Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Changes to normative statements #143

Merged
merged 6 commits into from
Sep 8, 2023
Merged

Changes to normative statements #143

Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ad46778
Changes to normative statements
OR13 Aug 24, 2023
ffe76d9
Merge branch 'main' of github.com:w3c/vc-jose-cose into adjust/normat…
OR13 Aug 24, 2023
6a821e1
Add guidance on why SHOULD over MUST for typ
OR13 Sep 5, 2023
973b500
Update index.html
OR13 Sep 6, 2023
2c56d85
Update index.html
OR13 Sep 6, 2023
cab349d
Update index.html
OR13 Sep 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 18 additions & 7 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,6 +204,17 @@ <h2>Securing the VC Data Model</h2>
transformation, while at the same time supporting registered
claims that are understood in the context of JOSE and COSE.
</p>
<p>
It is RECOMMENDED that media types be used to distinguish <a data-cite="VC-DATA-MODEL#credentials">verifiable credentials</a>
and <a data-cite="VC-DATA-MODEL#presentations">verifiable presentations</a> from other kinds of secured JSON or CBOR.
</p>
<p>
The most specific media type (or subtype) available SHOULD be used, instead of
more generic media types (or supertypes). For example, rather than the general
<code>application/sd-jwt</code>, <code>application/vc+ld+json+sd-jwt</code>
ought to be used, unless there is a more specific media type that would even
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
ought to be used, unless there is a more specific media type that would even
should to be used, unless there is a more specific media type that would even

Copy link
Member

@TallTed TallTed Sep 7, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ought to was meant to avoid potential confusion of should with SHOULD.

If should is now to be kept, should to be should be changed to should be or perhaps SHOULD be.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I prefer to avoid the normative language

better identify the secured envelope format.
</p>
OR13 marked this conversation as resolved.
Show resolved Hide resolved
<section>
<h2>With JOSE</h2>
<section>
Expand All @@ -215,10 +226,10 @@ <h2>Securing JSON-LD Verifiable Credentials with JOSE</h2>
</p>
<p>[[rfc7515]] MAY be used to secure this media type.</p>
OR13 marked this conversation as resolved.
Show resolved Hide resolved
<p>
The <code>typ</code> parameter MUST be <code>vc+ld+json+jwt</code>
The <code>typ</code> parameter SHOULD be <code>vc+ld+json+sd-jwt</code>
</p>
<p>
When present, the <code>cty</code> MUST be
When present, the <code>cty</code> SHOULD be
OR13 marked this conversation as resolved.
Show resolved Hide resolved
<code>vc+ld+json</code>
</p>
<p>
Expand Down Expand Up @@ -256,10 +267,10 @@ <h2>Securing JSON-LD Verifiable Presentations with JOSE</h2>
<code>application/vp+ld+json</code> with JOSE.
</p>
<p>[[rfc7515]] MAY be used to secure this media type.</p>
OR13 marked this conversation as resolved.
Show resolved Hide resolved
<p>The <code>typ</code> parameter MUST be
<p>The <code>typ</code> parameter SHOULD be
OR13 marked this conversation as resolved.
Show resolved Hide resolved
<code>vp+ld+json+jwt</code>
OR13 marked this conversation as resolved.
Show resolved Hide resolved
</p>
<p>When present, the <code>cty</code> parameter MUST be
<p>When present, the <code>cty</code> parameter SHOULD be
<code>vp+ld+json</code>
</p>
<p>
Expand Down Expand Up @@ -308,7 +319,7 @@ <h2>With COSE</h2>
<p>
COSE [[rfc9052]] is a common approach to encoding and securing
information using CBOR [[rfc8949]]. Verifiable credentials MAY
be secured using COSE [[rfc9052]] and MUST be identified through
be secured using COSE [[rfc9052]] and SHOULD be identified through
use of content types as outlined in this section.
</p>
<section>
Expand All @@ -319,15 +330,15 @@ <h2>Securing JSON-LD VCs with COSE</h2>
with COSE.
</p>
<p>[[rfc9052]] MAY be used to secure this media type.</p>
<p>When using this approach, the <code>type (TBD)</code> MUST be
<p>When using this approach, the <code>type (TBD)</code> SHOULD be
<code>vc+ld+json+cose</code>
</p>
<p class="issue">
See <a href="https://datatracker.ietf.org/doc/draft-jones-cose-typ-header-parameter/">draft-jones-cose-typ-header-parameter</a>,
regarding progress towards explicit typing for COSE.
</p>
<p>When using this approach, the <code>content type (3)</code>
MUST be <code>application/vc+ld+json</code></p>
SHOULD be <code>application/vc+ld+json</code></p>
<p>
See <a data-cite="rfc9052#section-3.1">Common COSE Header
Parameters</a> for additional details.
Expand Down