<div dir="ltr"><div dir="ltr"><div dir="ltr">+ Aaron as you mentioned him<br><br>> The reason it was abandoned was that Aaron Parecki and some others noted that using the ID token here for anything other than DPoP-authenticated HTTP requests results in the reuse of the DPoP key in different contexts, creating a risk of cross-protocol attacks. So for example it would be problematic to do BastionZero-like or SigStore-like things with this ID token. </div><div dir="ltr"><br></div><div>Aaron was on the call we just had, and did not voice his concerns. <br><br>In the security considerations, the key used for key binding MUST be different than the key used in other contexts. This applies equally to a VC based approach.<br>We should also restrict DPoP for access token binding to be independent for id_tokens. <br><br>Cross protocol JWT confusion is a problem for any JWT, including the VC approach -- and requires a verifier to correctly verify the JWTs they receive.<br><br>> zero OP interest <br><br>We have deployed this draft at Hellō for people to experiment with. My interest in a VC based token that is not an id_token is low. There is little understanding and machinery for VCs today. Building on the id_token is much more palatable than creating brand new tokens.<br><br>I'm responding to George's email right after this which may provide more context on the id_token focus.<br><br>/Dick<br><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Sep 5, 2025 at 9:46 PM Richard Barnes <<a href="mailto:rlb@ipv.sx" target="_blank">rlb@ipv.sx</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hi Mike,</div><div><br></div><div>To be blunt: The relationship between the two drafts is that the approach in the Key Binding draft was considered and rejected by our author team before we put forward the VC-based draft.</div><div><br></div><div>I totally understand how the authors arrived at this scheme; it's one I have proposed myself before. The reason it was abandoned was that Aaron Parecki and some others noted that using the ID token here for anything other than DPoP-authenticated HTTP requests results in the reuse of the DPoP key in different contexts, creating a risk of cross-protocol attacks. So for example it would be problematic to do BastionZero-like or SigStore-like things with this ID token. The reason we went the VC route is that VC are intended to be used in different protocols, and you can mint multiple VCs to support different applications.</div><div><br></div><div>You are correct that at this point the UserInfo VC draft is basically abandoned. But only because there was basically zero OP interest in implementing as far as I could tell. I still think the approach is correct, and the use cases are valuable (including Ethan and Dick's use cases). If OPs were interested, I would be excited to consume it in Webex.</div><div><br></div><div>If there's new energy here, I would propose we revive the VC draft and rebase it on the latest VCI stuff, probably the simpler SD-JWT-VC stuff out of OAuth rather than anything from W3C.</div><div><br></div><div>Cheers,</div><div>--Richard</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Sep 4, 2025 at 2:46 PM Michael Jones <<a href="mailto:michael_b_jones@hotmail.com" target="_blank">michael_b_jones@hotmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
<div lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size:11pt">Dear Morteza, Richard, Pieter, and Kristina,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">I am writing as an OpenID Connect working group chair to ask you what your plans are for the UserInfo VC draft (<a href="https://openid.net/specs/openid-connect-userinfo-vc-1_0.html" target="_blank">https://openid.net/specs/openid-connect-userinfo-vc-1_0.html</a>).
The current draft is over 2 years old and is the -00 draft. Furthermore, I observed that it uses VCDM 1.1, rather than VCDM 2.0 which replaced it.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Is one of you planning to continue working on the draft or should the working group consider it to be inactive?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Part of the context of the question is that Dick Hardt and Ethan Heilman have created the OpenID Connect Key Binding draft (<a href="https://github.com/dickhardt/openid-key-binding" target="_blank">https://github.com/dickhardt/openid-key-binding</a>),
which like your draft, uses key binding to an OpenID Connect issued token – but their draft binds the ID Token, rather than the UserInfo response. The working group is discussing whether to adopt their draft.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">We wanted to understand the relationship between your work and their work before potentially issuing a call for adoption.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Thanks for any information you can provide.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<div style="border-width:1pt medium medium;border-style:solid none none;border-color:rgb(225,225,225) currentcolor currentcolor;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> Openid-specs-ab <<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>>
<b>On Behalf Of </b>Brian Campbell via Openid-specs-ab<br>
<b>Sent:</b> Thursday, September 4, 2025 6:15 AM<br>
<b>To:</b> <a href="mailto:Dick.Hardt@gmail.com" target="_blank">Dick.Hardt@gmail.com</a>; Artifact Binding/Connect Working Group <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Cc:</b> Brian Campbell <<a href="mailto:bcampbell@pingidentity.com" target="_blank">bcampbell@pingidentity.com</a>>; <a href="mailto:ethan.r.heilman@gmail.com" target="_blank">ethan.r.heilman@gmail.com</a><br>
<b>Subject:</b> Re: [Openid-specs-ab] OpenID Connect Key Binding vs OpenID Connect UserInfo Verifiable Credentials<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">I suspect the intent of the homework runs a little deeper. Like perhaps coordinating with the UserInfo Verifiable Credentials authors to see if they are interested in reengaging with the work. Or understanding the rationale for some of
the design decisions made - id token vs. userinfo endpoint vs. credential issuance endpoint being one that seems particularly relevant but just one. <u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Thu, Aug 21, 2025 at 11:39<span style="font-family:Arial,sans-serif"> </span>AM Dick Hardt via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:currentcolor currentcolor currentcolor rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Here is my homework as assigned by the working group chair. :)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">KB = OpenID Connect Key Binding<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">UVC = OpenID Connect UserInfo Verifiable Credentials<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Links to specs at bottom<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><b>Tl;dr:<br>
</b>KB adds the key to an ID Token<br>
UVC creates a verifiable credential with same info, but VC syntax<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">KB does it in one call to OP<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">UVC requires two calls to OP<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><b>Key Bound Token</b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">KB outputs an id_token that includes a `cnf` claim of the public key<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">UVC outputs a verifiable credential with a `did:jwk:ey...` claim<br>
Both include all the same user claims <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><b>Authentication Request</b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- KB uses `dpop` scope as well as `dpop_jkt` parameter<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- UVC uses `userinfo_credential`<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">KB has extra layer of security as `dpop_jkt` provides additional assurance between authentication request and token request<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><br>
<b>Token Request</b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- KB - RP passes DPoP JWT as header <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- UVC has no changes<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><b>Token Response</b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- KB - OP passes back id_token that includes `cnf` claim<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- UVC - OP passes back an access_token as well as c_nonce and c_nonce_expires_in<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">At this point, KB has completed the key binding ... <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><b>Credential Request and Response </b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">UVC continues on <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- RP generates a verifiable credential request and passes it with the access_token as a bearer token to the OP's credential endpoint <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">- OP returns a verifiable credential<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><a href="https://dickhardt.github.io/openid-key-binding/main.html" target="_blank">https://dickhardt.github.io/openid-key-binding/main.html</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><a href="https://github.com/dickhardt/openid-key-binding" target="_blank">https://github.com/dickhardt/openid-key-binding</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><a href="https://openid.net/specs/openid-connect-userinfo-vc-1_0.html" target="_blank">https://openid.net/specs/openid-connect-userinfo-vc-1_0.html</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><br>
<b><i><span style="font-size:10pt;font-family:"Segoe UI",sans-serif;color:rgb(85,85,85);border:1pt windowtext;padding:0in">CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s).
Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.</span></i></b><u></u><u></u></p>
</div>
</div>
</div></blockquote></div>
</blockquote></div>