Repository navigation
[OID4VP] Verification keys with .well-known/did.json
#48853
|
Hi Everyone Right now, to verify verifiable presentations, I have the application fetching JWKS from the OIDC JWKS endpoint - the knowledge that these keys will verify the SD-JWT credential token or key binding token signatures is implicit. It could be useful to be able to fetch these keys from Thanks |
Replies: 1 comment 1 reply
|
I don’t think For SD-JWT VC, the issuer signature should be verified either via SD-JWT VC issuer metadata, i.e. The KB-JWT's signature is not checked with issuer keys at all but against the public key that is embedded in the credential itself in the |
|
@dominikschlosser Yes, in fact I don't use issuer keys but the embedded public keys to verify KBs, apologies, not sure why I mentioned KBs. Great, I missed the info about Thanks |
I don’t think
.well-known/did.jsonis the right discovery mechanism here. That endpoint exists fordid:web, but OID4VCI/OID4VP do not define a generic DID document endpoint for credential issuer key discovery.For SD-JWT VC, the issuer signature should be verified either via SD-JWT VC issuer metadata, i.e.
.well-known/jwt-vc-issuerwith jwks/jwks_uri, or via the cert in thex5c-header (which then must be checked against a pre-configured cert / trust list).In HAIP, the
x5c-method is mandatory.The KB-JWT's signature is not checked with issuer keys at all but against the public key that is embedded in the credential itself in the
cnf-claim.