[Openid-specs-ab] OpenID4VCI: JSON-LD processing of request and metadata fields

[Judith Kahrer]

Hi David,
Thanks for sharing your point of view and confirming some assumptions. I
fully agree with you. The statement is not my opinion but was a quote from
the current specification that did NOT refer to any verifiable credential
but required JSON-LD processing for a metadata field and request parameter
(see E.1.3.2
<https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#server_metadata_ldp_vc>
and
E.1.3.3
<https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-e.1.3.3>
in
Appendix E of the current draft). I also think, that metadata and protocol
defined in OpenID4VCI should be pure JSON and not JSON-LD. Consequently,
the requirements regarding JSON-LD processing for credentials_supported and
credential_definition should be removed as those are part of the metadata
and request respectively. They are not, once more, any credential (such can
only be found in credential responses).
Following that, any @context-field in an object that is NOT a credential,
should be removed as well. I'll open an issue with suggested changes.

Regards, Judith

On Sat, Feb 18, 2023, 08:59 David Chadwick via Openid-specs-ab <
openid-specs-ab at lists.openid.net> wrote:

> Hi Judith
>
> thankyou for your excellent response. I agree with most of what you say,
> but not the following "This object MUST be processed using full JSON-LD
> processing". It is my understanding that the protocol and metadata are pure
> JSON and should not be referred to as JSON-LD. Thus the current text is
> wrong if it either states or implies this. OTOH, the retrieved object may
> be a W3C Conformant VC (in which case it MUST contain the @context
> property) but this does not mean that the wallet has to perform any JSON LD
> processing on it. On the contrary pure JSON processing is sufficient if the
> semantics of JSON-LD are not required and JWT proofs are being used (I am
> not sure if the same is true for LD proofs). Interworking between JSON-LD
> processing and pure JSON processing issuers and wallets has already been
> adequately demonstrated (in the JFF plugfest). So I do not believe having
> an @context property in a credential is an issue that OID4VCI should be
> concerned with. Personally I do not think that our protocol should be
> supporting non-standard credential formats (i.e. any type of JWT) and
> should only support ISO mdl and W3C VCs either JWT or LD-proofed (but I
> think I am in a minority here). However, the W3C VC F2F this week has now
> agreed that verifiable credentials must have an @context property. Other
> serialisations that do not contain an @context property may be specified,
> but mapping rules from these to W3C VCs must be defined for them to be
> accepted in the W3C VC v2 recommendation. The mapping may be one way (from
> serialisation X to W3C VCs) or bi-directional and lossless. However, no
> examples of serialisation X have been fully specified so far, so until they
> are I do not think OID4VCI should include them (which currently it does).
>
> Kind regards
>
> David
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20230218/62a7fe84/attachment.html>