Skip to content

Add additional text clarifying how to match vct and doctype - #744

Open
GarethCOliver wants to merge 10 commits into
openid:mainfrom
GarethCOliver:type-matching
Open

Add additional text clarifying how to match vct and doctype#744
GarethCOliver wants to merge 10 commits into
openid:mainfrom
GarethCOliver:type-matching

Conversation

@GarethCOliver

@GarethCOliver GarethCOliver commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

Resolves #741 by adding more explicit instructions on what allows a Credential to satisfy vct_values, and applies similar explicit text to doctype_value

This makes use of the SD-JWT VC draft 15 which added aka_vcts for this purpose

Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
GarethCOliver and others added 2 commits June 18, 2026 08:30
Co-authored-by: Frederik Krogsdal Jacobsen <fkj@users.noreply.github.com>
Co-authored-by: Frederik Krogsdal Jacobsen <fkj@users.noreply.github.com>
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
Co-authored-by: Frederik Krogsdal Jacobsen <fkj@users.noreply.github.com>
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
GarethCOliver and others added 2 commits July 1, 2026 10:32
Co-authored-by: Frederik Krogsdal Jacobsen <fkj@users.noreply.github.com>
Co-authored-by: Frederik Krogsdal Jacobsen <fkj@users.noreply.github.com>

@c2bo c2bo left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess this should also go into 1.0 errata?

#741 also asks about the RP/Verifier side -> Should we add a sentence that these checks must be verified by the Verifier?

Text looks good otherwise imho

Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
@Sakurann

Sakurann commented Jul 2, 2026

Copy link
Copy Markdown
Collaborator

WG discussion: makes sense to have this in errata, too and also not to limit validation rules to the wallet but also verifier.

Co-authored-by: Christian Bormann <chris.bormann@gmx.de>
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
@brentzundel

Copy link
Copy Markdown
Collaborator

WG discussion suggests: Make sure it is clear this is an optional feature. @c2bo will propose text.

Co-authored-by: Frederik Krogsdal Jacobsen <fkj@users.noreply.github.com>
@GarethCOliver

Copy link
Copy Markdown
Contributor Author

From conversation at IETF: SD-JWT-VC intends to add a claim to make it explicit what the super-types of a particular credential are (which will make this trivial and correct).

Until that is in place we shouldn't update this text, and should update to reference it when it is ready. Note that the part of this PR related to mdoc can still go through.

@GarethCOliver

Copy link
Copy Markdown
Contributor Author

Updated text to reference the aka_vcts claim, making this nice and explicit.

When a Wallet or Verifier needs to determine whether a Credential's type satisfies a Credential Query, it MUST do so by evaluating if at least one of the following true:

1. The value of the `vct` claim in the Credential is contained in the `vct_values` array.
1. The `aka_vcts` claim is present and has at least one element that is contained in the `aka_vcts` array.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you mean?

Suggested change
1. The `aka_vcts` claim is present and has at least one element that is contained in the `aka_vcts` array.
1. The `aka_vcts` claim is present and has at least one element that is contained in the `vct_values` array.

@jogu jogu left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think if we make this change we have to make it in 1.0 as well - otherwise it's a breaking change in 1.1 and/or 1.0 and 1.1 differ in core behaviour.

But we need to come to a conclusion on #726 first really. If 1.0 is going to reference the latest SD-JWT spec then really 1.0 is going to gain this behaviour regardless, and if we agree on that then making it explicit in 1.0 is best.

(The actual changes in this PR do seem like a sensible way of addressing the problem.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Clarification on checking inheritance of received vct (VP token validation)

7 participants