<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div><div>Hi all</div><div><br></div><div>Draft 16 of OID4VCI has been published:</div><div><br></div><div><span style="caret-color: rgb(0, 104, 218); color: rgb(0, 104, 218); text-decoration: underline;">https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-16.html</span></div><div><span style="caret-color: rgb(0, 104, 218); color: rgb(0, 104, 218); text-decoration: underline;"><br></span></div><div>As per my email earlier in the week, and the discussion on yesterday’s WG call, the reason for publishing we start public review on.</div><div><br></div><div>Due to a last minute discussion on the presentation during issuance pull request ( <a href="https://github.com/openid/OpenID4VCI/pull/509">https://github.com/openid/OpenID4VCI/pull/509</a> ) this is not included into this revision, but the working group will continue discussion and may decide to publish a new version containing this and update the version under public review.</div><div><br></div><div>Change log since draft 15 is:</div></div><div><br></div><div><br></div><div><ul class="compact" style="padding: 0px; margin: 0px 0px 1em 2em; line-height: normal; caret-color: rgb(34, 34, 34); color: rgb(34, 34, 34); font-family: "Noto Sans", Arial, Helvetica, sans-serif; font-size: 14px;"><li class="compact" id="appendix-K-3.1" style="margin: 0px 0px 0.25em;">add new mechanism for signed Credential Issuer metadata</li><li class="compact" id="appendix-K-3.2" style="margin: 0px 0px 0.25em;">remove <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">signed_metadata</code> from Credential Issuer metadata</li><li class="compact" id="appendix-K-3.3" style="margin: 0px 0px 0.25em;">move proof type section to the Annex for readability, add some introduction and fix text in Section 8.1</li><li class="compact" id="appendix-K-3.4" style="margin: 0px 0px 0.25em;">move <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">claims</code> and <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">display</code> into <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">credential_metadata</code> and allow for credential-format specific mechanisms to override it</li><li class="compact" id="appendix-K-3.5" style="margin: 0px 0px 0.25em;">remove the option to use <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">format</code> from <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">authorization_details</code> in the Authorization Request</li><li class="compact" id="appendix-K-3.6" style="margin: 0px 0px 0.25em;">add implementation consideration about pre-final specs</li><li class="compact" id="appendix-K-3.7" style="margin: 0px 0px 0.25em;">move issuance pending from Deferred Credential Error Response to Deferred Credential Response</li><li class="compact" id="appendix-K-3.8" style="margin: 0px 0px 0.25em;">move the interval parameter from Deferred Credential Error Response to Credential Response</li><li class="compact" id="appendix-K-3.9" style="margin: 0px 0px 0.25em;">rework the Credential Response text, fix immediate issuance to have HTTP 200 status code</li><li class="compact" id="appendix-K-3.10" style="margin: 0px 0px 0.25em;">adds an option to return DPoP Nonce from the Nonce Endpoint</li><li class="compact" id="appendix-K-3.11" style="margin: 0px 0px 0.25em;">change Cryptographic Holder Binding to Cryptographic Key Binding</li><li class="compact" id="appendix-K-3.12" style="margin: 0px 0px 0.25em;">add privacy considerations for the client_id used with wallet attestations</li><li class="compact" id="appendix-K-3.13" style="margin: 0px 0px 0.25em;">deprecate the proof parameter in the credential request</li><li class="compact" id="appendix-K-3.14" style="margin: 0px 0px 0.25em;">URL to retrieve Credential Issuer Metadata now requires <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">.well-known/openid-credential-issuer</code> to be added at start of path to align with IETF requirements</li><li class="compact" id="appendix-K-3.15" style="margin: 0px 0px 0.25em;">explicitly state that various arrays in metadata/requests need to be non-empty</li><li class="compact" id="appendix-K-3.16" style="margin: 0px 0px 0.25em;">add missing request for media type registration of key-attestation+jwt in IANA Considerations</li><li class="compact" id="appendix-K-3.17" style="margin: 0px 0px 0.25em;">rename keyattestation+jwt to key-attestation+jwt</li><li class="compact" id="appendix-K-3.18" style="margin: 0px 0px 0.25em;">set key attestation nonce to c_nonce value for proof types with key attestations</li><li class="compact" id="appendix-K-3.19" style="margin: 0px 0px 0.25em;">use mdoc as a term, instead of mDL</li><li class="compact" id="appendix-K-3.20" style="margin: 0px 0px 0.25em;">clarify mdoc as a credential format can be used with non-mDL use-cases</li><li class="compact" id="appendix-K-3.21" style="margin: 0px 0px 0.25em;">remove the Dynamic Credential Request section and associated content</li><li class="compact" id="appendix-K-3.22" style="margin: 0px 0px 0.25em;">rename ldp_vp to di_vp</li><li class="compact" id="appendix-K-3.23" style="margin: 0px 0px 0.25em;">require proof_signing_alg_values_supported to match key proof algorithms</li><li class="compact" id="appendix-K-3.24" style="margin: 0px 0px 0.25em;">Align claims path query for ISO mdocs with JSON-based credentials</li><li class="compact" id="appendix-K-3.25" style="margin: 0px 0px 0.25em;">define <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">proof_signing_alg_values_supported</code> for attestation proof type</li><li class="compact" id="appendix-K-3.26" style="margin: 0px 0px 0.25em;">make type and values for credential_signing_alg_values_supported format specific</li><li class="compact" id="appendix-K-3.27" style="margin: 0px 0px 0.25em;">make type and values for proof_signing_alg_values_supported proof type specific</li><li class="compact" id="appendix-K-3.28" style="margin: 0px 0px 0.25em;">change algorithm identifiers for credential_signing_alg_values_supported to COSE algorithm values for mdocs</li><li class="compact" id="appendix-K-3.29" style="margin: 0px 0px 0.25em;">add Credential Request encryption and Zip support</li><li class="compact" id="appendix-K-3.30" style="margin: 0px 0px 0.25em;">request encryption is now required when response encryption is used</li><li class="compact" id="appendix-K-3.31" style="margin: 0px 0px 0.25em;">clarify an access token is not required at the nonce endpoint</li><li class="compact" id="appendix-K-3.32" style="margin: 0px 0px 0.25em;">clarify that credential_request_denied should be treated as non-recoverable and the request not retried</li><li class="compact" id="appendix-K-3.33" style="margin: 0px 0px 0.25em;">clarify meaning of absence of <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">cryptographic_binding_methods_supported</code> / <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">proof_types_supported</code></li><li class="compact" id="appendix-K-3.34" style="margin: 0px 0px 0.25em;">cleanup language around c_nonce</li><li class="compact" id="appendix-K-3.35" style="margin: 0px 0px 0.25em;">make OAuth2 security recommendations more actionable, including recommending use of FAPI2 Security Profile</li><li class="compact" id="appendix-K-3.36" style="margin: 0px 0px 0.25em;">add <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">unknown_credential_configuration</code> and <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">unknown_credential_identifier</code> errors</li><li class="compact" id="appendix-K-3.37" style="margin: 0px 0px 0.25em;">remove no-longer applicable <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">unsupported_credential_type</code> and <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">unsupported_credential_format</code>errors</li><li class="compact" id="appendix-K-3.38" style="margin: 0px 0px 0.25em;">issuer value in metadata must be validated</li><li class="compact" id="appendix-K-3.39" style="margin: 0px 0px 0.25em;">improve intro text about key attestations</li><li class="compact" id="appendix-K-3.40" style="margin: 0px 0px 0.25em;">clarify that number of issued credentials is related to number of keys proofed or attested</li><li class="compact" id="appendix-K-3.41" style="margin: 0px 0px 0.25em;">update OpenID Federation reference to draft 43</li><li class="compact" id="appendix-K-3.42" style="margin: 0px 0px 0.25em;">"Multiple credential issuance" section renamed to "Batch credential issuance" and made editorial improvements to it</li><li class="compact" id="appendix-K-3.43" style="margin: 0px 0px 0.25em;">clarify that when using scopes, if <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">credential_identifiers</code> are returned from the token endpoint they are inside <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">authorization_details</code></li><li class="compact" id="appendix-K-3.44" style="margin: 0px 0px 0.25em;">clarity that <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">x5c</code>, <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">kid</code> and <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">jwk</code> in the jwt proof type are mutually exclusive</li><li class="compact" id="appendix-K-3.45" style="margin: 0px 0px 0.25em;">clarify what checks wallet performs after receiving credential offer</li><li class="compact" id="appendix-K-3.46" style="margin: 0px 0px 0.25em;">editorial improvements to tx_code language</li></ul><div><font color="#222222" face="Noto Sans, Arial, Helvetica, sans-serif"><span style="caret-color: rgb(34, 34, 34); font-size: 14px;"><br></span></font></div></div><div><font color="#222222" face="Noto Sans, Arial, Helvetica, sans-serif"><span style="caret-color: rgb(34, 34, 34); font-size: 14px;">Thanks</span></font></div><div><font color="#222222" face="Noto Sans, Arial, Helvetica, sans-serif"><span style="caret-color: rgb(34, 34, 34); font-size: 14px;"><br></span></font></div><div><font color="#222222" face="Noto Sans, Arial, Helvetica, sans-serif"><span style="caret-color: rgb(34, 34, 34); font-size: 14px;">Joseph</span></font></div><div><font color="#222222" face="Noto Sans, Arial, Helvetica, sans-serif"><span style="caret-color: rgb(34, 34, 34); font-size: 14px;"><br></span></font></div></body></html>