Add support for di_vp proofs in credential requests as PoP - #257
Conversation
🦋 Changeset detectedLatest commit: 63d81cf The changes in this PR will be included in the next version bump. This PR includes changesets to release 4 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Signed-off-by: Sebastian Dechant <763247+S3bb1@users.noreply.github.com>
Signed-off-by: Sebastian Dechant <763247+S3bb1@users.noreply.github.com>
| /** | ||
| * The di_vp proof — a W3C Verifiable Presentation | ||
| */ | ||
| vp: Record<string, unknown> |
There was a problem hiding this comment.
To align with the current patterns of this library, if we are digging into this structure, we should add a zod schema for this to ensure type safety at runtime
There was a problem hiding this comment.
Added a zod validator for the vp :)
| // No JSON-LD/VC/DataIntegrity schema exists in this library and it's not this library's job to | ||
| // validate that structure — that's the caller's job via its own stack. Loose passthrough is | ||
| // intentional. |
There was a problem hiding this comment.
I think this kinda makes sense, but verifyCredentialRequestDiVpProof contradicts that.
There was a problem hiding this comment.
yeah the check follows the same patterns as the other proof-types, like the jwt is checking just that the string contains "a" compacted jwt string and not the decoded things. I can remove the comment. WDYT?
TimoGlastra
left a comment
TimoGlastra
left a comment
There was a problem hiding this comment.
Nice! a few small comments
Signed-off-by: Sebastian Dechant <763247+S3bb1@users.noreply.github.com>
Signed-off-by: Sebastian Dechant <763247+S3bb1@users.noreply.github.com>
2 participants
@openid4vc/openid4vcisupports two key proof types for Proof of Possession (PoP) in credential requests:jwtandattestation. The OID4VCI spec also defines a third:di_vp, where the wallet proves key possession by sending a W3C Verifiable Presentation secured with a Data Integrity Proof (e.g.ecdsa-sd-2023,eddsa-2022) instead of a JOSE-signed JWT.This PR Adds support for the OID4VCI
di_vpkey proof type used as an alternative Proof of Possession mechanism alongside the existingjwtandattestationproof types.di_vpis now a recognized proof type in the credential request schemas instead of being silently stripped by Zod.Openid4vciIssuer.verifyCredentialRequestDiVpProof(...), mirroring the existingverifyCredentialRequestJwtProof. It performs structural validation of the required Data Integrity fields before delegating actual cryptographic verification to a new optionalverifyDataIntegrityProofcallback onCallbackContext.