<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
</head>
<body>
<div name="messageBodySection">
<div dir="auto">Hi Tom,</div>
</div>
<div name="messageReplySection">
<div dir="auto">Am 28. Juli 2023, 20:51 +0200 schrieb Tom Jones <thomasclinganjones@gmail.com>:</div>
<blockquote style="border-left-color: rgb(26, 188, 156); margin: 5px; padding-left: 10px; border-left-width: thin; border-left-style: solid;"><span style="color:rgba(0, 0, 0, 0.9);background-color:#f2f2f2;font-family:-apple-system, system-ui, system-ui, Segoe UI, Roboto, Helvetica Neue, Fira Sans, Ubuntu, Oxygen, Oxygen Sans, Cantarell, Droid Sans, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Lucida Grande, Helvetica, Arial, sans-serif;font-size: 14px">I have a fundamental problem with</span> <span style="font-family:Noto Sans, Arial, Helvetica, sans-serif">OpenID for Verifiable Presentations over BLE flow diagrams.</span>It seems that the user wallet identifies itself to the verifier before the user knows the identifier of the verifier.<br />
There is a statement about the advertisement "5.2 <span style="font-family:Noto Sans, Arial, Helvetica, sans-serif;font-size: 14px">The QR Code contains the name and the ephemeral public key of the Verifier."</span>Is the presumption that the physical context of the QR code is sufficient?.<br />
It seems that anyone could go about pasting QR codes in any place that lead to attack sites.</blockquote>
<div dir="auto">The text in section 5 is still a bit misleading (esp. re encrypted:wallet provider clientid and encrypted:authentication context) and the information about verifier authentication is missing in the current revision. <br />
<br />
The fundamental idea of the draft is to use the messages defined in the OID4VP base spec and send them over a secure BLE connect. The description of the actual OID4VP message exchange starts at Section 7. <br />
<br />
<span style="color:var(--textColor);background-color:var(--backgroundColor)">Section 7.2 states "</span>The Request contains a signed request object containing the parameters as defined in [OpenID4VP].“ but<span style="color:var(--textColor);background-color:var(--backgroundColor)"> does not </span><span style="background-color:var(--backgroundColor)">explain</span><span style="color:var(--textColor);background-color:var(--backgroundColor)"> the rest.</span><br />
<br />
T<span style="color:var(--textColor);background-color:var(--backgroundColor)">he wallet can authenticate the verifier using this signed OID4VP request object, that is sent through the BLE connection. </span><br />
<br />
<span style="color:var(--textColor);background-color:var(--backgroundColor)">It is still an early draft, we will improve the text. So thanks for raising that issue. </span><br />
<br />
<span style="background-color:var(--backgroundColor)">best</span><span style="color:var(--textColor);background-color:var(--backgroundColor)"> regards,</span><br />
<span style="color:var(--textColor);background-color:var(--backgroundColor)">Torsten. </span><br /></div>
<blockquote style="border-left-color: rgb(26, 188, 156); margin: 5px; padding-left: 10px; border-left-width: thin; border-left-style: solid;"><br />
I am creating some BLE code to see if section 5.1 is any better. It is not clear from the docs that i have what information is in the ad.<br />
..tomj<br />
<br />
<br />
On Tue, Apr 25, 2023 at 4:37 AM Torsten Lodderstedt via Openid-specs-ab <<a href="https://mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<br />
<blockquote style="border-left-color: rgb(230, 126, 34); margin: 5px; padding-left: 10px; border-left-width: thin; border-left-style: solid;">Hi all, <br />
<br />
the initial revision of the OpenID for Verifiable Presentations over BLE draft is now available <a href="https://openid.bitbucket.io/connect/openid-4-verifiable-presentations-over-ble-1_0.html" target="_blank">https://openid.bitbucket.io/connect/openid-4-verifiable-presentations-over-ble-1_0.html</a>.<br />
<br />
Please review the specification and give feedback either here on the list or through issues at <a href="https://bitbucket.org/openid/connect/issues?status=new&status=open&status=submitted&is_spam=!spam" target="_blank">https://bitbucket.org/openid/connect/issues?status=new&status=open&status=submitted&is_spam=!spam</a>. <br />
<br />
Thanks in advance, <br />
Torsten. <br />
_______________________________________________<br />
Openid-specs-ab mailing list<br />
<a href="https://mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a></blockquote>
</blockquote>
</div>
</body>
</html>