<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><meta http-equiv="content-type" content="text/html; charset=us-ascii"><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><meta http-equiv="content-type" content="text/html; charset=us-ascii"><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>Hi all</div><div><br></div><div>Draft 04 of HAIP has been published:</div><div><br></div><div><a href="https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0-04.html">https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0-04.html</a></div><div></div><div><br></div><div>The reason for publishing this is it’s been quite a while since we last published a numbered draft and there’s a desire to have a link pointing to a stable version that external orgs can use.</div><div><br></div><div>Change log is:</div><div><br></div><div><ul class="compact" style="padding: 0px; margin: 0px 0px 1em 2em; line-height: normal; caret-color: rgb(34, 34, 34); color: rgb(34, 34, 34); font-family: "Noto Sans", Arial, Helvetica, sans-serif; font-size: 14px;"><li class="compact" id="appendix-D-3.1" style="margin: 0px 0px 0.25em;">update etsi tl and DC API references</li><li class="compact" id="appendix-D-3.2" style="margin: 0px 0px 0.25em;">update VP & VCI references to be to 1.0 Final</li><li class="compact" id="appendix-D-3.3" style="margin: 0px 0px 0.25em;">add separate custom url schemes for issuance and presentation to replace the haip:// scheme</li><li class="compact" id="appendix-D-3.4" style="margin: 0px 0px 0.25em;">support for haip-vp:// and haip-vci:// custom url schemes is now an ecosystem decision</li><li class="compact" id="appendix-D-3.5" style="margin: 0px 0px 0.25em;">allow ecosystems the option to use key attestations other than those defined in Annex D of <span style="position: relative;">[<a href="file:///Users/joseph/Documents/openid-repos/publication/digital-credentials-protocols/openid4vc-high-assurance-interoperability-profile-1_0-04.html#OIDF.OID4VCI" class="cite xref" style="text-decoration: none; z-index: 2; color: rgb(34, 34, 238);">OIDF.OID4VCI</a>]</span> in some cases</li><li class="compact" id="appendix-D-3.6" style="margin: 0px 0px 0.25em;">clarify nonce endpoint must be present when cryptographic_binding_methods_supported is</li><li class="compact" id="appendix-D-3.7" style="margin: 0px 0px 0.25em;">remove various requirements around claims present in SD-JWT VC as upstream spec covers them</li><li class="compact" id="appendix-D-3.8" style="margin: 0px 0px 0.25em;">require ephemeral encryption keys in VP</li><li class="compact" id="appendix-D-3.9" style="margin: 0px 0px 0.25em;">add note that lower assurance credentials can also be conveyed using this profile</li><li class="compact" id="appendix-D-3.10" style="margin: 0px 0px 0.25em;">add note on verifier certificate profiling</li><li class="compact" id="appendix-D-3.11" style="margin: 0px 0px 0.25em;">added support for credentials without cryptographic holder binding</li><li class="compact" id="appendix-D-3.12" style="margin: 0px 0px 0.25em;">mandate support for aki trusted_authorities method</li><li class="compact" id="appendix-D-3.13" style="margin: 0px 0px 0.25em;">remove presentation exchange reference since it was removed in openid4vp</li><li class="compact" id="appendix-D-3.14" style="margin: 0px 0px 0.25em;">Authorization Server and Credential Issuer must support metadata</li><li class="compact" id="appendix-D-3.15" style="margin: 0px 0px 0.25em;">x509_san_dns & verifier_attestations client id prefixes are no longer permitted, x509_hash must be used</li><li class="compact" id="appendix-D-3.16" style="margin: 0px 0px 0.25em;">x.509 certificates are now the mandatory mechanism for SD-JWT VC issuer key resolution</li><li class="compact" id="appendix-D-3.17" style="margin: 0px 0px 0.25em;"><code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">x5c</code> header in Status List Token must be present</li><li class="compact" id="appendix-D-3.18" style="margin: 0px 0px 0.25em;">clarify that Wallet Attestations must not contain linkable information.</li><li class="compact" id="appendix-D-3.19" style="margin: 0px 0px 0.25em;">add signed Issuer Metadata</li><li class="compact" id="appendix-D-3.20" style="margin: 0px 0px 0.25em;">require key attestation for OpenID4VCI</li><li class="compact" id="appendix-D-3.21" style="margin: 0px 0px 0.25em;">clarify text regarding mdoc specific parameters</li><li class="compact" id="appendix-D-3.22" style="margin: 0px 0px 0.25em;">add small note that establishing trust in and retrieving root certs is out scope</li><li class="compact" id="appendix-D-3.23" style="margin: 0px 0px 0.25em;">update wording from Client Identifier Scheme to Client Identifier Prefix #182</li><li class="compact" id="appendix-D-3.24" style="margin: 0px 0px 0.25em;">fix reference to ARF #177</li><li class="compact" id="appendix-D-3.25" style="margin: 0px 0px 0.25em;">remove old link in section 8 & clarify a note on claim based binding in OpenID4VP in HAIP #183</li><li class="compact" id="appendix-D-3.26" style="margin: 0px 0px 0.25em;">Clarify clause 4.1 statement #169</li><li class="compact" id="appendix-D-3.27" style="margin: 0px 0px 0.25em;">add a list of all specifications being profiled #145</li><li class="compact" id="appendix-D-3.28" style="margin: 0px 0px 0.25em;">say something about DPoP nonces</li><li class="compact" id="appendix-D-3.29" style="margin: 0px 0px 0.25em;">refactor to separate generic and SD-JWT clauses</li><li class="compact" id="appendix-D-3.30" style="margin: 0px 0px 0.25em;">add support for ISO mdoc isssuance</li><li class="compact" id="appendix-D-3.31" style="margin: 0px 0px 0.25em;">add support for ISO mdoc when using redirect-based OID4VP</li><li class="compact" id="appendix-D-3.32" style="margin: 0px 0px 0.25em;">remove requirement to support batch endpoint (it was removed from OID4VP)</li><li class="compact" id="appendix-D-3.33" style="margin: 0px 0px 0.25em;">remove SIOPv2 (webauthn is now the recommended way to handle pseudonymous login)</li><li class="compact" id="appendix-D-3.34" style="margin: 0px 0px 0.25em;">prohibit self-signed certificates for signing with <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">x509_hash</code></li><li class="compact" id="appendix-D-3.35" style="margin: 0px 0px 0.25em;">trust anchor certificates must not be included in <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">x5c</code> headers</li></ul><br class="Apple-interchange-newline"></div><div><br></div><div>Thanks</div><div><br></div><div>Joseph</div><div><br></div></div></div></body></html>