Add support for Enveloped Verifiable Credentials (2nd attempt) #1379

msporny · 2023-12-09T22:22:50Z

This PR attempts to address issue #1352 by adding a new feature for embedding "enveloped" Verifiable Credentials in Verifiable Presentations. This PR integrates @iherman's PR #1372.

Preview | Diff

iherman

None of my comments are show-stoppers.

index.html

iherman · 2023-12-10T09:16:43Z

index.html

+The `@context` value of the object MUST follow all of the "MUST" statements in
+Section <a href="#contexts"></a>. The `id` value of the object MUST be a `data:`


Suggested change

The `@context` value of the object MUST follow all of the "MUST" statements in

Section <a href="#contexts"></a>. The `id` value of the object MUST be a `data:`

The possible `@context` value of the object MUST follow all of the "MUST" statements in

Section <a href="#contexts"></a>. The `id` value of the object MUST be a `data:`

Is it really necessary to include a @context at this point? The only reason to have it is to use the id and type aliases, but that would be inherited from the contexts above, wouldn't it?

Yes, it's necessary, because (in the v2 context) we clear all context values inside the Verifiable Credential Graph. We have to do this in order to ensure that VCDM v1.1 VCs can be put inside VCDMV v2.0 VPs. If we don't do that, JSON-LD protected mode kicks in and alerts us that we're re-defining some terms (which is the correct behaviour).

Ah. Right, my bad.

(For other reviewers, in case they do not follow: there is a "@context": null statement within the definition of the VerifiablePresentation.verifiableCredential property in the V2 @context file. The reason is what @msporny describes above.)

Let me picky, though. The text says:

The @context value of the object MUST follow all of the "MUST" statements in Section 4.2 Contexts.

However, §4.2 only says:

Verifiable credentials and verifiable presentations MUST include a @context property.

Technically, i.e., in the vocabulary, an EnvelopedVerifiableCredential is not a VerifiableCredential (they are different classes), meaning that the statement in §4.2 does not apply, i.e., it is not said that a @context file must be present. You can either change the text in §4.2, or add a statement in the new section whereby a @context property MUST be added.

Also, continuing to be picky, and looking at §5.12, the text says:

For presentations, each value associated with the verifiableCredential property of the presentation is a separate named graph of type VerifiableCredentialGraph which contains a single verifiable credential.

(Emphasis is mine.) I believe it should say something like

which contains a single verifiable credential or and enveloped verifiable credential.

(Or something for that effect.)

Yes, I believe your statements above are correct, I'll make those modifications in the next iteration of this PR.

I don't think the second context is required here... if the v2 context defines things correctly.

@OR13,

As explained in the comments above, the second context is indeed necessary as the context is intentionally cleared to support other contexts (such as 1.1). So a context declaration is required.

@OR13

We can put it another way: if the second context is not used, then the right terms for that object must be @type and @id instead of type and id, respectively (this is how the current, v2 version of @context works, and I do not see any way to avoid that.)

It is indeed unfortunate that the usage of those aliases force us to use the second context here. But that is water under the bridge, we decided not to use the original, @-prefixed values.

@iherman, I applied your requests in 2ffb884.

index.html

OR13 · 2023-12-11T17:05:30Z

index.html

+The `@context` value of the object MUST follow all of the "MUST" statements in
+Section <a href="#contexts"></a>. The `id` value of the object MUST be a `data:`
+URL that expresses a secured <a>verifiable credential</a> using an enveloping
+security scheme, such as [[[VC-JOSE-COSE]]] [[VC-JOSE-COSE]]. The `type` value


Are there 2 here intentionally?

@OR13, this is a respec trick.

[[[VC-JOSE-COSE]]] is converted into the official title of the spec

[[VC-JOSE-COSE]] is converted into a reference to the References' section.

So the short answer to your question is: yes.

OR13 · 2023-12-11T17:06:22Z

index.html

+  <span class="highlight">"verifiableCredential": [{
+    "@context": "https://www.w3.org/ns/credentials/v2",
+    "id": "data:application/vc+ld+json+sd-jwt;base64,QzVjV...RMjUK==",
+    "type": "EnvelopedVerifiableCredential"


This is interesting... I think with some discussion this could be acceptable.

index.html

brianorwhatever · 2023-12-11T17:08:30Z

This PR is great and does a good job in finally disambiguating things that are quite clearly different.

decentralgabe

I'm supportive of this compromise. Thank you.

OR13 · 2023-12-11T17:50:04Z

Does this mean that you can't use SD-JWT to create v1 presentations or credentials?

Or that the v2 context is required to make v1 presentations?

dlongley

+1 to @iherman's comments.

index.html

dmitrizagidulin

👍

iherman · 2023-12-13T17:10:24Z

The issue was discussed in a meeting on 2023-12-13

no resolutions were taken

View the transcript

2.12. Clarify section on verifiable credential graph (issue vc-data-model#1365)

See github issue vc-data-model#1365.

Brent Zundel: clarify section of verifiable credential graph.
… what needs to change to address this?

Manu Sporny: there is a clear concern, which i think I can address.
… for the avoidance of doubt, the following values are not allowed in a verifiableCredential.
… I list raw text strings, and URLs.
… it has to be an object of some kind that creates that graph structure.
… and I won't make it exhaustive... its strange to point out, what you cannot put in the field.

Dave Longley: "MUST be an object and can't be something else, such as...".

Andres Uribe: works for me, thanks manu!

Brent Zundel: do you want to mix that into 1379?

Manu Sporny: seems to make sense to put it in 1379.

See github pull request vc-data-model#1379.

Brent Zundel: then it will address that issue as well.
… not hearing anyone opposed to this path.

iherman · 2023-12-13T17:10:24Z

The issue was discussed in a meeting on 2023-12-13

no resolutions were taken

View the transcript

2.7. Add mechanism to embed externally secured VCs in a VP (issue vc-data-model#1352)

See github issue vc-data-model#1352.

Brent Zundel: add mechanism to secure VPs.
… first PR failed, second PR was raised, can we get an update.

See github pull request vc-data-model#1379.

Manu Sporny: seems it will land.
… we seem to have a solution for securing verifiable presentations without using proof.

Co-authored-by: Ted Thibodeau Jr <[email protected]>

Co-authored-by: Ivan Herman <[email protected]>

Co-authored-by: Orie Steele <[email protected]>

msporny · 2023-12-15T17:25:42Z

Normative, multiple reviews, changes requested and made, no objections, merging.

iherman · 2023-12-16T07:44:28Z

@msporny the PR has been merged, but I do not see any additions reflecting on what I wrote in #1379 (comment). A quick search on the term EnvelopedVerifiableCredential reveals that the only place the term appears is in §4.11.1 Enveloped Verifiable Credentials.

msporny · 2023-12-16T18:45:09Z

@msporny the PR has been merged, but I do not see any additions reflecting on what I wrote in #1379 (comment).

Woops, apologies. Fixed in 2ffb884.

iherman and others added 2 commits December 9, 2023 15:39

Add EnvelopedVerifiableCredential type to vocabulary.

2783fd5

Add section for Enveloped Verifiable Credentials.

179b88b

msporny requested review from dlongley, m00sey, jandrieu, iherman, dmitrizagidulin, David-Chadwick, decentralgabe, selfissued, OR13, brentzundel, awoie and Sakurann December 9, 2023 22:22

Add EnvelopedVerifiableCredential to JSON-LD Context.

5cbb196

msporny mentioned this pull request Dec 9, 2023

Add mechanism to embed externally secured VCs in a VP #1352

Closed

msporny added the before-CR label Dec 9, 2023

This was referenced Dec 9, 2023

Add the EnvelopedVerifiableCredential class to the vocabulary #1372

Closed

Clarify section on verifiable credential graph #1365

Closed

iherman approved these changes Dec 10, 2023

View reviewed changes

msporny requested review from TallTed and andresuribe87 December 10, 2023 20:50

msporny mentioned this pull request Dec 11, 2023

Add relatedResource property to VerifiablePresentation #1370

Closed

OR13 reviewed Dec 11, 2023

View reviewed changes

OR13 approved these changes Dec 11, 2023

View reviewed changes

OR13 reviewed Dec 11, 2023

View reviewed changes

index.html Outdated Show resolved Hide resolved

decentralgabe approved these changes Dec 11, 2023

View reviewed changes

OR13 mentioned this pull request Dec 11, 2023

Presentation with key binding transmute-industries/dune#1

Merged

dlongley approved these changes Dec 11, 2023

View reviewed changes

TallTed requested changes Dec 12, 2023

View reviewed changes

index.html Outdated Show resolved Hide resolved

brentzundel mentioned this pull request Dec 12, 2023

Add mechanism to embed enveloped VCs in VPs. #1358

Closed

dmitrizagidulin approved these changes Dec 12, 2023

View reviewed changes

mkhraisha approved these changes Dec 12, 2023

View reviewed changes

msporny and others added 3 commits December 15, 2023 12:17

Fix grammar in Enveloped Verifiable Credentials introduction.

c4d5554

Co-authored-by: Ted Thibodeau Jr <[email protected]>

Add reference to RFC2397.

01262ae

Co-authored-by: Ivan Herman <[email protected]>

Fix example for SD-JWT.

3884d4e

Co-authored-by: Orie Steele <[email protected]>

msporny merged commit 8f26399 into main Dec 15, 2023
2 checks passed

msporny deleted the msporny-evc branch December 15, 2023 17:25

iherman mentioned this pull request Dec 16, 2023

Updating the vocab diagram #1387

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for Enveloped Verifiable Credentials (2nd attempt) #1379

Add support for Enveloped Verifiable Credentials (2nd attempt) #1379

msporny commented Dec 9, 2023 •

edited by pr-preview bot

Loading

iherman left a comment

iherman Dec 10, 2023 •

edited

Loading

msporny Dec 10, 2023 •

edited

Loading

iherman Dec 10, 2023 •

edited

Loading

msporny Dec 10, 2023

OR13 Dec 11, 2023

dlongley Dec 11, 2023

iherman Dec 12, 2023

msporny Dec 16, 2023

OR13 Dec 11, 2023

iherman Dec 12, 2023

OR13 Dec 11, 2023

brianorwhatever commented Dec 11, 2023

decentralgabe left a comment

OR13 commented Dec 11, 2023

dlongley left a comment

dmitrizagidulin left a comment

iherman commented Dec 13, 2023

2.12. Clarify section on verifiable credential graph (issue vc-data-model#1365)

iherman commented Dec 13, 2023

2.7. Add mechanism to embed externally secured VCs in a VP (issue vc-data-model#1352)

msporny commented Dec 15, 2023

iherman commented Dec 16, 2023

msporny commented Dec 16, 2023

		The `@context` value of the object MUST follow all of the "MUST" statements in
		Section <a href="#contexts"></a>. The `id` value of the object MUST be a `data:`

Add support for Enveloped Verifiable Credentials (2nd attempt) #1379

Add support for Enveloped Verifiable Credentials (2nd attempt) #1379

Conversation

msporny commented Dec 9, 2023 • edited by pr-preview bot Loading

iherman left a comment

Choose a reason for hiding this comment

iherman Dec 10, 2023 • edited Loading

Choose a reason for hiding this comment

msporny Dec 10, 2023 • edited Loading

Choose a reason for hiding this comment

iherman Dec 10, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brianorwhatever commented Dec 11, 2023

decentralgabe left a comment

Choose a reason for hiding this comment

OR13 commented Dec 11, 2023

dlongley left a comment

Choose a reason for hiding this comment

dmitrizagidulin left a comment

Choose a reason for hiding this comment

iherman commented Dec 13, 2023

2.12. Clarify section on verifiable credential graph (issue vc-data-model#1365)

iherman commented Dec 13, 2023

2.7. Add mechanism to embed externally secured VCs in a VP (issue vc-data-model#1352)

msporny commented Dec 15, 2023

iherman commented Dec 16, 2023

msporny commented Dec 16, 2023

msporny commented Dec 9, 2023 •

edited by pr-preview bot

Loading

iherman Dec 10, 2023 •

edited

Loading

msporny Dec 10, 2023 •

edited

Loading

iherman Dec 10, 2023 •

edited

Loading