A new IETF WG has been proposed in the Security Area. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (i...@ietf.org) by 2024-05-18.
Secure Patterns for Internet CrEdentials (spice) ----------------------------------------------------------------------- Current status: BOF WG Chairs: Hannes Tschofenig <hannes.tschofe...@gmx.net> Assigned Area Director: Paul Wouters <paul.wout...@aiven.io> Security Area Directors: Paul Wouters <paul.wout...@aiven.io> Deb Cooley <debcool...@gmail.com> Mailing list: Address: sp...@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/spice Archive: https://mailarchive.ietf.org/arch/browse/spice/ Group page: https://datatracker.ietf.org/group/spice/ Charter: https://datatracker.ietf.org/doc/charter-ietf-spice/ ## Introduction A digital credential expresses claims, assertions, or attributes about a subject, such as their name or age, and their cryptographic keys. Some sets of claim names have already been defined by the IETF and other standards development groups (e.g., OpenID Foundation). Digital credentials typically involve at least three entities. An issuer constructs and secures a digital credential for a holder. Holders may be willing either to partially disclose some values of their attributes or to demonstrate some properties about their attributes without disclosing their values. Holders disclose credentials, attributes, or proofs regarding attributes in what is called a "digital presentation" to a verifier. Some holders may wish to carry more than one digital credential. These credentials, together with associated key material, can be stored in an identity digital wallet. ## Goal The SPICE WG will profile existing IETF technologies and address residual gaps that would enable their use in digital credentials and presentations. * The JOSE WG is already standardizing a token format for unlinkability & selective disclosure in the form of JWP/CWP (draft-ietf-jose-json-web-proof). The SPICE WG will profile these token formats for use with digital credentials. * The OAUTH WG is already standardizing a token format for unlinkability & selective disclosure in the form of SD-JWT/SD-JWT-VC (draft-ietf-oauth-selective-disclosure-jwt and draft-ietf-oauth-sd-jwt-vc). The SPICE WG will define SD-CWT/SD-CWT-VC, analogs for these JWT-based tokens but based on CWT. The SPICE WG coordinates with RATS, OAuth, JOSE, COSE, and SCITT working groups that develop documents related to the identity and credential space. The SPICE WG builds on existing cryptographic primitives and does not define novel cryptographic schemes. The SPICE WG develops digital credential profiles which can support a number of use cases. To help guide engineering decisions, requirements for proposed standards in the program of work will be created in coordination with the working groups listed above. The profiles developed by the SPICE WG will enable digital credentials to leverage existing IETF technologies. Privacy by design, confidentiality, and consent will be considered, and implementation guidance will be given for each proposed standard in the program of work. The privacy and security considerations related to the impact of confidential computing, remote attestation, trusted execution environments (TEE), and hardware security modules (HSM) on digital credentials will be developed in coordination with relevant IETF WGs (e.g., TEEP) and feedback from experts on the mailing list. Privacy and security considerations regarding redaction, linkability and selective disclosure will be developed for proposed standards in the program of work. SPICE will be inspired by the conceptual data model of the W3C VC but will not work on the RDF data models. ## Out of Scope * General Key discovery is out of scope for this WG. There are several mechanisms for distributing or discovering key material (e.g., https://openid.net/specs/openid-connect-discovery-1_0.html). ## Program of Work * An informational Architecture that defines the terminology (e.g., Issuer, Holder, Verifier, Claims, Credentials, Presentations) and the essential communication patterns between roles, such as credential issuance, where an issuer delivers a credential to a holder, and presentation, where a holder delivers a presentation to a verifier. * Proposed standard documents for digital credential profiles covering JWP and CWP (from JOSE) that enable digital credentials with unlinkability and selective disclosure. This work will include registering claims that are in the JWT and CWT registries to enable digital credentials to transition from one security format to another (i.e., JSON/CBOR). * Proposed standard document defining SD-CWT, a profile of CWT inspired by SD-JWT (from OAuth) that enables digital credentials with unlinkability and selective disclosure. * A proposed standard Metadata & Capability Discovery protocol for JWT, CWT, SD-JWT, SD-CWT, CWP and JWP using HTTPS/CoAP for CBOR-based digital credentials to enable the 3 roles (issuers, holders and verifiers) to discover supported capabilities, protocols and formats for keys, claims, credential types and proofs. The design will be inspired by the OAuth "vc-jwt-issuer" metadata work (draft-ietf-oauth-sd-jwt-vc) which supports ecosystems using JSON serialization. ## Milestones * 04/2025 - Submit an informational Architecture document to the IESG for publication * 10/2025 - Submit a proposed standard document covering a JWP/CWP profile for digital credentials to the IESG for publication * 10/2025 - Submit a proposed standard document defining SD-CWT to the IESG for publication * 03/2026 - Submit a document as a proposed standard covering Metadata & Capability Discovery protocol to the IESG for publication _______________________________________________ IETF-Announce mailing list -- ietf-announce@ietf.org To unsubscribe send an email to ietf-announce-le...@ietf.org
