traceability-interop

traceability-interop copied to clipboard

https://datatracker.ietf.org/doc/draft-fett-oauth-selective-disclosure-jwt/

This issue to track interest from implementers on SD-JWT, in relation to verifiable credentials.

Note that the sd-jwt spec is not done, and there is no vc-sd-jwt spec describing a mapping from the VCDM2.0 Core Data Model to vc-sd-jwt, similar to https://github.com/w3c/vc-jwt

For implementers wishing to demonstrate interoperability with vc-sd-jwt, these appear to be critical blockers, feel free to add your comments here, if you are interested in vc-sd-jwt in a supply chain usecase.

+1 to this. A VC-SD-JWT spec would offer SD-JWT foundational spec a clearer separation of concerns from VC data model nuances. Specifically as it relates to attribute value canonicalization. A VC should be able to express itself as an SD-JWT. As opposed to, an SD-JWT must support its expressions as a VC.

Cross-linking an SD-JWT issue raised relating to this: https://github.com/oauthstuff/draft-selective-disclosure-jwt/issues/141

We're keeping an eye on the draft, as it evolves... If it ships as part of vc data model v2, I think we can consider covering it with tests.

Not possible to represent verifiable credentials in SD-JWT currently. We will keep an eye on it.

Seems like there is no action we can take on this now.

No action yet - @OR13 to add comments

I have it on my list to do an implementation and describe a mapping for JSON-LD, so we can add support for it.

Cross-linking to: https://github.com/w3c-ccg/traceability-interop/issues/453

See https://w3c.github.io/vc-jose-cose/#vc-ld-sd-jwt-media-type

Its possible to address by acknowledging specific media types.

Seem status list testing is higher priority.

https://github.com/w3c/vc-jose-cose-test-suite/blob/main/testcases/secured-vc-jwt-sd/spec.yaml

please comment on https://github.com/w3c/vc-jose-cose/issues/141

Ideally we don't need to support +jwt and +sd-jwt.

@OR13 is working on it

We need to make a selection of what part of vc-jose-cose we want to support in this profile, whether sd-jwt or +jwt

We should narrow the profile to +jwt.

Personal recommendation is to go with +jwt as it is the easiest for most implementers to support.

Resolved on may 30th call, we will be supporting +jwt

@OR13 you're assigned to this, do you believe you will be taking this or should we be re-assigning it?

the ask for this issue is to update language in the spec to say we will be targetting the +jwt profile section of the vc-jose-cose spec.

I believe this issue should be closed, and FCGS should be limited to JWT.

Please assign @nissimsan any necessary cleanup.

Closing this. We cab bring SD-JWT back when we encounter requirements which need its features.