Merge pull request #53 from vcstuff/verifier-attestion-keys

added requirement to support web-based key resolution for verifier at…
openid · Sep 28, 2023 · 29d00a4 · 29d00a4
2 parents 3bd9f83 + 57dfe3d
commit 29d00a4
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/draft-oid4vc-haip-sd-jwt-vc.md b/draft-oid4vc-haip-sd-jwt-vc.md
@@ -157,6 +157,7 @@ Note: Issuers should be mindful of how long the usage of the refresh token is al
    * Authorization Request MUST be sent using the `request_uri` parameter as defined in JWT-Secured Authorization Request (JAR) [@!RFC9101].
    * `client_id_scheme` parameter MUST be present in the Authorization Request.
    * `client_id_scheme` value MUST be either `x509_san_dns` or `verifier_attestation`. Wallet MUST support both. Verifier MUST support at least one. (pending OID4VCI PR #524 for verifier_attestation)
+   * To obtain the issuer's public key for verification, verifiers MUST support web-based key resolution as defined in Section 5 of [@!I-D.ietf-oauth-sd-jwt-vc]. The JOSE header `kid` MUST be used to identify the respective key.
    * Presentation Definition JSON object MUST be sent using a `presentation_definition` parameter.
    * The following features from the DIF Presentation Exchange v2.0.0 MUST be supported. A JSON schema for the supported features is in (#presentation-definition-schema):