[Openid-specs-ab] Issue #1624: Introduction text ambituity (openid/connect)

Nat issues-reply at bitbucket.org
Mon Aug 29 20:46:06 UTC 2022


New issue 1624: Introduction text ambituity
https://bitbucket.org/openid/connect/issues/1624/introduction-text-ambituity

Nat Sakimura:

Currently, it states: 

> Verifiable Credentials are very similar to identity assertions, like ID Tokens in OpenID Connect, in that they allow an Issuer to assert End-User claims. However, in contrast to the identity assertions, a verifiable Credential follows a pre-defined schema \(the Credential type\) and is typically bound to key material allowing the End-User to prove the legitimate possession of the Credential. This allows secure direct presentation of the Credential from the End-User to the RP, without involvement of the Credential issuer. This specification caters for those differences.

Is “verifiable Credential” always associated with JSON Schema? It just says “pre-defined schema”, and it is not clear. ID Token is not a free format and has a certain schema but does not have JSON Schema so if you mean “JSON Schema” it is correct. If it means a more general schema, the sentence is false. 

Also “This allows” is a bit ambiguous. It is better to spell it out as “The binding to the key allows”.




More information about the Openid-specs-ab mailing list