<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Dear Morteza, Richard, Pieter, and Kristina,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I am writing as an OpenID Connect working group chair to ask you what your plans are for the UserInfo VC draft (<a href="https://openid.net/specs/openid-connect-userinfo-vc-1_0.html">https://openid.net/specs/openid-connect-userinfo-vc-1_0.html</a>).
The current draft is over 2 years old and is the -00 draft. Furthermore, I observed that it uses VCDM 1.1, rather than VCDM 2.0 which replaced it.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Is one of you planning to continue working on the draft or should the working group consider it to be inactive?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Part of the context of the question is that Dick Hardt and Ethan Heilman have created the OpenID Connect Key Binding draft (<a href="https://github.com/dickhardt/openid-key-binding">https://github.com/dickhardt/openid-key-binding</a>),
which like your draft, uses key binding to an OpenID Connect issued token – but their draft binds the ID Token, rather than the UserInfo response. The working group is discussing whether to adopt their draft.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">We wanted to understand the relationship between your work and their work before potentially issuing a call for adoption.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks for any information you can provide.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Openid-specs-ab <openid-specs-ab-bounces@lists.openid.net>
<b>On Behalf Of </b>Brian Campbell via Openid-specs-ab<br>
<b>Sent:</b> Thursday, September 4, 2025 6:15 AM<br>
<b>To:</b> Dick.Hardt@gmail.com; Artifact Binding/Connect Working Group <openid-specs-ab@lists.openid.net><br>
<b>Cc:</b> Brian Campbell <bcampbell@pingidentity.com>; ethan.r.heilman@gmail.com<br>
<b>Subject:</b> Re: [Openid-specs-ab] OpenID Connect Key Binding vs OpenID Connect UserInfo Verifiable Credentials<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">I suspect the intent of the homework runs a little deeper. Like perhaps coordinating with the UserInfo Verifiable Credentials authors to see if they are interested in reengaging with the work. Or understanding the rationale for some of
the design decisions made - id token vs. userinfo endpoint vs. credential issuance endpoint being one that seems particularly relevant but just one. <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Thu, Aug 21, 2025 at 11:39<span style="font-family:"Arial",sans-serif"> </span>AM Dick Hardt via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Here is my homework as assigned by the working group chair. :)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">KB = OpenID Connect Key Binding<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">UVC = OpenID Connect UserInfo Verifiable Credentials<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Links to specs at bottom<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>Tl;dr:<br>
</b>KB adds the key to an ID Token<br>
UVC creates a verifiable credential with same info, but VC syntax<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">KB does it in one call to OP<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">UVC requires two calls to OP<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>Key Bound Token</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">KB outputs an id_token that includes a `cnf` claim of the public key<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">UVC outputs a verifiable credential with a `did:jwk:ey...` claim<br>
Both include all the same user claims <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>Authentication Request</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- KB uses `dpop` scope as well as `dpop_jkt` parameter<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- UVC uses `userinfo_credential`<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">KB has extra layer of security as `dpop_jkt` provides additional assurance between authentication request and token request<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
<b>Token Request</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- KB - RP passes DPoP JWT as header <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- UVC has no changes<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>Token Response</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- KB - OP passes back id_token that includes `cnf` claim<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- UVC - OP passes back an access_token as well as c_nonce and c_nonce_expires_in<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">At this point, KB has completed the key binding ... <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>Credential Request and Response </b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">UVC continues on <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- RP generates a verifiable credential request and passes it with the access_token as a bearer token to the OP's credential endpoint <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">- OP returns a verifiable credential<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><a href="https://dickhardt.github.io/openid-key-binding/main.html" target="_blank">https://dickhardt.github.io/openid-key-binding/main.html</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://github.com/dickhardt/openid-key-binding" target="_blank">https://github.com/dickhardt/openid-key-binding</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://openid.net/specs/openid-connect-userinfo-vc-1_0.html" target="_blank">https://openid.net/specs/openid-connect-userinfo-vc-1_0.html</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><br>
<b><i><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:#555555;border:none windowtext 1.0pt;padding:0in">CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s).
Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.</span></i></b><o:p></o:p></p>
</div>
</body>
</html>