=m>w4ht zB3QAR!z-b-WX^70&fz_iCk4v3CL1pQ8ymu?PuOVu8XWI@P;sOT-6O4UUfZVZql^EuIzY%@A(T)NkDP1Z#Ax2XSaEk zN8E3H)j*)O@97mb+U-ZHffT7D(U&M#{Kjk1+uUQWR_cmCeqXpPt=Y1 z4J`r5wuA3+%)Lm$^FeD7M?9VGRBX`KPAm-|ga;%Bm`qb<88B65HK|e}Y4TeJ|AR5Y z)$>tJ{tvX|;XUgR^VVr?Lq#=Q;~Ekq?UDAU((L;vYM?JOo+?{K081hk>;}4Onm$IA zPS?{Jx0qrWq5L*hyb>>>etMky#|bAOd!S&Dq)c^KjnPq{p;FkQAkrMUX1nCd13z{4`UeIyRP~y-ycp*r`Jk9U@W@?#tFLX(HVrW` zG0PyZv!!Aq<;)ep7e)u35)I20o#lj!M7+KA!A}rWHG;Dtslu4VKn?(t*^RBOq71T1P9OLPP{0eF~0Q38lh z6u-0z3?6~mHyHw?fa7cx7Y|8RA@n*1eh!osaGmDSW2FnEe93(UEWMJI!lxu$sInRA zNwl3v33MBd20zp+o3%109W|MDw5AMWNxGKWq9GDATz!VLDyw?UuL5!nu6u)`O0uaa z_wyr*)%u%pCtJ&@e0$$g3UPI^W;ON(1O%xGPUtbA$d=zUL?+$nV^cJafC)b=(7eCK z4BWgPihCXB+8uBu(0$XKvz3NzSvCk)IQJ-jj?9PKMg5@$wM>Fiip`ZWbyV&^DVxGVhUnMeF&FY|n^>Kmi{vu$HJ zw|IcoMb99-d28#L)+5}C|fE?i(+kW6Dm~&zaNqeC%55Njpl!RXX^>7 zIM~Zr;tKP4>O&>sjRdtME#}oMqwmT8!DBDu$rI{V&307oS4{XoQV^xO>Xc0NiVH&BV+}WL|qKVnm+1XQMZ2O>OQ5d ztoy<&S71%hnF6Gggd2N&Ht4N)0JiRIp8wgF)+l|SdFt6~Wk|uen43aC5xeD4_-?nf1WQyI2{eqxmQBcGXj=d>b09iL4L$c&0I_{ zQTMCkL`IA=Kgt48$e?y%(lgg?QcMxdB~aZ2H0tY6xu5x*EK!d?`{w!yD1wh0izxwX zxb!~oGmIKT^(#&nrhJ#5U^=v-n~*qn=&hTcwJ7)+oI6}pu~O_4aq_Z%E4-CH#uO?h z!Z`bFCc!HEm^?%?ytdV`-{ZMY6%=+Ryb`Sa$=Y*K@{k1Q?YnGGJ&NwQt`Z&QKN%r) z{R%L(zsjonfDYBJ=-MFjbw}NaZM`lDZ|r2pWnz}};yJug-CEJ69Upwa4>thW6a?mE zgXH$DKfFvQT5@vz)bGP; zna@g=wbSOERSj4aI2QGic8~Mm(YSyHEK|DMyuzr~s_^lQvqsz@gtY+JC!vTiZ=s|6 z-p-{jEYxra>K{l)+~%&F-^PhVlGmFzTqJ2OPuTT9e8oiXNkEYR$AlM}q>9Mdt>ny& zolDJUasjstS;~O<6ee}D7VcdCyMp4))=Mqa_ZhjY$U79$co38UN#`aqO&hgLf-h%= zq9hTsmHe>P_WyDn1x1MnfWUeofw$o>k6!fXQ_NMB1QY9V4`|Y&CKgQs_%bXalKD)| zP2!WSa|qful`}_=!$^_AtnV_hZ-KaL^p$4`%!^1*o4Z}-0x-)i2SjwahSvsi!V;BO z^^vs9{0j!>H(=3PVtbdgVfz-=?F_h|5xz)BcW8KU00J_ivy@bM5^8*U^6s~HNKfQ{ zE>^xDnv*?1x|3h5^!NO82h+~&;qAiCVz|Mqi1W(M0j<_`i>Uz3Dms^lGth04?iAWe zP;nPvtGbL$O9UoDN*ng1sPjALAPgK>k?8+*7(rP~$PfUAStc*f;rXK8aXjdXHMxS$ z4tEDVyj4HWxtrt#KCD7AWz;GAuQx8@0|47fIzo~)3Vn*F<}HIQJ!f(E<>m!^`T2>( z$?)h$$1Uo1?;cS854Qio3nfGjc9BR=9yU7s0Qk@vgDVC3dAH=O?pavbcP|LyNUXbW zfu|B)vN1;q+a~$k)6bDIePhZ;71oo-M{@=X%NP;JN9zk`Try}#e3 zv%wACft(UxECj-V9FG}Y7IeR>Z^y9C%_bDh@nlX9MfC7iK~^MIrXeW=T`?IXa6UFh zPV>sR4dN;}e!DbzrF^W^DAj#v*}3y&Q5;sQ>uF*_y;a*wy7%LTeE!_LB1jG6OK z1e>m|LAKDJL9bSxpx0xqQQu7Z37qpQZ3|Ds?nA^O!drDxrfg4x=}h)~4P7H?J<%Hw zMXmOk7gH?)D~HwbAxHbX`t`}pX@wQ(pFaFh{TDCuFlqJ^0mDirk4=0HQR#Gil##K!VG(jm`XY#ZRu0v=ho$^PS@R2m_ zE4R>YI#Wl@JLc};vcs2OYR)9Y^%xDIbjL>0w*v=5I_Qo$=FQ8GylHI%PK}hG(uObbJtk_;=y@ts5A0sLC*bhTn<^m+S=7*q`*%k@>QJ2;zxg7 ztC75;Ww%heMwZW13A)I*TEY(x)cAPH)x%&8ITVH>}KB^K?bSGe=8XC}yb`tq~Evk}>!)TL9_1T)m_gOF+p)`RV{wak(IM#9RUnP z^lRG7Z$pRr5l12RXmI)G-~MbKk#I0+RWCbpEi!WGEcI4Pu;;+MicDq>>MZQuncEWf z4>&^Em|X6Pjuf+{+OGFj1evDZ1wIZ4Xv$JBUWm9LU^b{X7}n)8nY7YCSwd2T!CRP< zdUoVmMml)RlKDj&lJ!qBw?bEK)YZ|lZ1WHZ^URKKpuWlCkH!zt;DwBqJ}8=0jV#dL zQ4bozdPnJx4MN<0i1m8o1Irq5Wk-8n!^*3`deel=V~!rY#_UX^t3H+^4l38g_#0$L zoo1#bIvY&~3*Br!DJHigXvN7Wtsu4wA#@cDsh>M~Y8-(^@uB8OPMq7c`p|VKprrE$ zoBQW;po&4759<9in%>_%seIo+KAnS2T?c_(gjN7pyL3=`eB!Rk4|yP>!cR9IG;OfV zjw?hQmVYN3ZCHSl+j^_(aTF)&N3N7GYnZZFiAes&Lyy0aT8V5}O~}a#U-*^{y=uR3 zwJyd|h$`b|>wVier6D^yz%j>8B($Ll##l*N-REA=q4#LEDo(d}|9taZ-_tX%J1jeGHcKqGmLtmlNq7jSx7aLE`0XWK(`mleKI%Grn zOb8^)ySl$A>bcwN;mz+pDr0Sp(@!-)!S`6``TK?@To#B%AW^zt&iLyNUKR#=o*6|= zrW*OoRE8ZW$i4QONoN!EVzlo8zJ@~FDx8%GTKo0}vj}+bAdzmWbv8Ex$&>Su`OY3# zsC3AsKe$bOZ}4aL!2kj%nmKVxrSmPPzHHlvBGMC%LK-S$h|0|;L?`3goB zmPG*WNU{Ezz4e7%1_K=ydRGJ#IclB+@lIqEQe3m}Jz&?xc9Hn+fAEU7`Q3!xD*#OH z63aAQUM%c_@{F{QdEHm*xQqPrr4=Dp06*RMLYM>X9TED&_X=Z$SX%q$!{;XuS0L7e zrj;ZV;BBDdb7FykLCl^VIOT-H{jeYllsSF?S(P(~jxVANRF0n7*JOEX{U1N{KHNKpW^2r`6Uj7tPn*g@T_xT8p3wb;TseraCl z7i{()%FJr6?__EOMf@zO`xUUUx?h@T1&M4L#S$+%6lhdMFHrRgje|sx(hD|E;&eC-uss&?hNI?aOc?~;$--xEfpeDYkIxlch^ylF_C!Xo!{Edy}Po89-pleBb zp=_j!t?dM+Ur<}XAiuBic95FYOOE+G_3irK#=?PjP4KXi%s_nZ}Zx{Hi z5cL(}7KkA`&B@pQ7hYSUrTHKCt{b3rY_MGfBI?Fq^Qi%+zFI8}c9=GZ;-<+Jh%Q zDuVk{f6%kRo#_HYF&!6FlvuTb5SNLsmG5Ap6lnJn077mU5d^n*1)nK#KzfV+lgFGK z-$oI?DSU`PvLTJIdlrWU5g3@i^kpu1v@TA0VLFFQLLJdVkmronx2Z!EwU`1EGkWl? zAw<=PNnG*|H5v6G@VS95+^g7neVU_xXPhf=X>wGn)Gw^b%8KYl&K$eIBnmlMCbovv z;aPfN+|fh@*jx`w>s8M@8ve@oD5!L3bPP2Luf6jm`McPMBZ$WW2S58Xmzsvpf|J?j|j!lO(1fmB3`j8%A0@}X)`#qe$(30>z0j5G8 zXN4p-EO}A`#z1|8r$xRj9exMI+;Zk3n{XSnR}=*hgg9o1c+h(bMc^@BMLUSXL#D`T z)sw{T30h+jMX+5iZgFimR! zvW2*eqzB?+{`X&G(~O?Dsu$Wh!qA}TUkHAVJW^zCs$sKPW z5c9z6?>*WzsFd@khn~4(+jQj#8rCtC4?>v_Rm5hMTr7LdbT@&yguT1IR%O_IPI>O{ z?Wr*&(^vQ9BNG5VRdu`=%AY8CSmR!TvrNr73a2@K&FXI6A$JQfUntL1ab)|nV=})D zCTI^u-z8Mz@@h_4pOvbZi27+G{1l}cDPFo7^z&vXd>$Zs$!ZN8$AE0GROqYI#`12= zcVkhXyc#E;W|4g6`}h&)57uY~>wT=Vqw;8cdfa;0AGvd{_~Ppd8Ags@vJQwx@RQVPf%D3y0zP8m&T`s%!2M>oN7)OzMO`VuB{rbRbeuC z_f~LyDdtAe@jYwjPseWF-T3^8zIfsyD5%cS_3SA(OrfxZQgRf#l&~A-fNn6%ibR$T zj8r(h%sEevbvysO@j^q7Tu-t@2)_lZfJ9Zy4UTSo*ue7qD7;E9LDxQo^YqS#TA&$x zBqmR!;ZV|IYWmN>_GtTC{7ghz+%$nm)4x7*7cMK&*Q?)EUM)P_BqoH=f9Q{eocH6i z#;=vHyK@OlJ;zObtmvD{yGBh&a2_}IY>I``>V!a~@;hkxe+GEh<3Ast1OZWu_MWa~ z<6-0`+{b=VEld0|-q&AO6uFN|=~eb9WRt6qjzVQ`d3wRv|mU=Ft7L3KB82XTvySGIJMgVM*310AmB35n*#60M$ zPzOV8`zJUsXpC`}pgyzzGCoqSav2&}k|Tg6%b08f)ucHPloVXhNVKWNlhy0$%mOf^ zE(Fvq0kQrOh>oCO|76+#LBza@>HmUWI@irpDA!JY8r?<@#wuA%qDRqJ!OX|rU zD%kws3WdXV*coZ`r6 zD+8B+B=)s2f+p36?(m&v89Ju5sP$Nu;QH*crW{pq|KpE8^L(2v6ZqwEP2I*y9QQWl z^*6xaVc}_KL-ZUA)LAP%`OYM~30OG$HDtvRanOlPQbGUMZAyZd2L#1}ut#-4gIn`^ zW_qNM(FunJkO!924vGtFWGXW_FI$h7sM)x!r)>e*9)g zDigNGGFV}dM*DpWnd;=YQtK5L`vbm%d;M&aq2au+*XoObYRGG+M{udTF4LI#)W4#W zyDV*Jjy5-|io}sccq6Ai!4{A)6L_S8`3VSSsA~}Fu+vkM1IIMkr3fud2qF|DZ!beC z;ws!bI3U;sq5+|xx7Xt12IBxZZNpm8yOs+X3*2XU?&wx_e2`5-hjF)DoZS*1KQiNL zpH{h$h-0jqY{^)QQvmT(1j&k)wcVx{fLN#Ks!D5RtSZ2A0Kw7YR^rZ!;f@!}BoF$$ zZf;O4cVRnR7cK=E_d#vL0=ot+9&SL2B8zq)15s2eB5l4PmWEFK#cT_r0TM$FiZJ2? zB7_>-%_fWY?jZ1Qoa%pD4I5|Sq*I|yGn46oTD3N_c&H*15|VrOENn0>Q3R@lPML)= zBFS#Pq@P3(J}4Uh{NvpIQzjkHz>wyA4MGBV|H-&3qwtOH1T`sjns_+Gs>^Tdh+HSO zAlVQ(GxIA+*r&4waX)Q}};Gcl^=``n!k2Z8lrEv>ORWZ5T2LnJQYx5V#6SBw+Fk5GkxL zC|}rd_5e!+hkDsB?_w@86)QnM4nMmido`G4^hr3ZLPGwYflG^*o87|s7`gl#aUWrH z_g5;2reAyN^#Rb)|I`KGyy+-xVh@?m@Fi6KC{Y;TPk_KPqwU1(LnCqt|Lqr6vsL5H ze3fUzOcC2~w1&yqZ|+s)u>)410@(TrZbf0Ru%KLzsZ)i`;e$@wDKfyVo0#GRcZVMV5gzIg2^j$rM3KPnOr9~s z1mHz4$I%YNlNG8zYTe2R{xsa5@Z%B1D+~bTwLD03AoF#U7xoGUKk>u;&Ti@KG5H{Q2@YV4jWs>2i+At9r-3>Uf~n%JLk*z8i{y)O3hD_V4gbTd%r%gQ8z2CZx^O zuBRbb#A#o%idYra@8O1GM!uug8RT(r_{np7Roegfc-BjGQ1k&mQ**3&Jn>KPoE3g~VY0?q4bRnymk@wq(jadcU6rVEBz1OZI?;MjOYX063|{m8 zM>R`y9 zDZ~a|Y}cSqV(e$Ygt*RW{Ig;0_>q`-mqrW=dDjC?2KtMnSk{tI6NL2Ofg-ttc&N}W zjLOkp2iJVj6v4R7JD?r2MpO~j-tP9cGaoS{2Hib|PIx_tZiE;eHAuIUg^Wm~r2qC^zSv{?k1~ac z@T-J_DAYU3O)xML`WA0#p7@X1g_#e=3!-BVo0=j!Afnz0)NBub))(q~(<+{Od?7#b zBJO?+y5CUFSK(vEG2!nyb1Ys+e*U8tfLHf!H-?7$$jHIWG)P;V1w+F;YY0F3qxSrQ z2_{>tllvzH(*TbJqBFTy0ZA>W5uL>CjlnMRD(NhoA!`WXC2M9dF%bhO@s41l0uSZFaU7V7Zvz|Wc`w>C6i3o0 z!4!nOQenvWC`E$-?&)~$p6wV`;fGw7?K(F%F*KCjr?~RlRN{RA;M`AV@42#5DdzbJ@?IL{^@+J((oB{2+T~1s z+51$0VMnfw*N$gC(d!tftaTUT!_T>iN4yXJp3Q#WvDa0ZgU*}2)3H=`BwXw|>$9OU-sR3}86cUAVv=B`%ovBO__ely;-c4O#TE8q31MY}WH z&shxcwQ{k}Eg221;=h;M4AK8Xk&ARsnv`B(JJ4yr!<%jyHMH}jzuLyz-!Q>wP2IN& zwxk{>O?#+$<`OYv?5jrYNZ!!I`H10y>*5riz4F|DnRVrOW zYUksLfi_WZI{$%SOMl(*$%%*jbd+U@+#`Pc7K$@;83RSF;}KdzQT}##9~6}(c#)2x zUSIzI!~ckSC|3Rbi!il6Xn=+4vCcB%EP3d9YT)ee)Sr6F43ul-EM+OVGK??$amAJ4 zhzDI&hicU>&!!#jeErczdZhgEmj{%KrQfyC8M^VB*>$)2W>1+EL)5fdI)Gv*;Efv`F^V9b)F4sdoJ*plZS7@)uN!5SEza&bS zc4_qh%M-ter5nwPR70=hD~zYU%5hI+*SB<=(X&TRiXZ)JDJ%EK-KwW5e~ha$)x9lZ zVj^d1;B&-u+Ah9lsz!S!mddWAT?#zcHJj&n=FFK*onI#(xckm(4ycYGMbOT}`>5U8 zMqU-P`UZQ)W2aAe{=a`i_U|S3_y$T#Q%@sJ&GO>^0Wg46P5=M^ literal 0 HcmV?d00001 diff --git a/topics/attribute-sharing.md b/topics/attribute-sharing.md index 0e62e64..1f459c0 100644 --- a/topics/attribute-sharing.md +++ b/topics/attribute-sharing.md @@ -8,11 +8,11 @@ For identity providers such as the Internet Identity, the principal under which In order to solve this problem, there are a few parameters that need to be specified in the architecture. * Who can issue credentials - - **Trusted identity providers**: In some architectures such as Concordium's blockchain [[Concordium](https://concordium.com/ "The Cordordium blockchain")], trusted identity providers are responsible for issuing and managing attributes to users. - - **Any entity or user**: In other cases, such as in the W3C's verifiable credential standard [[VC-DATA-MODEL](https://www.w3.org/TR/vc-data-model/ "Verifiable Credentials Data Model v1.1")], any entity is allowed to be an issuer. In this case, it is up to relying party dapps to decide which issuers they are willing to trust during the verification process. + - **Trusted identity providers**: In some architectures such as Concordium's blockchain [[Concordium][Concordium]], trusted identity providers are responsible for issuing and managing attributes to users. + - **Any entity or user**: In other cases, such as in the W3C's verifiable credential standard [[VC-DATA-MODEL][VC]], any entity is allowed to be an issuer. In this case, it is up to relying party dapps to decide which issuers they are willing to trust during the verification process. * Who decides which issuers to trust - - **Off-chain**: In some architectures, such as Concordium's blockchain [[Concordium](https://concordium.com/ "The Cordordium blockchain")], there is a particular entity such as the Foundation who is responsible for managing the registration of identity providers - - **RP - relying party**: In the W3C's verifiable credential standard [[VC-DATA-MODEL](https://www.w3.org/TR/vc-data-model/ "Verifiable Credentials Data Model v1.1")], the relying party is the one that decides which issuers can be trusted. + - **Off-chain**: In some architectures, such as Concordium's blockchain [[Concordium][Concordium]], there is a particular entity such as the Foundation who is responsible for managing the registration of identity providers + - **RP - relying party**: In the W3C's verifiable credential standard [[VC-DATA-MODEL][VC]], the relying party is the one that decides which issuers can be trusted. - **NNS / SNS**: Another possibility is for Decentralized Autonomous Organizations (DAOs), such as the NNS or an SNS, to decide which issuers to trust. * Who pays for the service - **Self-sovereign identity**: In this setting, the owner of identity would be responsible for paying for the service being provided by the issuer. This option potentially provides better privacy since the issuer in principle would not be aware of which relying party is verifying the user attributes. @@ -47,7 +47,7 @@ In order to provide attribute support in a privacy-preserving manner, our propos Let PIssuer and PRP be the identities under which a user is known to the issuing and relying party dapp canisters. In order to securely link these principals, our proposal is to let the identity provider create a joint identifier PNew to be shared between these dapps and to provide separate signatures securely linking PNew to PIssuer and PRP respectively. ![Joint user principals shared between issuer and relying party dapps](../diagrams/user-principals-private.png) -In order to preserve user privacy, the value of PNew needs to be unpredictable. One way of achieving this is to choose a random new value for every session in which the relying party dapp needs to obtain attributes from an issuing dapp. However, for simplicity and efficiency reasons, we recommend to set the value of PNew as a (pseudorandom) deterministic functions (PRFs) [[PRF](https://en.wikipedia.org/wiki/Pseudorandom_function_family "Pseudorandom function families")] of the user anchors and the frontend origins at the issuing and relying party dapps. +In order to preserve user privacy, the value of PNew needs to be unpredictable. One way of achieving this is to choose a random new value for every session in which the relying party dapp needs to obtain attributes from an issuing dapp. However, for simplicity and efficiency reasons, we recommend to set the value of PNew as a deterministic pseudorandom function [[PRF][PRF]] of the user anchors and the frontend origins at the issuing and relying party dapps. ## Proposal focused on self-sovereign identities @@ -55,10 +55,10 @@ Following the intuition above, we now propose a specific flow focused on self-so This proposal has the following features: * It provides user privacy via the establishment of a new joint identifier computed as a function of the issuer and the relying party frontend origins and the identities under which the user is known to these dapps. This is represented by steps (7) and (8). -* It allows relying parties and identity providers to agree on the user attributes that need to be included in the user credential via a presentation exchange. This protocol exchange can be based on the Presentation Exchange Specification [[DIF-Presentation-Exchange](https://identity.foundation/presentation-exchange/ "DIF Presentation Exchange")] by the Decentralized Identity Foundation (DIF). This is represented by steps (3) and (12). -* It allows issuers to specify the inputs that are required from a subject to process a request for credential issuance via the use of credential manifests [[DIF-Credential-Manifests](https://identity.foundation/credential-manifest/ "DIF Credential Manifest")]. This is represented by steps (4) and (5). +* It allows relying parties and identity providers to agree on the user attributes that need to be included in the user credential via a presentation exchange. This protocol exchange can be based on the Presentation Exchange Specification [[DIF-Presentation-Exchange][DIF-PE]] by the Decentralized Identity Foundation (DIF). This is represented by steps (3) and (12). +* It allows issuers to specify the inputs that are required from a subject to process a request for credential issuance via the use of credential manifests [[DIF-Credential-Manifests][DIF-CM]]. This is represented by steps (4) and (5). * Identity providers can use the credential manifest information to submit the credential application for the user. This is represented by step (11). -* If the issuer accepted the credential application by the user, it issues a credential using the new joint identifier for the user, as indicated in step (14). The credential format can be based on the verifiable credentials data model [[VC-DATA-MODEL](https://www.w3.org/TR/vc-data-model/ "Verifiable Credentials Data Model v1.1")]. +* If the issuer accepted the credential application by the user, it issues a credential using the new joint identifier for the user, as indicated in step (14). The credential format can be based on the verifiable credentials data model [[VC-DATA-MODEL][VC]]. * It allows users to use different anchors with respect to the issuer and relying party dapps, as indicated in step (7). ## Flow description @@ -68,12 +68,12 @@ This proposal has the following features: * RP frontend checks whether user attributes have been verified * Generate key pair (RPSK,RPPK) 2. RP frontend opens the Identity Provider (IdP) frontend on a separate window, sending: - * Presentation request (see [[DIF-Presentation-Exchange](https://identity.foundation/presentation-exchange/ "DIF Presentation Exchange")]) + * Presentation request (see [[DIF-Presentation-Exchange][DIF-PE]]) * RPPK * Issuing dapp * RP dapp 3. IdP frontend requests credential manifest from the issuer backend - * Data format can be based on DIF's credential manifest [[DIF-Credential-Manifest](https://identity.foundation/credential-manifest/ "DIF Credential Manifests")] + * Data format can be based on DIF's credential manifest [[DIF-Credential-Manifests][DIF-CM]] * This step may not be needed if the IdP has previously obtained the manifest. 4. Issuer backend replies with the credential manifest * This step may not be needed if the IdP has previously obtained the manifest. @@ -89,13 +89,13 @@ This proposal has the following features: * A signed pair (PNew, PIssuer)🔒 * A signed pair (PNew, PRP)🔒 * PNew = PRFseed(anchorRP,anchorIssuer,RPorig,ISorig) - * where PRFseed is a pseudorandom function with secret key __seed__ [[PRF](https://en.wikipedia.org/wiki/Pseudorandom_function_family "Pseudorandom function families")] + * where PRFseed is a pseudorandom function [[PRF][PRF]] with secret key __seed__ 9. IdP frontend opens the issuer frontend on a separate window, requesting session key 10. Issuer frontend generates session key and sends it to the IdP frontend * Generate key pair (ISSK,ISPK) * Send (ISPK + request reference) 11. IdP frontend requests credential for PIssuer under PNew, including - * Credential application [[DIF-Credential-Manifests](https://identity.foundation/credential-manifest/ "DIF Credential Manifests")] + * Credential application [[DIF-Credential-Manifests][DIF-CM]] * A signed pair (PNew, PIssuer)🔒 * IdP2 delegation to PIssuer * Request reference @@ -113,7 +113,468 @@ This proposal has the following features: * Credential for PNew 16. RP frontend interacts with its backend to update the user status +## Message flow details + +In this section, , we give examples of the following flows used in the proposal for attribute support: +* Presentation request +* Credential manifest request +* Credential manifest +* Credential application +* Credential response +* Presentation submission + +These flows will take place between relying parties, the identity provider, and issuers. While the relying party will act as a verifier for the presentation, issuers will be responsible for generating the actual credentials that will be included in the presentation. + +![diagram of message flow among the issuer, identity provider, and relying party dapps](../diagrams/attribute-flow-details.png) + +Credential manifests are also used during the interaction between the identity provider and the issuer to specify the inputs that a user must provide for the evaluation and issuance of a credential. This includes, for instance, the different attributes and algorithms supported by the issuer and the issuance requirements. + +In the following, we describe these flows in more detail, using the examples and definitions given in the DIF presentation exchange [[DIF Presentation Exchange][DIF-PE]] and credential manifest [[DIF Credential Manifest][DIF-CM]] specifications. + +### Presentation request + +The main content of a presentation request is a presentation definition, which indicates what proofs a verifier requires. + +Presentation definitions can have three fields [[DIF Presentation Exchange][DIF-PE]]: +* `id` (mandatory): MUST be a string, which SHOULD provide a unique ID for the desired context. +* `input_descriptors` (mandatory): MUST be an array of Input Descriptor Objects. +* `format` (optional): MUST be an object with one or more properties matching the registered Claim Format Designations (e.g., `jwt`, `jwt_vc`, `jwt_vp`, etc.). This object MUST include a format-specific property (i.e., `alg`, `proof_type`) that expresses which algorithms the Verifier supports for the format. + +Example based on the [DIF Presentation Exchange][DIF-PE] specification: + +```json +{ + // NOTE: VP, OIDC, DIDComm, or CHAPI outer wrapper properties would be here. + "presentation_definition": { + "id": "32f54163-7166-48f1-93d8-ff217bdb0653", + "input_descriptors": [ + { + "id": "wa_driver_license", + "name": "Washington State Business License", + "purpose": "We can only allow licensed Washington State business representatives into the WA Business Conference", + "constraints": { + "fields": [ + { + "path": [ + "$.credentialSubject.dateOfBirth", + "$.credentialSubject.dob", + "$.vc.credentialSubject.dateOfBirth", + "$.vc.credentialSubject.dob" + ] + } + ] + } + } + ] + "format": { + "jwt": { + "alg": ["EdDSA", "ES256K", "ES384"] + }, + "jwt_vc": { + "alg": ["ES256K", "ES384"] + }, + "jwt_vp": { + "alg": ["EdDSA", "ES256K"] + }, + "ldp_vc": { + "proof_type": [ + "JsonWebSignature2020", + "Ed25519Signature2018", + "EcdsaSecp256k1Signature2019", + "RsaSignature2018" + ] + }, + "ldp_vp": { + "proof_type": ["Ed25519Signature2018"] + }, + "ldp": { + "proof_type": ["RsaSignature2018"] + } + } + } +} +``` + +### Presentation submission + +According to the DIF Presentation Exchange specification [DIF Presentation Exchange], Presentation Submissions are used to express how the inputs presented as proofs to a Verifier are provided in accordance with the requirements specified in a Presentation Definition. + +Embedded Presentation Submission objects MUST be located within a target data format as the value of a `presentation_submission` property. The current specification lists four possible Embed targets: Verifiable Presentation [[VC-DATA-MODEL][VC]], Open ID Connect [[OIDC][OIDC]], CHAPI [[CHAPI][CHAPI]] and DIDcomm [[DIDComm][DIDComm]]. These are data formats used in messaging protocols that may be used to transport a Presentation Submission. + +In the case of Verifiable Presentation [[VC-DATA-MODEL][VC]] and Open ID Connect [[OIDC][OIDC]], the `presentation_submission` object MUST be included at the top-level of the Embed Target. + +The presentation_submission object MUST have the following fields [[DIF Presentation Exchange][DIF-PE]]: +* `id` (mandatory): MUST be a unique identifier, such as a UUID. +* `definition_id` (mandatory): MUST be the id value of a valid Presentation Definition. +* `descriptor_map` (mandatory): MUST be an array of Input Descriptor Mapping Objects, composed as follows: + * `id`: MUST be a string that matches the id property of the Input Descriptor in the Presentation Definition to which this Presentation Submission is related. + * `format`: denotes the data format of the Claim; MUST be a string that matches one of the Claim Format Designation (e.g., `jwt`, `jwt_vc`, `jwt_vp`, etc.). + * `path`: MUST be a JSONPath string expression, indicating the Claim submitted in relation to the identified Input Descriptor. + +[Example](https://identity.foundation/presentation-exchange/#basic-presentation-submission-object-2) without the outer wrapper properties of the Embed Target [[DIF Presentation Exchange][DIF-PE]]: + +```json +{ + // NOTE: VP, OIDC, DIDComm, or CHAPI outer wrapper properties would be here. + + "presentation_submission": { + "id": "a30e3b91-fb77-4d22-95fa-871689c322e2", + "definition_id": "32f54163-7166-48f1-93d8-ff217bdb0653", + "descriptor_map": [ + { + "id": "banking_input_2", + "format": "jwt_vc", + "path": "$.verifiableCredential[0]" + }, + { + "id": "employment_input", + "format": "ldp_vc", + "path": "$.verifiableCredential[1]" + }, + { + "id": "citizenship_input_1", + "format": "ldp_vc", + "path": "$.verifiableCredential[2]" + } + ] + } +} +``` + +[Example](https://identity.foundation/presentation-exchange/#presentation-submission---verifiable-presentation-2) using verifiable presentations [[VC-DATA-MODEL][VC]]: + +```json +{ + "@context": [ + "https://www.w3.org/2018/credentials/v1", + "https://identity.foundation/presentation-exchange/submission/v1" + ], + "type": [ + "VerifiablePresentation", + "PresentationSubmission" + ], + "presentation_submission": { + "id": "a30e3b91-fb77-4d22-95fa-871689c322e2", + "definition_id": "32f54163-7166-48f1-93d8-ff217bdb0653", + "descriptor_map": [ + { + "id": "banking_input_2", + "format": "jwt_vc", + "path": "$.verifiableCredential[0]" + }, + { + "id": "employment_input", + "format": "ldp_vc", + "path": "$.verifiableCredential[1]" + }, + { + "id": "citizenship_input_1", + "format": "ldp_vc", + "path": "$.verifiableCredential[2]" + } + ] + }, + "verifiableCredential": [ + { + "comment": "IN REALWORLD VPs, THIS WILL BE A BIG UGLY OBJECT INSTEAD OF THE DECODED JWT PAYLOAD THAT FOLLOWS", + "vc": { + "@context": "https://www.w3.org/2018/credentials/v1", + "id": "https://eu.com/claims/DriversLicense", + "type": ["EUDriversLicense"], + "issuer": "did:example:123", + "issuanceDate": "2010-01-01T19:73:24Z", + "credentialSubject": { + "id": "did:example:ebfeb1f712ebc6f1c276e12ec21", + "accounts": [ + { + "id": "1234567890", + "route": "DE-9876543210" + }, + { + "id": "2457913570", + "route": "DE-0753197542" + } + ] + } + } + }, + { + "@context": "https://www.w3.org/2018/credentials/v1", + "id": "https://business-standards.org/schemas/employment-history.json", + "type": ["VerifiableCredential", "GenericEmploymentCredential"], + "issuer": "did:foo:123", + "issuanceDate": "2010-01-01T19:73:24Z", + "credentialSubject": { + "id": "did:example:ebfeb1f712ebc6f1c276e12ec21", + "active": true + }, + "proof": { + "type": "EcdsaSecp256k1VerificationKey2019", + "created": "2017-06-18T21:19:10Z", + "proofPurpose": "assertionMethod", + "verificationMethod": "https://example.edu/issuers/keys/1", + "jws": "..." + } + }, + { + "@context": "https://www.w3.org/2018/credentials/v1", + "id": "https://eu.com/claims/DriversLicense", + "type": ["EUDriversLicense"], + "issuer": "did:foo:123", + "issuanceDate": "2010-01-01T19:73:24Z", + "credentialSubject": { + "id": "did:example:ebfeb1f712ebc6f1c276e12ec21", + "license": { + "number": "34DGE352", + "dob": "07/13/80" + } + }, + "proof": { + "type": "RsaSignature2018", + "created": "2017-06-18T21:19:10Z", + "proofPurpose": "assertionMethod", + "verificationMethod": "https://example.edu/issuers/keys/1", + "jws": "..." + } + } + ], + "proof": { + "type": "RsaSignature2018", + "created": "2018-09-14T21:19:10Z", + "proofPurpose": "authentication", + "verificationMethod": "did:example:ebfeb1f712ebc6f1c276e12ec21#keys-1", + "challenge": "1f44d55f-f161-4938-a659-f8026467f126", + "domain": "4jt78h47fh47", + "jws": "..." + } +} +``` + +### Credential manifest request + +This is just a protocol message to request a credential manifest from an issuer. There is no specific format requirement. + +### Credential manifest + +As stated above, Credential Manifests are a common data format for describing the inputs a Subject must provide to an Issuer for subsequent evaluation and issuance of a credential. + +According to the specification [[DIF Credential Manifest][DIF-CM]], Credential Manifests are JSON objects composed as follows: +* `id` (mandatory): MUST be a string. The string SHOULD provide a unique ID for the desired context. +* `name` (optional): MUST be a string that acts as a summarizing title for the Manifest in question. +* `description` (optional): MUST be a string that explains what the Manifest in question is generally offering in exchange for meeting its requirements. +* `issuer` (mandatory): MUST be an object composed as follows: + * `id` (mandatory): MUST be a valid URI string that identifies the issuer. + * `name` (optional): MUST be a string that SHOULD reflect the human-readable name the Issuer wishes to be recognized by. + * `styles` (optional): MUST be an object or URI, as defined by the DIF Entity Styles specification. +* `output_descriptors` (mandatory): MUST be an array of Output Descriptor Objects. They are used to describe the Claims an Issuer is offering to a Holder. +* `format` (optional): MUST be the same structure as Presentation Definition’s format property. This property informs the Holder of the Claim format the Issuer can issue in. +* `presentation_definition` (optional): MUST be a Presentation Definition object, as defined by the Presentation Exchange specification. + +> `presentation_definition` is intended to be used in the case where the issuer requires a different credential from the user in order to issue a credential. + +[Example](https://identity.foundation/credential-manifest/#credential-manifest-format) of a credential manifest: + +```json +{ + "credential_manifest": { + "id": "WA-DL-CLASS-A", + "name": "Washington State Class A Driver's License Application", + "description": "This application is for the Washington State Class A Driver's License, which requires an applicant to be of at least 18 years of age and provide proof of CDL training completion.", + "output_descriptors": [], + "spec_version": "https://identity.foundation/credential-manifest/spec/v1.0.0/", + "issuer": { + "id": "did:example:123?linked-domains=3", + "name": "Washington State Government", + "styles": { + "thumbnail": { + "uri": "https://dol.wa.com/logo.png", + "alt": "Washington State Seal" + }, + "hero": { + "uri": "https://dol.wa.com/people-working.png", + "alt": "People working on serious things" + }, + "background": { + "color": "#ff0000" + }, + "text": { + "color": "#d4d400" + } + } + }, + "format": { + "jwt": { + "alg": ["EdDSA", "ES256K", "ES384"] + }, + "jwt_vc": { + "alg": ["ES256K", "ES384"] + }, + "jwt_vp": { + "alg": ["EdDSA", "ES256K"] + }, + "ldp_vc": { + "proof_type": [ + "JsonWebSignature2020", + "Ed25519Signature2018", + "EcdsaSecp256k1Signature2019", + "RsaSignature2018" + ] + }, + "ldp_vp": { + "proof_type": ["Ed25519Signature2018"] + }, + "ldp": { + "proof_type": ["RsaSignature2018"] + } + } + } +} +``` + +### Credential application + +According to the specification [[DIF Credential Manifest][DIF-CM]], Credential Applications are objects embedded within target claim negotiation formats that pass information from the Holder to the Issuer. + +Credential Applications are composed as follows: +* `id` (mandatory): MUST be a unique identifier, such as a UUID. +* `spec_version` (mandatory): MUST be a valid spec URI according to the rules set in the versioning section. +* `manifest_id` (mandatory): MUST be the id of a valid Credential Manifest. +* `format` (mandatory IF the related Credential Manifest specifies a `format` property): MUST be a subset of the format property in the Credential Manifest to which is related. This object informs the Issuer which formats the Holder wants to receive the Claims in. +* `presentation_submission` (mandatory IF the related Credential Manifest contains a `presentation_definition`): MUST be a valid Presentation Submission as defined in the Presentation Exchange specification. + +[Example](https://identity.foundation/credential-manifest/#credential-application---simple-example): +```json +{ + "id": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", + "spec_version": "https://identity.foundation/credential-manifest/spec/v1.0.0/", + "manifest_id": "WA-DL-CLASS-A", + "format": { + "ldp_vc": { + "proof_type": [ + "JsonWebSignature2020", + "EcdsaSecp256k1Signature2019" + ] + } + }, + "presentation_submission": { + "id": "a30e3b91-fb77-4d22-95fa-871689c322e2", + "definition_id": "32f54163-7166-48f1-93d8-ff217bdb0653", + "descriptor_map": [ + { + "id": "input_1", + "format": "jwt_vc", + "path": "$.verifiableCredential[0]" + }, + { + "id": "input_2", + "format": "ldp_vc", + "path": "$.verifiableCredential[1]" + }, + { + "id": "input_3", + "format": "ldp_vc", + "path": "$.verifiableCredential[2]" + } + ] + } +} +``` + +### Credential response + +Credential Responses encapsulate possible responses from a Credential Application, with two possible outcomes: fulfillment or denial. The outcome depends on whether a Credential Application is accepted or not. + +As per the specification [[DIF Credential Manifest][DIF-CM]], Embedded Credential Response objects MUST be located within target data format as the value of a `credential_response` property. + +As for credential applications, the `credential_response` property MUST be included at the top-level of an Embed Target in the case of verifiable presentations [[VC-DATA-MODEL][VC]] and OpenID Connect [[OIDC][OIDC]]. This property is composed as follows: + +* `id` (mandatory): MUST be a unique identifier, such as a UUID. +* `spec_version` (mandatory): MUST be a valid spec URI according to the rules set in the versioning section. +* `manifest_id` (mandatory): MUST be the `id` value of a valid Credential Manifest. +* `application_id` (optional): If present, MUST be the `id` value of a valid Credential Application. +* `fulfillment` or `denial` (one of them MUST be present): + * `fulfillment`: is composed as follows: + * `descriptor_map` (mandatory): MUST be an array of Output Descriptor Mapping Objects. + * `denial`: is composed as follows: + * `reason` (mandatory): MUST be a string which states why the Credential Application was not successful + * `input_descriptors` (mandatory IF the related Credential Application contains a `presentation_submission`): MUST be an array of `input_descriptor` string identifiers from the `descriptor_map` property of a Presentation Submission + +[Fulfillment example](https://identity.foundation/credential-manifest/#credential-response---fulfillment-example): +```json +{ + "id": "a30e3b91-fb77-4d22-95fa-871689c322e2", + "spec_version": "https://identity.foundation/credential-manifest/spec/v1.0.0/", + "manifest_id": "32f54163-7166-48f1-93d8-ff217bdb0653", + "application_id": "b6385066-147c-49d0-9783-261a2154b1fd", + "fulfillment": { + "descriptor_map": [ + { + "id": "banking_output_2", + "format": "jwt_vc", + "path": "$.verifiableCredential[0]" + }, + { + "id": "employment_output", + "format": "ldp_vc", + "path": "$.verifiableCredential[1]" + }, + { + "id": "citizenship_output_1", + "format": "ldp_vc", + "path": "$.verifiableCredential[2]" + } + ] + } +} +``` ## Proposal with payment support To be done at a later time. +## References + +[[Concordium][Concordium]] +The Cordordium blockchain. +URL: https://concordium.com/ + +[[CHAPI][CHAPI]] W3C Credential Handler API 1.0 (https://w3c-ccg.github.io/credential-handler-api/). Dave Longley, Manu Sporny. 2021-6-23. Status: Draft Community Group Report. + +[[DIDComm][DIDComm]] DIF DIDComm Messaging (https://identity.foundation/didcomm-messaging/spec/v2.0/). Sam Curren, Tobias Looker, Oliver Terbu. Status: DIF-Ratified Specification. + +[[OIDC][OIDC]] Open ID Connect (https://openid.net/specs/openid-connect-core-1_0.html). Jones, M., Bradley, J., and N. Sakimura. Status: Approved Specification. + +[[DIF Credential Manifest][DIF-CM]] DIF Credential Manifests 0.0.1. +Daniel Buchner, Brent Zundel, Jace Hensley, Daniel McGrogan, Gabe Cohen. URL: https://identity.foundation/credential-manifest/ Status: Strawman + +[[DIF Presentation Exchange][DIF-PE]] +Presentation Exchange 2.0.0. +Daniel Buchner, Brent Zundel, Martin Riedel, Kim Hamilton Duffy. +URL: https://identity.foundation/presentation-exchange/spec/v2.0.0/ +Status: DIF Ratified Specification + +[[PRF][PRF]] +Oded Goldreich, Shafi Goldwasser, Silvio Micali: +"How to Construct Random Functions". +Journal of the ACM. 33 (4): 792–807. +doi:10.1145/6490.6503. +Wiki: https://en.wikipedia.org/wiki/Pseudorandom_function_family + +[[VC-DATA-MODEL][VC]] Verifiable Credentials Data Model 1.0 (https://www.w3.org/TR/vc-data-model/). Manu Sporny; Grant Noble; Dave Longley; Daniel Burnett; Brent Zundel; 2019-11-19. Status: REC. + + + +[Concordium]: https://concordium.com/ "The Cordordium blockchain" + +[DIF-CM]: https://identity.foundation/credential-manifest/ "DIF Credential Manifests" + +[DIF-PE]: https://identity.foundation/presentation-exchange/spec/v2.0.0/ "DIF Presentation Exchange" + +[VC]: https://www.w3.org/TR/vc-data-model/ "Verifiable Credentials Data Model v1.1" + +[PRF]: https://en.wikipedia.org/wiki/Pseudorandom_function_family "Pseudorandom function families" + +[OIDC]: https://openid.net/specs/openid-connect-core-1_0.html "Open ID Connect" + +[CHAPI]: https://w3c-ccg.github.io/credential-handler-api/ "W3C Credential Handler API 1.0" + +[DIDComm]: https://identity.foundation/didcomm-messaging/spec/v2.0/ "DIF DIDComm Messaging" \ No newline at end of file