Skip to content

mdoc & SD-JWT VC 'must' requirements for status list are very different #374

Description

@jogu

https://openid.github.io/OpenID4VC-HAIP/openid4vc-high-assurance-interoperability-profile-1_1-wg-draft.html#name-ietf-sd-jwt-vc-profile has a bunch of requirements for status list, e.g.:

The public key used to validate the signature on the Status List Token defined in [I-D.ietf-oauth-status-list] MUST be included in the x5c JOSE header of the Token

Each Credential MUST have its own unique, unpredictable status list index

These requirements only apply to SD-JWT - for mdoc we just say:

The Credential Issuer MAY include the MSO revocation mechanism in the issued mdoc. When doing so, it MUST use one of the mechanisms defined in ISO/IEC 18013-5 ([ISO.18013-5.second.edition]).

which doesn't say anything on either of the two above topics. For 'Each Credential MUST have its own unique, unpredictable status list index' - whereas the base token list IETF draft has that as a 'SHOULD'.

This ends up with a weird asymmetry that is probably unexpected - when testing issuers, an SD-JWT VC issuer that reuses status list indexes will fail and can't be certified, but a mdoc issue that reuses status list indexes just gets a 'warning' and can be certified.

I'm not really sure what to do about that. We may just have to leave it as a weird oddity, unless ISO tighten up the text in -5 2nd edition (I've suggested they look into it).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions