Skip to content

Add an option for a Wallet to configure supported Proof types#517

Open
dzarras wants to merge 4 commits into
eu-digital-identity-wallet:release/0.12.0from
niscy-eudiw:feat/proof-options
Open

Add an option for a Wallet to configure supported Proof types#517
dzarras wants to merge 4 commits into
eu-digital-identity-wallet:release/0.12.0from
niscy-eudiw:feat/proof-options

Conversation

@dzarras
Copy link
Copy Markdown
Contributor

@dzarras dzarras commented Apr 15, 2026

This PR add a new option called proofs in OpenId4VCIConfig as a means for a Wallet to configure the supported Attestation/Proofs.

Current a Wallet can configuration the following:

  1. Whether non-device-bound attestations are supported;
  2. Whether device-bound attestations are supported; For device-bound attestations a Wallet can also:
    1. Configure which JWS Algorithms are supported for the Proofs;
    2. Configure which Proof Types are supports; Currently the supports Proof Types are:
      1. JWT Proofs without Key Attestation;
      2. JWT Proofs with Key Attestation;
      3. Attestation Proofs;

The new configuration option is taken into account just before generating the Proofs for the Credential Request.
Before generating the Proofs for the Credential Request, we check for the selected Credential Configuration:

  • If it's a non-device-bound attestation, whether Wallet supports non-device-bound attestations;
  • If it's a device-bound attestation, whether the Credential Configuration contains any Wallet supported Proof Type. If no match is found, issuance fails;

Closes #508

@dzarras dzarras requested review from babisRoutis and vafeini April 15, 2026 10:59
@dzarras dzarras self-assigned this Apr 15, 2026
@dzarras dzarras added feature New feature or request ETSI 119 472-3 security labels Apr 15, 2026
@dzarras dzarras force-pushed the feat/proof-options branch from 495e0b2 to d439e66 Compare May 6, 2026 10:07
@dzarras dzarras changed the base branch from main to release/0.12.0 May 6, 2026 10:07
@dzarras dzarras added this to the openid4vci-kt v0.12.0 milestone May 6, 2026
@dzarras
Copy link
Copy Markdown
Contributor Author

dzarras commented May 6, 2026

@babisRoutis, @vafeini PR now targets release/0.12.0 and is ready for review.

Comment thread src/main/kotlin/eu/europa/ec/eudi/openid4vci/Config.kt Outdated
Comment thread src/main/kotlin/eu/europa/ec/eudi/openid4vci/Config.kt Outdated
Comment thread src/main/kotlin/eu/europa/ec/eudi/openid4vci/Config.kt Outdated
* @property deviceBound Whether the Wallet supports device-bound attestations, and the Proofs it supports.
*/
data class ProofsConfig(
val supportsNonDeviceBound: Boolean,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please rename it to isNoProofSupported?

The non-device-bound term is not recognizable immediately in a OpenId4VCI context.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Device-bound as a term is used neither in OpenID4VCI nor HAIP.

If we rename the property supportsNonDeviceBound we also have to rename the property deviceBound and the data class DeviceBound as well.

Any ideas/suggestions for the later?

*/
data class DeviceBound(
val algorithms: Set<JWSAlgorithm>?,
val proofs: Set<Proof>,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like the Set approach, but it works

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dzarras Can you please consider #508 (comment)

Let's discuss this offline

@dzarras dzarras force-pushed the feat/proof-options branch from 2df3e0e to 03030b9 Compare May 14, 2026 06:36
@dzarras
Copy link
Copy Markdown
Contributor Author

dzarras commented May 14, 2026

@babisRoutis, @vafeini Rebased against release/0.12.0. Please check again.

@dzarras dzarras requested a review from babisRoutis May 14, 2026 06:36
@dzarras dzarras force-pushed the feat/proof-options branch from 03030b9 to 43ca4af Compare May 14, 2026 10:49
@sonarqubecloud
Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Introduce a configuration option to enforce the use of key_attestation

2 participants