Informational: Why individual Input Descriptor IDs are necessary

[csuwildcat]

From @JaceHensley:

Let's use a simpler example.

This is our PD, it is requesting a VC that has the property foo.bar.baz and it must be 42 or greater. Literally doesn't care about the schema or type of the VC, just wants one with foo.bar.baz of 42 or greater.

{
  "id": "32f54163-7166-48f1-93d8-ff217bdb0653",
  "input_descriptors": [
    {
      "id": "foobarbaz_input",
      "schema": [{ "uri": "..." }],
      "group": ["A"],
      "constraints": {
        "fields": [
          {
            "path": ["$.foo.bar.baz"],
            "purpose": "Credential must have property foo.bar.baz and it's value must be greater than 42",
            "filter": {
              "type": "number",
              "minimum": 42
            }
          }
        ]
      }
    }
  ]
}

The holder, if they are a good actor, will use the PD to filter their VCs to select a VC that satisfies the InputDescriptor. But if the holder is a bad actor they'd just submit whatever VC they want.

The PresentationSubmission would like this this:

{
  "@context": ["https://www.w3.org/2018/credentials/v1", "https://identity.foundation/presentation-exchange/submission/v1"],
  "type": ["VerifiablePresentation", "PresentationSubmission"],
  "id": "...",
  "presentation_submission": {
    "id": "...",
    "definition_id": "32f54163-7166-48f1-93d8-ff217bdb0653",
    "descriptor_map": [
      {
        "id": "foobarbaz_input",
        "format": "ldp_vc",
        "path": "$.verifiableCredential[0]"
      }
    ]
  },
  "verifiableCredential": [
    {
      "@context": ["https://www.w3.org/2018/credentials/v1", "..."],
      "type": ["VerifiableCredential", "..."],
      "credentialSubject": {
        // ...
      },
      "foo": {
        "bar": {
          "baz": 42
        }
      },
      "proof": {
        // ...
      }
    }
  ],
  "proof": {
    // ...
  }
}

The verifier would then want to run this PresentationSubmission (and thus it's VCs) against the PD to ensure that the holder did in fact submit a VC that satisfies the PD.

[csuwildcat]

Walkthrough of one major reason you want and need individual Input Descriptors to have IDs (as shown by @JaceHensley in the above example):

1. You have a PE Descriptor that says: "Within your submitted credential (of the 3 you submit), you need to have a credential that matches requirements X, Y, Z, which includes having a number greater than 42 at the foo.bar.baz property"
2. The Holder runs through their credentials and tests them to see if there are any matches for the PE Input Descriptors the Verifier provided, one of which is a filter for the foo.bar.baz property value, which just happens to be described using the JSON Schema conditional syntax.
3. The Holder finds a cred that meets all the requirements, including a value of 75 for the foo.bar.baz property, which is greater than 42. Yay!
4. Now the Holder sends their bundle of 3 creds to the Verifier, who also needs to do the exact same verification of requirements against the submitted creds
5. The Verifier needs to make sure they cred they received contains a value greater than 42 for the foo.bar.baz property, because you can't just trust client inputs. (form data submission 101)
6. The Verifier uses the exact same PE Input Descriptor filter against the cred to determine the cred does indeed contain a value at foo.bar.baz that is greater than 42...but wait, which cred do they test that against?! Good question. Shucks, wouldn't it be neat if the credentials were submitted with an ID to let the Verifier know which PE Input Descriptor a cred is being submitted against, so they know which one to test against? Heck yes it would! Well great, they they're in luck, because that's exactly what the Descriptor/mapping ID does! If you didn't specify the PE Input Descriptor ID against which you are submitting a credential, you would instead have to O(n) loop to hit test all PE Input Descriptors against all the submitted creds, which every programmer reading the spec would laugh and point at. I don't want people laughing and pointing at us, thus we have references that connect each PE Input Descriptor to each credential submitted.

[csuwildcat]

Additional point to consider: as we begin integrating ZKP-based credentials, needless random hit testing and misevaluation of credentials in blind iteration will incur 100x the compute cost. It would behoove us to consider this as we evaluate this question.

[OR13]

Removing id is a bad idea.