From f27e6d22c7a436853dac76c6d3c913c606653be7 Mon Sep 17 00:00:00 2001 From: gco Date: Thu, 18 Jun 2026 05:13:15 -0700 Subject: [PATCH 01/10] Add additional text clarifying how to match vct_values and doctype_value. --- 1.1/openid-4-verifiable-presentations-1_1.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/1.1/openid-4-verifiable-presentations-1_1.md b/1.1/openid-4-verifiable-presentations-1_1.md index 198af1b2..bc2f00ba 100644 --- a/1.1/openid-4-verifiable-presentations-1_1.md +++ b/1.1/openid-4-verifiable-presentations-1_1.md @@ -2889,8 +2889,7 @@ The following is an ISO mdoc specific parameter in the `meta` parameter in a Cre `doctype_value`: : REQUIRED. String that specifies an allowed value for the -doctype of the requested Verifiable Credential. It MUST -be a valid doctype identifier as defined in [@ISO.18013-5]. +doctype of the requested Verifiable Credential. It MUST be a valid doctype identifier as defined in [@ISO.18013-5]. For a mdoc to satisfy the Credential Query, the value of the `docType` element in the `MobileSecurityObject` structure MUST be equal to the `doctype_value`. ### Parameter in the Claims Query {#mdocs_claims_query} @@ -3249,11 +3248,13 @@ The following is a non-normative example of `client_metadata` request parameter The following is an SD-JWT VC specific parameter in the `meta` parameter in a Credential Query as defined in (#credential_query). `vct_values`: -: REQUIRED. A non-empty array of strings that specifies allowed values for -the type of the requested Verifiable Credential. All elements in the array MUST -be valid type identifiers as defined in [@!I-D.ietf-oauth-sd-jwt-vc]. The Wallet -MAY return Credentials that inherit from any of the specified types, following -the inheritance logic defined in [@!I-D.ietf-oauth-sd-jwt-vc]. +: REQUIRED. A non-empty array of strings that specifies allowed values for the type of the requested Verifiable Credential. All elements in the array MUST be valid type identifiers as defined in [@!I-D.ietf-oauth-sd-jwt-vc]. To satisfy the Credential Query, a Credential MUST either have or inherit from a type that is included in the `vct_values` array as defined in [@!I-D.ietf-oauth-sd-jwt-vc]. + +A Credential's type can be determined as satifying the Credential Query as follows: + +1. Check if the `vct` in the Credential is contained in the `vct_values` array. If it is, the Credential satisfies the Credential Query. +1. If is is not, check if the Credential has an `extends` claim. If it does repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. +1. If none of the above conditions are met, the Credential's type does not satisfy the Credential Query. ### Presentation Response From 717390cbd5680caf5923c8a34ab5879baee333bf Mon Sep 17 00:00:00 2001 From: Gareth Oliver Date: Thu, 18 Jun 2026 08:30:24 -0700 Subject: [PATCH 02/10] Update 1.1/openid-4-verifiable-presentations-1_1.md Co-authored-by: Frederik Krogsdal Jacobsen --- 1.1/openid-4-verifiable-presentations-1_1.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/1.1/openid-4-verifiable-presentations-1_1.md b/1.1/openid-4-verifiable-presentations-1_1.md index bc2f00ba..9f773421 100644 --- a/1.1/openid-4-verifiable-presentations-1_1.md +++ b/1.1/openid-4-verifiable-presentations-1_1.md @@ -3253,7 +3253,7 @@ The following is an SD-JWT VC specific parameter in the `meta` parameter in a Cr A Credential's type can be determined as satifying the Credential Query as follows: 1. Check if the `vct` in the Credential is contained in the `vct_values` array. If it is, the Credential satisfies the Credential Query. -1. If is is not, check if the Credential has an `extends` claim. If it does repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. +1. If `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. 1. If none of the above conditions are met, the Credential's type does not satisfy the Credential Query. ### Presentation Response From 7a092dbe13f3c6317347db8e1a4b7ea977a1fc36 Mon Sep 17 00:00:00 2001 From: Gareth Oliver Date: Thu, 18 Jun 2026 08:30:33 -0700 Subject: [PATCH 03/10] Update 1.1/openid-4-verifiable-presentations-1_1.md Co-authored-by: Frederik Krogsdal Jacobsen --- 1.1/openid-4-verifiable-presentations-1_1.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/1.1/openid-4-verifiable-presentations-1_1.md b/1.1/openid-4-verifiable-presentations-1_1.md index 9f773421..0c158cc1 100644 --- a/1.1/openid-4-verifiable-presentations-1_1.md +++ b/1.1/openid-4-verifiable-presentations-1_1.md @@ -3254,7 +3254,7 @@ A Credential's type can be determined as satifying the Credential Query as follo 1. Check if the `vct` in the Credential is contained in the `vct_values` array. If it is, the Credential satisfies the Credential Query. 1. If `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. -1. If none of the above conditions are met, the Credential's type does not satisfy the Credential Query. +1. If none of the above conditions are met, the Credential does not satisfy the Credential Query. ### Presentation Response From 12ea8bacd34a9c70aba9bd988457db4c9201434a Mon Sep 17 00:00:00 2001 From: Gareth Oliver Date: Mon, 22 Jun 2026 05:41:17 -0700 Subject: [PATCH 04/10] Apply suggestion from @fkj Co-authored-by: Frederik Krogsdal Jacobsen --- 1.1/openid-4-verifiable-presentations-1_1.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/1.1/openid-4-verifiable-presentations-1_1.md b/1.1/openid-4-verifiable-presentations-1_1.md index 0c158cc1..25ac0648 100644 --- a/1.1/openid-4-verifiable-presentations-1_1.md +++ b/1.1/openid-4-verifiable-presentations-1_1.md @@ -3253,7 +3253,7 @@ The following is an SD-JWT VC specific parameter in the `meta` parameter in a Cr A Credential's type can be determined as satifying the Credential Query as follows: 1. Check if the `vct` in the Credential is contained in the `vct_values` array. If it is, the Credential satisfies the Credential Query. -1. If `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. +1. If `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. If a circular dependency is detected while following `extends` claims, the Credential does not satisfy the Credential Query. 1. If none of the above conditions are met, the Credential does not satisfy the Credential Query. ### Presentation Response From 368d4ca6dca2a7686074bb9298e9cd7042d54852 Mon Sep 17 00:00:00 2001 From: Gareth Oliver Date: Mon, 22 Jun 2026 05:43:18 -0700 Subject: [PATCH 05/10] Apply suggestion from @GarethCOliver --- 1.1/openid-4-verifiable-presentations-1_1.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/1.1/openid-4-verifiable-presentations-1_1.md b/1.1/openid-4-verifiable-presentations-1_1.md index 25ac0648..daed756f 100644 --- a/1.1/openid-4-verifiable-presentations-1_1.md +++ b/1.1/openid-4-verifiable-presentations-1_1.md @@ -3253,7 +3253,7 @@ The following is an SD-JWT VC specific parameter in the `meta` parameter in a Cr A Credential's type can be determined as satifying the Credential Query as follows: 1. Check if the `vct` in the Credential is contained in the `vct_values` array. If it is, the Credential satisfies the Credential Query. -1. If `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. If a circular dependency is detected while following `extends` claims, the Credential does not satisfy the Credential Query. +1. If `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. If a circular dependency is detected while following the `extends` claims, the Credential does not satisfy the Credential Query. 1. If none of the above conditions are met, the Credential does not satisfy the Credential Query. ### Presentation Response From 4072a9c8626312030d4e85cf0912960156137bc5 Mon Sep 17 00:00:00 2001 From: Gareth Oliver Date: Wed, 1 Jul 2026 10:32:04 +0200 Subject: [PATCH 06/10] Update 1.1/openid-4-verifiable-presentations-1_1.md Co-authored-by: Frederik Krogsdal Jacobsen --- 1.1/openid-4-verifiable-presentations-1_1.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/1.1/openid-4-verifiable-presentations-1_1.md b/1.1/openid-4-verifiable-presentations-1_1.md index daed756f..0b3bfbd7 100644 --- a/1.1/openid-4-verifiable-presentations-1_1.md +++ b/1.1/openid-4-verifiable-presentations-1_1.md @@ -3250,7 +3250,7 @@ The following is an SD-JWT VC specific parameter in the `meta` parameter in a Cr `vct_values`: : REQUIRED. A non-empty array of strings that specifies allowed values for the type of the requested Verifiable Credential. All elements in the array MUST be valid type identifiers as defined in [@!I-D.ietf-oauth-sd-jwt-vc]. To satisfy the Credential Query, a Credential MUST either have or inherit from a type that is included in the `vct_values` array as defined in [@!I-D.ietf-oauth-sd-jwt-vc]. -A Credential's type can be determined as satifying the Credential Query as follows: +The Wallet MUST determine whether a Credential's type satisfies a Credential Query by following these steps: 1. Check if the `vct` in the Credential is contained in the `vct_values` array. If it is, the Credential satisfies the Credential Query. 1. If `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. If a circular dependency is detected while following the `extends` claims, the Credential does not satisfy the Credential Query. From 1b3fa7dd7ddd788b99cf10f895022fb7c717d8af Mon Sep 17 00:00:00 2001 From: Gareth Oliver Date: Wed, 1 Jul 2026 10:33:20 +0200 Subject: [PATCH 07/10] Update 1.1/openid-4-verifiable-presentations-1_1.md Co-authored-by: Frederik Krogsdal Jacobsen --- 1.1/openid-4-verifiable-presentations-1_1.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/1.1/openid-4-verifiable-presentations-1_1.md b/1.1/openid-4-verifiable-presentations-1_1.md index 0b3bfbd7..3a89510e 100644 --- a/1.1/openid-4-verifiable-presentations-1_1.md +++ b/1.1/openid-4-verifiable-presentations-1_1.md @@ -3253,7 +3253,7 @@ The following is an SD-JWT VC specific parameter in the `meta` parameter in a Cr The Wallet MUST determine whether a Credential's type satisfies a Credential Query by following these steps: 1. Check if the `vct` in the Credential is contained in the `vct_values` array. If it is, the Credential satisfies the Credential Query. -1. If `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. If a circular dependency is detected while following the `extends` claims, the Credential does not satisfy the Credential Query. +1. If the `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. If a circular dependency is detected while following the `extends` claims, the Credential does not satisfy the Credential Query. 1. If none of the above conditions are met, the Credential does not satisfy the Credential Query. ### Presentation Response From 5b6ea03c65a1e087ce46d7a5f977f7313a5a1725 Mon Sep 17 00:00:00 2001 From: Gareth Oliver Date: Thu, 9 Jul 2026 16:42:46 +1000 Subject: [PATCH 08/10] Apply suggestion from @c2bo Co-authored-by: Christian Bormann --- 1.1/openid-4-verifiable-presentations-1_1.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/1.1/openid-4-verifiable-presentations-1_1.md b/1.1/openid-4-verifiable-presentations-1_1.md index 3a89510e..307fda09 100644 --- a/1.1/openid-4-verifiable-presentations-1_1.md +++ b/1.1/openid-4-verifiable-presentations-1_1.md @@ -2889,7 +2889,7 @@ The following is an ISO mdoc specific parameter in the `meta` parameter in a Cre `doctype_value`: : REQUIRED. String that specifies an allowed value for the -doctype of the requested Verifiable Credential. It MUST be a valid doctype identifier as defined in [@ISO.18013-5]. For a mdoc to satisfy the Credential Query, the value of the `docType` element in the `MobileSecurityObject` structure MUST be equal to the `doctype_value`. +doctype of the requested Verifiable Credential. It MUST be a valid doctype identifier as defined in [@ISO.18013-5]. For an mdoc to satisfy the Credential Query, the value of the `docType` element in the `MobileSecurityObject` structure MUST be equal to the `doctype_value`. ### Parameter in the Claims Query {#mdocs_claims_query} From 5f83d2e6e30436cbd5b3d244d1dad3d961dec7fd Mon Sep 17 00:00:00 2001 From: Gareth Oliver Date: Thu, 16 Jul 2026 13:46:42 -0700 Subject: [PATCH 09/10] Apply suggestion from @fkj Co-authored-by: Frederik Krogsdal Jacobsen --- 1.1/openid-4-verifiable-presentations-1_1.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/1.1/openid-4-verifiable-presentations-1_1.md b/1.1/openid-4-verifiable-presentations-1_1.md index 307fda09..075406c4 100644 --- a/1.1/openid-4-verifiable-presentations-1_1.md +++ b/1.1/openid-4-verifiable-presentations-1_1.md @@ -3250,7 +3250,7 @@ The following is an SD-JWT VC specific parameter in the `meta` parameter in a Cr `vct_values`: : REQUIRED. A non-empty array of strings that specifies allowed values for the type of the requested Verifiable Credential. All elements in the array MUST be valid type identifiers as defined in [@!I-D.ietf-oauth-sd-jwt-vc]. To satisfy the Credential Query, a Credential MUST either have or inherit from a type that is included in the `vct_values` array as defined in [@!I-D.ietf-oauth-sd-jwt-vc]. -The Wallet MUST determine whether a Credential's type satisfies a Credential Query by following these steps: +When a Wallet or Verifier needs to determine whether a Credential's type satisfies a Credential Query, it MUST do so by following these steps: 1. Check if the `vct` in the Credential is contained in the `vct_values` array. If it is, the Credential satisfies the Credential Query. 1. If the `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. If a circular dependency is detected while following the `extends` claims, the Credential does not satisfy the Credential Query. From 958f44d08c0b2eab47e8845e37ff6f51dc4b34d8 Mon Sep 17 00:00:00 2001 From: Gareth Oliver Date: Wed, 5 Aug 2026 10:37:38 -0700 Subject: [PATCH 10/10] Clarify requirements for vct_values in Credential Query --- 1.1/openid-4-verifiable-presentations-1_1.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/1.1/openid-4-verifiable-presentations-1_1.md b/1.1/openid-4-verifiable-presentations-1_1.md index 075406c4..e775fdc3 100644 --- a/1.1/openid-4-verifiable-presentations-1_1.md +++ b/1.1/openid-4-verifiable-presentations-1_1.md @@ -3248,13 +3248,12 @@ The following is a non-normative example of `client_metadata` request parameter The following is an SD-JWT VC specific parameter in the `meta` parameter in a Credential Query as defined in (#credential_query). `vct_values`: -: REQUIRED. A non-empty array of strings that specifies allowed values for the type of the requested Verifiable Credential. All elements in the array MUST be valid type identifiers as defined in [@!I-D.ietf-oauth-sd-jwt-vc]. To satisfy the Credential Query, a Credential MUST either have or inherit from a type that is included in the `vct_values` array as defined in [@!I-D.ietf-oauth-sd-jwt-vc]. +: REQUIRED. A non-empty array of strings that specifies allowed values for the type of the requested Verifiable Credential. All elements in the array MUST be valid type identifiers as defined in [@!I-D.ietf-oauth-sd-jwt-vc]. To satisfy the Credential Query, a Credential MUST be of a type that is included in the `vct_values` array as defined in [@!I-D.ietf-oauth-sd-jwt-vc]. -When a Wallet or Verifier needs to determine whether a Credential's type satisfies a Credential Query, it MUST do so by following these steps: +When a Wallet or Verifier needs to determine whether a Credential's type satisfies a Credential Query, it MUST do so by evaluating if at least one of the following true: -1. Check if the `vct` in the Credential is contained in the `vct_values` array. If it is, the Credential satisfies the Credential Query. -1. If the `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. If a circular dependency is detected while following the `extends` claims, the Credential does not satisfy the Credential Query. -1. If none of the above conditions are met, the Credential does not satisfy the Credential Query. +1. The value of the `vct` claim in the Credential is contained in the `vct_values` array. +1. The `aka_vcts` claim is present and has at least one element that is contained in the `aka_vcts` array. ### Presentation Response