[Openid-specs-ab] Issue #1232: What is the scope of a signature? (openid/connect)

[tomcjones]

New issue 1232: What is the scope of a signature?
https://bitbucket.org/openid/connect/issues/1232/what-is-the-scope-of-a-signature

Tom Jones:

In the past a singer \(issuer, OP\) was attesting to all of the elements in the document signed. \(subject to the terms of course\). If signed “blobs” are included in a signed document, I propose that the the signer is taking responsibility for all of the attributes in the document **that are not signed by others**.

This issue came up wrt the mDL which is likely to be initiated by a MVD but include covid credentials from an IIS or even a private lab. I don’t believe the MVD is making any statement about the covid creds.

Note also that the expiry date becomes less absolute. As in the case of a passport, it has some extended validity for a year after expiry. Also a mDL my no longer work to authorize driving a car, but still allow you to buy alcohol. Composite docs will have expiry of different attributes at different times.