Hi all,
We have published version -18 of the SD-JWT VC draft, introducing the optional
aka_vcts claim following feedback at the recent IETF meeting and from
implementers.
Previously, relationships between credential types could only be discovered
through the extends property in Type Metadata. Since Metadata processing is
optional and may be unavailable, for example offline, issuance and presentation
protocols cannot rely on it for type matching.
For example, a Verifier requesting urn:example:eudi:pid might receive:
{
"vct": "urn:example:eudi:pid:aendgard:1",
"aka_vcts": ["urn:example:eudi:pid"]
}
The credential can then be matched as either type without resolving Type
Metadata.
Like vct, aka_vcts is issuer-signed, cannot be selectively disclosed, and does
not by itself establish the Issuer’s authorization.
The claim is independent of Type Metadata and extends. Existing extends-based
matching remains supported. Where Metadata exists for both types, the vct type
SHOULD extend the listed type directly or transitively.
Based on implementer feedback, the claim was renamed from inherits to aka_vcts,
and the Metadata consistency requirement was relaxed from MUST to SHOULD.
Best,
Oliver
_______________________________________________
OAuth mailing list -- [email protected]
To unsubscribe send an email to [email protected]
