Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Complete IANA Considerations section #401

Merged
merged 8 commits into from
Oct 23, 2024
Merged

Complete IANA Considerations section #401

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
f9ddbff
Start IANA Registrations
selfissued Sep 28, 2024
6becbcf
Completed IANA Considerations section
selfissued Oct 3, 2024
45a6185
Added IANA.URI.Schemes reference
selfissued Oct 3, 2024
8c5587d
Use IANA.JOSE reference
selfissued Oct 3, 2024
da64014
Put backquotes around registered names, as suggested by Daniel Fett
selfissued Oct 3, 2024
9b619ab
Use IANA.JOSE reference
selfissued Oct 3, 2024
fc94341
Make URI scheme registration Permanent
selfissued Oct 8, 2024
1f4dbce
Removed IANA registrations for c_nonce and c_nonce_expires_in
selfissued Oct 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
156 changes: 109 additions & 47 deletions openid-4-verifiable-credential-issuance-1_0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -874,7 +874,7 @@ Additional proof types MAY be defined and used.
The JWT MUST contain the following elements:

* in the JOSE header,
* `alg`: REQUIRED. A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry [@IANA.JOSE.ALGS]. It MUST NOT be `none` or an identifier for a symmetric algorithm (MAC).
* `alg`: REQUIRED. A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry [@IANA.JOSE]. It MUST NOT be `none` or an identifier for a symmetric algorithm (MAC).
* `typ`: REQUIRED. MUST be `openid4vci-proof+jwt`, which explicitly types the key proof JWT as recommended in Section 3.11 of [@!RFC8725].
* `kid`: OPTIONAL. JOSE Header containing the key ID. If the Credential shall be bound to a DID, the `kid` refers to a DID URL which identifies a particular key in the DID Document that the Credential shall be bound to. It MUST NOT be present if `jwk` is present.
* `jwk`: OPTIONAL. JOSE Header containing the key material the new Credential shall be bound to. It MUST NOT be present if `kid` is present.
Expand All @@ -889,7 +889,7 @@ The JWT MUST contain the following elements:

The Credential Issuer MUST validate that the JWT used as a proof is actually signed by a key identified in the JOSE Header.

Cryptographic algorithm names used in the `proof_signing_alg_values_supported` Credential Issuer metadata parameter for this proof type SHOULD be one of those defined in [@IANA.JOSE.ALGS].
Cryptographic algorithm names used in the `proof_signing_alg_values_supported` Credential Issuer metadata parameter for this proof type SHOULD be one of those defined in [@IANA.JOSE].

Below is a non-normative example of a `proof` parameter (with line breaks within values for display purposes only):

Expand Down Expand Up @@ -1421,7 +1421,7 @@ The following is a non-normative example of Credential Issuer metadata of a Cred

Note: The Client MAY use other mechanisms to obtain information about the Verifiable Credentials that a Credential Issuer can issue.

## OAuth 2.0 Authorization Server Metadata
## OAuth 2.0 Authorization Server Metadata {#as-metadata}

This specification also defines a new OAuth 2.0 Authorization Server metadata [@!RFC8414] parameter to publish whether the Authorization Server that the Credential Issuer relies on for authorization supports anonymous Token Requests with the Pre-Authorized Grant Type. It is defined as follows:

Expand Down Expand Up @@ -1780,25 +1780,25 @@ regulation), the Credential Issuer should properly authenticate the Wallet and e
</front>
</reference>

<reference anchor="OpenID.Core" target="http://openid.net/specs/openid-connect-core-1_0.html">
<reference anchor="OpenID.Core" target="https://openid.net/specs/openid-connect-core-1_0.html">
<front>
<title>OpenID Connect Core 1.0 incorporating errata set 2</title>
<author initials="N." surname="Sakimura" fullname="Nat Sakimura">
<organization>NRI</organization>
<author fullname="Nat Sakimura" initials="N." surname="Sakimura">
<organization abbrev="NAT.Consulting (was at NRI)">NAT.Consulting</organization>
</author>
<author initials="J." surname="Bradley" fullname="John Bradley">
<organization>Ping Identity</organization>
<author fullname="John Bradley" initials="J." surname="Bradley">
<organization abbrev="Yubico (was at Ping Identity)">Yubico</organization>
</author>
<author initials="M." surname="Jones" fullname="Michael B. Jones">
<organization>Microsoft</organization>
<author fullname="Michael B. Jones" initials="M.B." surname="Jones">
<organization abbrev="Self-Issued Consulting (was at Microsoft)">Self-Issued Consulting</organization>
</author>
<author initials="B." surname="de Medeiros" fullname="Breno de Medeiros">
<organization>Google</organization>
<author fullname="Breno de Medeiros" initials="B." surname="de Medeiros">
<organization abbrev="Google">Google</organization>
</author>
<author initials="C." surname="Mortimore" fullname="Chuck Mortimore">
<organization>Salesforce</organization>
<author fullname="Chuck Mortimore" initials="C." surname="Mortimore">
<organization abbrev="Disney (was at Salesforce)">Disney</organization>
</author>
<date day="15" month="December" year="2023"/>
<date day="15" month="December" year="2023"/>
</front>
</reference>

Expand Down Expand Up @@ -1862,18 +1862,9 @@ regulation), the Credential Issuer should properly authenticate the Wallet and e
</front>
</reference>

<reference anchor="IANA.JOSE.ALGS" target="https://www.iana.org/assignments/jose/jose.xhtml#web-signature-encryption-algorithms">
<reference anchor="IANA.JOSE" target="https://www.iana.org/assignments/jose">
<front>
<title>JSON Web Signature and Encryption Algorithms</title>
<author>
<organization>IANA</organization>
</author>
</front>
</reference>

<reference anchor="IANA.COSE.ALGS" target="https://www.iana.org/assignments/cose/cose.xhtml#algorithms">
<front>
<title>COSE Algorithms</title>
<title>JSON Object Signing and Encryption (JOSE)</title>
<author>
<organization>IANA</organization>
</author>
Expand Down Expand Up @@ -1949,7 +1940,7 @@ regulation), the Credential Issuer should properly authenticate the Wallet and e
<author fullname="Vladimir Dzhuvinov">
<organization>Connect2id</organization>
</author>
<date day="4" month="December" year="2023"/>
<date day="15" month="September" year="2024"/>
</front>
</reference>

Expand All @@ -1973,6 +1964,16 @@ regulation), the Credential Issuer should properly authenticate the Wallet and e
</front>
</reference>

<reference anchor="IANA.URI.Schemes" target="https://www.iana.org/assignments/uri-schemes">
<front>
<title>Uniform Resource Identifier (URI) Schemes</title>
<author>
<organization>IANA</organization>
</author>
<date/>
</front>
</reference>

<reference anchor="eIDAS" target="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32014R0910">
<front>
<title>REGULATION (EU) No 910/2014 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC</title>
Expand Down Expand Up @@ -2022,7 +2023,7 @@ When the `format` value is `jwt_vc_json`, the entire Credential Offer, Authoriza

#### Credential Issuer Metadata {#server-metadata-jwt-vc-json}

Cryptographic algorithm names used in the `credential_signing_alg_values_supported` parameter SHOULD be one of those defined in [@IANA.JOSE.ALGS].
Cryptographic algorithm names used in the `credential_signing_alg_values_supported` parameter SHOULD be one of those defined in [@IANA.JOSE].

The following additional Credential Issuer metadata parameters are defined for this Credential Format for use in the `credential_configurations_supported` parameter, in addition to those defined in (#credential-issuer-parameters).

Expand Down Expand Up @@ -2237,7 +2238,7 @@ The Credential Format Identifier is `vc+sd-jwt`.

### Credential Issuer Metadata {#server-metadata-sd-jwt-vc}

Cryptographic algorithm names used in the `credential_signing_alg_values_supported` parameter SHOULD be one of those defined in [@IANA.JOSE.ALGS].
Cryptographic algorithm names used in the `credential_signing_alg_values_supported` parameter SHOULD be one of those defined in [@IANA.JOSE].

The following additional Credential Issuer metadata parameters are defined for this Credential Format for use in the `credential_configurations_supported` parameter, in addition to those defined in (#credential-issuer-parameters).

Expand Down Expand Up @@ -2287,66 +2288,113 @@ The following is a non-normative example of a Credential Response containing a C

# IANA Considerations

## Sub-Namespace Registration
## OAuth URI Registry

This specification registers the following URN
in the IANA "OAuth URI" registry [@IANA.OAuth.Parameters]
established by [@!RFC6755].

This specification registers the following URN in the IANA "OAuth URI" registry [@!IANA.OAuth.Parameters] established by [@!RFC6755].
### urn:ietf:params:oauth:grant-type:pre-authorized_code

* URN: urn:ietf:params:oauth:grant-type:pre-authorized_code
* URN: `urn:ietf:params:oauth:grant-type:pre-authorized_code`
* Common Name: Pre-Authorized Code
* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - [email protected]
* Reference: (#token-request) of this specification
* Reference: (#credential-offer-parameters) of this specification

## OAuth Parameters Registry

This specification registers the following parameter names in the IANA "OAuth Parameters" registry [@!IANA.OAuth.Parameters] established by [@!RFC6749].
This specification registers the following OAuth parameters
in the IANA "OAuth Parameters" registry [@IANA.OAuth.Parameters]
established by [@!RFC6749].

### wallet_issuer

* Parameter Name: wallet_issuer
* Name: `wallet_issuer`
* Parameter Usage Location: authorization request
* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - [email protected]
* Reference: (#credential-authz-request) of this specification

* Parameter Name: user_hint
### user_hint

* Name: `user_hint`
* Parameter Usage Location: authorization request
* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - [email protected]
* Reference: (#credential-authz-request) of this specification

* Parameter Name: issuer_state
### issuer_state

* Name: `issuer_state`
* Parameter Usage Location: authorization request
* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - [email protected]
* Reference: (#credential-authz-request) of this specification

* Parameter Name: pre-authorized_code
### pre-authorized_code

* Name: `pre-authorized_code`
* Parameter Usage Location: token request
* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - [email protected]
* Reference: (#token-request) of this specification

* Parameter Name: tx_code
### tx_code

* Name: `tx_code`
* Parameter Usage Location: token request
* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - [email protected]
* Reference: (#token-request) of this specification

### credential_identifiers

* Name: `credential_identifiers`
* Parameter Usage Location: token response
* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - [email protected]
* Reference: (#token-response) of this specification

## OAuth Authorization Server Metadata Registry

This specification registers the following authorization server metadata parameter
in the IANA "OAuth Authorization Server Metadata" registry [@IANA.OAuth.Parameters]
established by [@!RFC8414].

### pre-authorized_grant_anonymous_access_supported

* Metadata Name: `pre-authorized_grant_anonymous_access_supported`
* Metadata Description: Boolean indicating whether Credential Issuer accepts Token Request with Pre-Authorized Code but without `client_id`
* Change Controller: OpenID Foundation Artifact Binding Working Group - [email protected]
* Reference: (#as-metadata) of this specification

## OAuth Dynamic Client Registration Metadata Registry

This specification registers the following client metadata name in the IANA "OAuth Dynamic Client Registration Metadata" registry [@!IANA.OAuth.Parameters] established by [@!RFC7591].
This specification registers the following client metadata parameter
in the IANA "OAuth Dynamic Client Registration Metadata" registry [@IANA.OAuth.Parameters]
established by [@!RFC7591].

### credential_offer_endpoint

* Client Metadata Name: credential_offer_endpoint
* Client Metadata Name: `credential_offer_endpoint`
* Client Metadata Description: Credential Offer Endpoint
* Change Controller: OpenID Foundation Digital Credentials Protocols Working Group - [email protected]
* Reference: (#credential-offer-endpoint) of this specification

* Reference: (#client-metadata) of this specification

## Well-Known URI Registry

This specification registers the following well-known URI in the IANA "Well-Known URI" registry established by [@!RFC5785].
This specification registers the following well-known URI
in the IANA "Well-Known URI" registry [@IANA.OAuth.Parameters]
established by [@!RFC5785].

### .well-known/openid-credential-issuer

* URI suffix: openid-credential-issuer
* URI suffix: `openid-credential-issuer`
* Change controller: OpenID Foundation Digital Credentials Protocols Working Group - [email protected]
* Specification document: (#credential-issuer-wellknown) of this document
* Specification document: (#credential-issuer-wellknown) of this specification
* Related information: (none)

## Media Types Registry

This specification registers the following media types in the IANA "Media Types" registry [@!IANA.MediaTypes] in the manner described in [@!RFC6838].
This specification registers the following media type [@RFC2046]
in the IANA "Media Types" registry [@IANA.MediaTypes]
in the manner described in [@RFC6838].

### application/openid4vci-proof+jwt

* Type name: `application`
* Subtype name: `openid4vci-proof+jwt`
Expand All @@ -2368,6 +2416,19 @@ This specification registers the following media types in the IANA "Media Types"
* Change controller: OpenID Foundation Digital Credentials Protocols Working Group - [email protected]
* Provisional registration? No

## Uniform Resource Identifier (URI) Schemes Registry

This specification registers the following URI scheme
in the IANA "Uniform Resource Identifier (URI) Schemes" registry [@IANA.URI.Schemes].

### openid-credential-offer

* URI Scheme: openid-credential-offer
* Description: Custom scheme used for credential offers
* Status: Permanent
* Well-Known URI Support: -
* Change Controller: OpenID Foundation Artifact Binding Working Group - [email protected]
* Reference: (#client-metadata-retrieval) of this specification

# Use Cases

Expand Down Expand Up @@ -2427,6 +2488,7 @@ The technology described in this specification was made available from contribut
* deferred credential response always returns an array (same as credential response)
* notification_id is now used for an issuance flow that can contain more than one credential
* Fixed #375: Enabled non-breaking extensibility.
* Fixed #239: Completed IANA Considerations section.

-14

Expand Down