using a VC for Verifier Attestation

[Sakurann]

the core idea is: "Verifier obtains a VC from a trusted third party, a VC includes a key material of a Verifier, authorization request is signed using that key". need to define a schema for that VC.

[Sakurann]

this is what I have now: "When the Client Identifier Scheme is verifier_attestation, the Client Identifier MUST equal sub claim value in the Verifier attestation JWT. The request MUST be signed with the private key corresponding to the public key in the cnf claim in the Verifier attestation JWT. The Verifier attestation VC MUST be added to a newly defined verifier_attestation JOSE Header of a request object. The Wallet MUST validate the signature on the Verifier attestation JWT by a trusted third party. Verifier metadata MUST be obtained from the Verifier attestation JWT."

[tlodderstedt]

Just check back with ppl from ETSi. They are in favor of (in addition to x.509 for qWACs and qSeals) having a VC-based mechanism for Verifier authentication.

[peppelinux]

we are not forced in using verifier_attestation JOSE claim, since we may use a trust_chain jose claim

the attestation is flat, while the trust chain attests all the trust relationships between the parties that attests the accreditation status of an entity, without a central registry

[c2bo]

I think this should be moved to OpenID4VP - I don't think this belongs in HAIP?

[Sakurann]

i think if we do this, we can define a new client id scheme..? so marking 1.1 for now