SlideShare a Scribd company logo
1 of 31
Download to read offline
How to Build Interoperable
Decentralized Identity Systems
with OpenID for Verifiable
Credentials
Kristina Yasuda, Microsoft
Dr. Torsten Lodderstedt, yes
Kristina
Identity Standards Architect
Yasuda
Microsoft
Dr. Torsten
Managing Director
Lodderstedt
yes IDP GmbH
Issuer
(Website)
Verifier
(Website)
Wallet
(user’s device,
cloud or hybrid)
Credential
Issuance
Credential
Presentation
User Interactions
● The User presenting the Identity data directly to the Verifier from the Wallet
○ <> In the federated model where Identity data is sent directly from the IdP to the Verifier
● Usually expressed with the flow below:
What is Decentralized Identity?
Verifiable Credentials: Benefits
● End-Users gain more privacy, and portability over their identity
information.
● Cheaper, faster, and more secure identity verification, when transforming
physical credentials into digital ones.
● Universal approach to handle identification, authentication, and
authorization in digital and physical space.
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Why Protocol Layer Interoperability is Crucial.
Credential
Issuance
Credential
Presentation
One entity needs to talk to the large the number of entities, to increase the value of “Decentralized
Identity”.
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
User Interactions
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Issuer
(Website)
Wallet
(user’s device,
cloud or
hybrid)
Verifier
(Website)
Issuer
(Website)
Problems we identified & how we solved them
Problem Solution
A lot of entirely new Protocols. (Hard to get
security right, steep learning curve)
⇒
Building upon currently widely used protocols:
OAuth 2.0 and OpenID Connect. (Secure,
already understood)
No clear winner among Credential Formats ⇒ Designing a Credential Format agnostic protocol
Reluctance to use only DIDs.
No clear winner among DID methods
⇒ Designing a protocol agnostic to the Key
Resolution mechanism. (No need to use DIDs)
Participating entities cannot typically
establish trust upfront, using traditional
mechanisms.
⇒ Flexibility in Trust Management. Third Party
Trust.
OpenID for Verifiable
Credential Issuance
Issuer
(Website)
Verifier
(Website)
Wallet
(user’s device,
cloud or hybrid)
Credential
Issuance
Credential
Presentation
User Interactions
OpenID for Verifiable
Presentations
Self-Issued OP v2
...so here comes OpenID for Verifiable Credentials!
Adoption (selected use-cases)
The European Digital
Identity Wallet Architecture
and Reference Framework[1]
(eIDAS ARF/EUDIW) requires
OID4VCI, OID4VP and
SIOPv2 for online use-cases
NIST National
Cybersecurity Center of
Excellence[2] plans to
implement reference
implementation for OID4VP to
present mdocs/mDL
DIF JWT VC Presentation
Profile[3] uses OID4VP for
request and presentation of
W3C JWT VCs and SIOPv2
for user authentication.
Implementers: Ping Identity,
Microsoft, IBM, Spruce,
Auth0, Gen Digital
[1] https://cloudsignatureconsortium.org/new-eu-eidas-regulation-a-quantum-leap-for-electronic-identity/
[2] https://www.nccoe.nist.gov/projects/digital-identities-mdl
[3] https://identity.foundation/jwt-vc-presentation-profile/#workplace-credential
Open Source libraries
● Walt.id
○ https://github.com/walt-id/waltid-ssikit (Kotlin)
● Sphereon
○ https://github.com/Sphereon-Opensource/SIOP-OpenID4VP (Typescript)
○ https://github.com/Sphereon-Opensource/OpenID4VCI-client (Typescript)
○ https://github.com/Sphereon-Opensource/ssi-sdk (Typescript)
● Microsoft
○ https://github.com/microsoft/VerifiableCredential-SDK-Android (Kotlin)
○ https://github.com/microsoft/VerifiableCredential-SDK-iOS (Swift)
● Spruce
○ https://github.com/spruceid/oidc4vci-rs (Rust)
○ https://github.com/spruceid/oidc4vci-issuer (Rust)
● EBSI
○ https://api-pilot.ebsi.eu/docs/libraries (Javascript)
● Impierce Technologies
○ https://github.com/impierce/openid4vc (Rust)
Let us tell you more about the
protocol
OpenID for Verifiable Credential Issuance
(Highlights)
- It’s an OAuth-protected API (Credential Endpoint at the Resource Server)
- Supports various Security levels (including high security with hardware bound
keys)
- Various business requirements supported (ex. remote and in-person
provisioning)
- Different user-experiences can be achieved (multiple ways to initiate the flow)
- Issuer can check Wallet’s capabilities & Wallet can discover Issuer metadata
Wallet
⓪ Wallet requests & User authorizes
credential issuance
③ Credential is issued
① access token(, refresh token)
② Wallet requests credential issuance
Protocol Flow
Alice
Credential
Issuer
Authorization Code Flow
Pre-Authorized Code Flow
OpenID for Verifiable Presentations (Highlights)
- Designed for high degree of privacy
- Supports various Security levels (e.g. mutual authentication among the
parties)
- Different user-experience can be achieved (same-device and
cross-device)
- Presentation of multiple Credentials supported
- Various Wallet deployment models supported
- All local to a native app
- Cloud Wallet with a backend
- Browser wallet
Same Device Presentation
Cross Device Presentation
Features of OpenID for Verifiable Credentials
1) It is NOT only about W3C Verifiable Credentials.
2) Does not require the usage of DLT (or Blockchain).
3) We are an open standardization community. Implementer’s feedback is
incorporated in an agile and transparent manner.
4) It is modular and flexible to cater for the needs of different legislations and
use-cases.
5) Complemented by active work on profiles to help the developers interoperate.
User Interactions
New additions to the family coming!
OpenID for Verifiable Credential Issuance
Self-Issued OP v2
OpenID for Verifiable Presentations
OpenID for Verifiable Presentations over BLE
Security and Trust in OpenID for Verifiable Credentials
Core specs
additional specs
Certification Suite
High-Assurance Profile
Issuer
(Website)
Verifier
(Website)
Wallet
(user’s device,
cloud or hybrid)
Issue Credentials Present Credentials
High Assurance Profile of
OpenID4VC
with SD-JWT-VC
Profiling OpenID4VC
- OpenID4VC is a framework
- Interoperability requires “profiling”
- Profile defines:
- mandatory to implement elements of the protocols, (e.g., grant types, etc.)
- wallet invocation mechanism (i.e., custom URL scheme)
- authentication requirements for Verifiers and Wallets
- Credential Format(s) with
■ issuer identification and key resolution
■ holder key binding
- Crypto algorithms
High Assurance Profile of OpenID4VC with
SD-JWT-VC
- Interoperability across parties while being privacy preserving and able to
fulfill security and regulatory requirements
- Intended audience
- eIDAS ARF (through OIDF/EC liaison)
- CA DMV wallet
- Basis for OWF project(s)
- Basis for Userinfo Interoperability profile
- IDunion Tech Stack
- GAIN PoC
- Japanese government (Trusted Web project)
- other jurisdictions
- private companies / infrastructure companies
OID4VC High Assurance Interoperability Profile with SD-JWT VC
SIOPv2 OID4VP OID4VCI
custom scheme
crypto suites
custom scheme
credential profile
client id scheme
custom scheme
credential profile
wallet attestation
scheme
Protocols
- Custom Scheme: haip://
- issuer key resolution:
web-based, x509
- Crypto Suites:
P-256(ecp256r1), SHA256
Basic Choices
Attestation
based Client
Authentication
crypto suites
issuer key resolution
Wallet Attestation Scheme
Credential profile: VC-SD-JWT
VC-SD-JWT
JWT/CWT
Statuslist
crypto suites
issuer key resolution
crypto suites
issuer key resolution
Profiles need to:
● fill the extension points
● define mandatory to implement features
OpenID for Verifiable Credential Issuance
- Pre-authorization code flow and authorization code flow are both required.
- Sender-constrained Tokens using DPoP required
- Credential Offer
- for both pre-authorization code flow and authorization code
- custom scheme “haip://” for wallet invocation
- Authorization at Issuer with Pushed Authorization Requests (PAR)
- Wallet Authentication with sender-constrained JWTs
- "scope” parameter to requesting authorization for credential issuance
- Only required endpoint is Credential Endpoint
- Batch Credential Endpoint is required for dual issuance of SD-JWT-VC and mdocs
OpenID for Verifiable Presentations
- custom scheme “haip://” for wallet invocation.
- Response type: “vp_token”.
- Response mode: “direct_post” with redirect_uri.
- Using “request_uri” to send Authorization Request is required.
- Presentation Definition is sent using “presentation_definition” parameter
- Subset of the Presentation Exchange Syntax in order to simplify implementation and
prevent security issues
- Verifier Authentication with
- x.509 Certificates or
- Sender-constrained JWTs
SIOP v2
- custom URL scheme “haip://” for wallet invocation
- subject_syntax_types_supported value MUST be
urn:ietf:params:oauth:jwk-thumbprint
- Verifier Authentication with
- x.509 Certificates or
- Sender-constrained JWTs
Credential Format
- SD-JWT VC with JSON payload (“typ”: “vc+sd-jwt”)
- both compact and JSON serialization
- Definition of mapping to VCDM base media type
- Issuer identification and key resolution
1. Web PKI based: iss=issuer URL used to obtain jwks_uri + key id in the `kid`
JWS header
2. x.509: iss=SAN in x.509 cert + x.509 cert chain in the `x5c` JWS header
- Holder binding:
- `cnf` JWT claim with jwk
- Credential Revocation: Bitmap type style Status list using JWTs
SD-JWT VC
with web PKI based Issuer key resolution
{
"alg": "ES256",
"typ": "vc+sd-jwt",
"kid":"4"
}
{
"iss": "https://credential-issuer.example.com",
"iat": 1516239022,
"exp": 1516247022,
"type": "Identity",
"_sd": [
"UiuRGkTW7e_5UQauGeQRQdF8u3WYevS4Fs0IuB_DgYM",
"tmPlXq0MID-oRXbUNHyoVZrc9Qkm8cwJTohVyOVlUgQ",
"vTz0JI103v4k4pKIloT83Yzi33L1SdZlWBPmsfJBefk"
],
"_sd_alg": "sha-256",
"cnf": {
"jwk": {
"kty": "EC",
"crv": "P-256",
"x":
"TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc",
"y":
"ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ"
}
}
}
Crypto
- For signing and signature validation:
- ES256 algorithm and ECDSA keys using the P-256 (secp256k1)
- As hash algorithm to generate and validate the digests in the SD-JWT VC:
- SHA256
Call to Action:
Implement, Implement, Implement
The information can be found at https://openid.net/openid4vc/
THANK YOU!

More Related Content

What's hot

OpenID for Verifiable Credentials
OpenID for Verifiable CredentialsOpenID for Verifiable Credentials
OpenID for Verifiable CredentialsTorsten Lodderstedt
 
Verifiable Credentials in Self-Sovereign Identity (SSI)
Verifiable Credentials in Self-Sovereign Identity (SSI)Verifiable Credentials in Self-Sovereign Identity (SSI)
Verifiable Credentials in Self-Sovereign Identity (SSI)Evernym
 
Decentralized Identifiers (DIDs): The Fundamental Building Block of Self-Sove...
Decentralized Identifiers (DIDs): The Fundamental Building Block of Self-Sove...Decentralized Identifiers (DIDs): The Fundamental Building Block of Self-Sove...
Decentralized Identifiers (DIDs): The Fundamental Building Block of Self-Sove...SSIMeetup
 
What are Decentralized Identifiers (DIDs)?
What are Decentralized Identifiers (DIDs)?What are Decentralized Identifiers (DIDs)?
What are Decentralized Identifiers (DIDs)?Evernym
 
Verifiable Credentials_Kristina_Identiverse2022_vFIN.pdf
Verifiable Credentials_Kristina_Identiverse2022_vFIN.pdfVerifiable Credentials_Kristina_Identiverse2022_vFIN.pdf
Verifiable Credentials_Kristina_Identiverse2022_vFIN.pdfKristina Yasuda
 
EUDI wallets with OpenID for verifiable credentials (OID4VCI/OID4VP)
EUDI wallets with OpenID for verifiable credentials (OID4VCI/OID4VP)EUDI wallets with OpenID for verifiable credentials (OID4VCI/OID4VP)
EUDI wallets with OpenID for verifiable credentials (OID4VCI/OID4VP)Lal Chandran
 
SSI DIDs VCs 入門資料
SSI DIDs VCs 入門資料SSI DIDs VCs 入門資料
SSI DIDs VCs 入門資料KAYATO SAITO
 
Decentralized Identifier (DIDs) fundamentals deep dive
Decentralized Identifier (DIDs) fundamentals deep diveDecentralized Identifier (DIDs) fundamentals deep dive
Decentralized Identifier (DIDs) fundamentals deep diveSSIMeetup
 
20231109_OpenID_TechNight_OpenID_Federation.pdf
20231109_OpenID_TechNight_OpenID_Federation.pdf20231109_OpenID_TechNight_OpenID_Federation.pdf
20231109_OpenID_TechNight_OpenID_Federation.pdfOpenID Foundation Japan
 
OpenID Connect 4 SSI (at EIC 2021)
OpenID Connect 4 SSI (at EIC 2021)OpenID Connect 4 SSI (at EIC 2021)
OpenID Connect 4 SSI (at EIC 2021)Torsten Lodderstedt
 
Introduction to Self Sovereign Identity - IIW October 2019
Introduction to Self Sovereign Identity - IIW October 2019Introduction to Self Sovereign Identity - IIW October 2019
Introduction to Self Sovereign Identity - IIW October 2019Heather Vescent
 
Digital Identity Wallets: What They Mean For Banks
Digital Identity Wallets: What They Mean For BanksDigital Identity Wallets: What They Mean For Banks
Digital Identity Wallets: What They Mean For BanksEvernym
 
IDA,VC,DID関連仕様 最新情報 - OpenID BizDay #15
IDA,VC,DID関連仕様 最新情報 - OpenID BizDay #15IDA,VC,DID関連仕様 最新情報 - OpenID BizDay #15
IDA,VC,DID関連仕様 最新情報 - OpenID BizDay #15OpenID Foundation Japan
 
Introduction to Self Sovereign Identity
Introduction to Self Sovereign IdentityIntroduction to Self Sovereign Identity
Introduction to Self Sovereign IdentityHeather Vescent
 
What is self-sovereign identity (SSI)?
What is self-sovereign identity (SSI)?What is self-sovereign identity (SSI)?
What is self-sovereign identity (SSI)?Evernym
 
OpenID Connect for W3C Verifiable Credential Objects
OpenID Connect for W3C Verifiable Credential ObjectsOpenID Connect for W3C Verifiable Credential Objects
OpenID Connect for W3C Verifiable Credential ObjectsTorsten Lodderstedt
 
Machine identity - DIDs and verifiable credentials for a secure, trustworthy ...
Machine identity - DIDs and verifiable credentials for a secure, trustworthy ...Machine identity - DIDs and verifiable credentials for a secure, trustworthy ...
Machine identity - DIDs and verifiable credentials for a secure, trustworthy ...SSIMeetup
 
Self-issued OpenID Provider_OpenID Foundation Virtual Workshop
Self-issued OpenID Provider_OpenID Foundation Virtual Workshop Self-issued OpenID Provider_OpenID Foundation Virtual Workshop
Self-issued OpenID Provider_OpenID Foundation Virtual Workshop Kristina Yasuda
 

What's hot (20)

OIDC4VP for AB/C WG
OIDC4VP for AB/C WGOIDC4VP for AB/C WG
OIDC4VP for AB/C WG
 
OpenID Connect 4 SSI
OpenID Connect 4 SSIOpenID Connect 4 SSI
OpenID Connect 4 SSI
 
OpenID for Verifiable Credentials
OpenID for Verifiable CredentialsOpenID for Verifiable Credentials
OpenID for Verifiable Credentials
 
Verifiable Credentials in Self-Sovereign Identity (SSI)
Verifiable Credentials in Self-Sovereign Identity (SSI)Verifiable Credentials in Self-Sovereign Identity (SSI)
Verifiable Credentials in Self-Sovereign Identity (SSI)
 
Decentralized Identifiers (DIDs): The Fundamental Building Block of Self-Sove...
Decentralized Identifiers (DIDs): The Fundamental Building Block of Self-Sove...Decentralized Identifiers (DIDs): The Fundamental Building Block of Self-Sove...
Decentralized Identifiers (DIDs): The Fundamental Building Block of Self-Sove...
 
What are Decentralized Identifiers (DIDs)?
What are Decentralized Identifiers (DIDs)?What are Decentralized Identifiers (DIDs)?
What are Decentralized Identifiers (DIDs)?
 
Verifiable Credentials_Kristina_Identiverse2022_vFIN.pdf
Verifiable Credentials_Kristina_Identiverse2022_vFIN.pdfVerifiable Credentials_Kristina_Identiverse2022_vFIN.pdf
Verifiable Credentials_Kristina_Identiverse2022_vFIN.pdf
 
EUDI wallets with OpenID for verifiable credentials (OID4VCI/OID4VP)
EUDI wallets with OpenID for verifiable credentials (OID4VCI/OID4VP)EUDI wallets with OpenID for verifiable credentials (OID4VCI/OID4VP)
EUDI wallets with OpenID for verifiable credentials (OID4VCI/OID4VP)
 
SSI DIDs VCs 入門資料
SSI DIDs VCs 入門資料SSI DIDs VCs 入門資料
SSI DIDs VCs 入門資料
 
Decentralized Identifier (DIDs) fundamentals deep dive
Decentralized Identifier (DIDs) fundamentals deep diveDecentralized Identifier (DIDs) fundamentals deep dive
Decentralized Identifier (DIDs) fundamentals deep dive
 
20231109_OpenID_TechNight_OpenID_Federation.pdf
20231109_OpenID_TechNight_OpenID_Federation.pdf20231109_OpenID_TechNight_OpenID_Federation.pdf
20231109_OpenID_TechNight_OpenID_Federation.pdf
 
OpenID Connect 4 SSI (at EIC 2021)
OpenID Connect 4 SSI (at EIC 2021)OpenID Connect 4 SSI (at EIC 2021)
OpenID Connect 4 SSI (at EIC 2021)
 
Introduction to Self Sovereign Identity - IIW October 2019
Introduction to Self Sovereign Identity - IIW October 2019Introduction to Self Sovereign Identity - IIW October 2019
Introduction to Self Sovereign Identity - IIW October 2019
 
Digital Identity Wallets: What They Mean For Banks
Digital Identity Wallets: What They Mean For BanksDigital Identity Wallets: What They Mean For Banks
Digital Identity Wallets: What They Mean For Banks
 
IDA,VC,DID関連仕様 最新情報 - OpenID BizDay #15
IDA,VC,DID関連仕様 最新情報 - OpenID BizDay #15IDA,VC,DID関連仕様 最新情報 - OpenID BizDay #15
IDA,VC,DID関連仕様 最新情報 - OpenID BizDay #15
 
Introduction to Self Sovereign Identity
Introduction to Self Sovereign IdentityIntroduction to Self Sovereign Identity
Introduction to Self Sovereign Identity
 
What is self-sovereign identity (SSI)?
What is self-sovereign identity (SSI)?What is self-sovereign identity (SSI)?
What is self-sovereign identity (SSI)?
 
OpenID Connect for W3C Verifiable Credential Objects
OpenID Connect for W3C Verifiable Credential ObjectsOpenID Connect for W3C Verifiable Credential Objects
OpenID Connect for W3C Verifiable Credential Objects
 
Machine identity - DIDs and verifiable credentials for a secure, trustworthy ...
Machine identity - DIDs and verifiable credentials for a secure, trustworthy ...Machine identity - DIDs and verifiable credentials for a secure, trustworthy ...
Machine identity - DIDs and verifiable credentials for a secure, trustworthy ...
 
Self-issued OpenID Provider_OpenID Foundation Virtual Workshop
Self-issued OpenID Provider_OpenID Foundation Virtual Workshop Self-issued OpenID Provider_OpenID Foundation Virtual Workshop
Self-issued OpenID Provider_OpenID Foundation Virtual Workshop
 

Similar to How to Build Interoperable Decentralized Identity Systems with OpenID for Verifiable Credentials

How to Build Interoperable Decentralized Identity Systems with OpenID for Ver...
How to Build Interoperable Decentralized Identity Systems with OpenID for Ver...How to Build Interoperable Decentralized Identity Systems with OpenID for Ver...
How to Build Interoperable Decentralized Identity Systems with OpenID for Ver...Torsten Lodderstedt
 
Exploring Advanced Authentication Methods in Novell Access Manager
Exploring Advanced Authentication Methods in Novell Access ManagerExploring Advanced Authentication Methods in Novell Access Manager
Exploring Advanced Authentication Methods in Novell Access ManagerNovell
 
Microservices security - jpmc tech fest 2018
Microservices security - jpmc tech fest 2018Microservices security - jpmc tech fest 2018
Microservices security - jpmc tech fest 2018MOnCloud
 
Value proposition of SSI tech providers - Self-Sovereign Identity
Value proposition of SSI tech providers - Self-Sovereign IdentityValue proposition of SSI tech providers - Self-Sovereign Identity
Value proposition of SSI tech providers - Self-Sovereign IdentitySSIMeetup
 
Microservices Security landscape
Microservices Security landscapeMicroservices Security landscape
Microservices Security landscapeSagara Gunathunga
 
Cloud Identity Webinar
Cloud Identity WebinarCloud Identity Webinar
Cloud Identity WebinarWSO2
 
Cartes Asia Dem 2010 V2
Cartes Asia Dem 2010 V2Cartes Asia Dem 2010 V2
Cartes Asia Dem 2010 V2Donald Malloy
 
DEVNET-1010 Using Cisco pxGrid for Security Platform Integration
DEVNET-1010	Using Cisco pxGrid for Security Platform IntegrationDEVNET-1010	Using Cisco pxGrid for Security Platform Integration
DEVNET-1010 Using Cisco pxGrid for Security Platform IntegrationCisco DevNet
 
apidays LIVE India 2022_Standardizing Biometric Device Integration for Identi...
apidays LIVE India 2022_Standardizing Biometric Device Integration for Identi...apidays LIVE India 2022_Standardizing Biometric Device Integration for Identi...
apidays LIVE India 2022_Standardizing Biometric Device Integration for Identi...apidays
 
Authentication Models
Authentication ModelsAuthentication Models
Authentication ModelsRaj Chanchal
 
Webinar: Extend The Power of The ForgeRock Identity Platform Through Scripting
Webinar: Extend The Power of The ForgeRock Identity Platform Through ScriptingWebinar: Extend The Power of The ForgeRock Identity Platform Through Scripting
Webinar: Extend The Power of The ForgeRock Identity Platform Through ScriptingForgeRock
 
Application Security in ASP.NET Core
Application Security in ASP.NET CoreApplication Security in ASP.NET Core
Application Security in ASP.NET CoreNETUserGroupBern
 
OSCON 2018 Getting Started with Hyperledger Indy
OSCON 2018 Getting Started with Hyperledger IndyOSCON 2018 Getting Started with Hyperledger Indy
OSCON 2018 Getting Started with Hyperledger IndyTracy Kuhrt
 
Using Cisco pxGrid for Security Platform Integration: a deep dive
Using Cisco pxGrid for Security Platform Integration: a deep diveUsing Cisco pxGrid for Security Platform Integration: a deep dive
Using Cisco pxGrid for Security Platform Integration: a deep diveCisco DevNet
 
2019 - Tech Talk DC - Token-based security for web applications using OAuth2 ...
2019 - Tech Talk DC - Token-based security for web applications using OAuth2 ...2019 - Tech Talk DC - Token-based security for web applications using OAuth2 ...
2019 - Tech Talk DC - Token-based security for web applications using OAuth2 ...Vladimir Bychkov
 
2019 - Nova Code Camp - AuthZ fundamentals with ASP.NET Core
2019 - Nova Code Camp - AuthZ fundamentals with ASP.NET Core2019 - Nova Code Camp - AuthZ fundamentals with ASP.NET Core
2019 - Nova Code Camp - AuthZ fundamentals with ASP.NET CoreVladimir Bychkov
 
AllTheTalks.Online 2020: "Basics of OAuth 2.0 and OpenID Connect"
AllTheTalks.Online 2020: "Basics of OAuth 2.0 and OpenID Connect"AllTheTalks.Online 2020: "Basics of OAuth 2.0 and OpenID Connect"
AllTheTalks.Online 2020: "Basics of OAuth 2.0 and OpenID Connect"Andreas Falk
 
ASP.NET Single Sign On
ASP.NET Single Sign OnASP.NET Single Sign On
ASP.NET Single Sign Onleastprivilege
 
Wso2 is integration with .net core
Wso2 is   integration with .net coreWso2 is   integration with .net core
Wso2 is integration with .net coreIsmaeel Enjreny
 

Similar to How to Build Interoperable Decentralized Identity Systems with OpenID for Verifiable Credentials (20)

How to Build Interoperable Decentralized Identity Systems with OpenID for Ver...
How to Build Interoperable Decentralized Identity Systems with OpenID for Ver...How to Build Interoperable Decentralized Identity Systems with OpenID for Ver...
How to Build Interoperable Decentralized Identity Systems with OpenID for Ver...
 
Exploring Advanced Authentication Methods in Novell Access Manager
Exploring Advanced Authentication Methods in Novell Access ManagerExploring Advanced Authentication Methods in Novell Access Manager
Exploring Advanced Authentication Methods in Novell Access Manager
 
Microservices security - jpmc tech fest 2018
Microservices security - jpmc tech fest 2018Microservices security - jpmc tech fest 2018
Microservices security - jpmc tech fest 2018
 
OpenID Connect Explained
OpenID Connect ExplainedOpenID Connect Explained
OpenID Connect Explained
 
Value proposition of SSI tech providers - Self-Sovereign Identity
Value proposition of SSI tech providers - Self-Sovereign IdentityValue proposition of SSI tech providers - Self-Sovereign Identity
Value proposition of SSI tech providers - Self-Sovereign Identity
 
Microservices Security landscape
Microservices Security landscapeMicroservices Security landscape
Microservices Security landscape
 
Cloud Identity Webinar
Cloud Identity WebinarCloud Identity Webinar
Cloud Identity Webinar
 
Cartes Asia Dem 2010 V2
Cartes Asia Dem 2010 V2Cartes Asia Dem 2010 V2
Cartes Asia Dem 2010 V2
 
DEVNET-1010 Using Cisco pxGrid for Security Platform Integration
DEVNET-1010	Using Cisco pxGrid for Security Platform IntegrationDEVNET-1010	Using Cisco pxGrid for Security Platform Integration
DEVNET-1010 Using Cisco pxGrid for Security Platform Integration
 
apidays LIVE India 2022_Standardizing Biometric Device Integration for Identi...
apidays LIVE India 2022_Standardizing Biometric Device Integration for Identi...apidays LIVE India 2022_Standardizing Biometric Device Integration for Identi...
apidays LIVE India 2022_Standardizing Biometric Device Integration for Identi...
 
Authentication Models
Authentication ModelsAuthentication Models
Authentication Models
 
Webinar: Extend The Power of The ForgeRock Identity Platform Through Scripting
Webinar: Extend The Power of The ForgeRock Identity Platform Through ScriptingWebinar: Extend The Power of The ForgeRock Identity Platform Through Scripting
Webinar: Extend The Power of The ForgeRock Identity Platform Through Scripting
 
Application Security in ASP.NET Core
Application Security in ASP.NET CoreApplication Security in ASP.NET Core
Application Security in ASP.NET Core
 
OSCON 2018 Getting Started with Hyperledger Indy
OSCON 2018 Getting Started with Hyperledger IndyOSCON 2018 Getting Started with Hyperledger Indy
OSCON 2018 Getting Started with Hyperledger Indy
 
Using Cisco pxGrid for Security Platform Integration: a deep dive
Using Cisco pxGrid for Security Platform Integration: a deep diveUsing Cisco pxGrid for Security Platform Integration: a deep dive
Using Cisco pxGrid for Security Platform Integration: a deep dive
 
2019 - Tech Talk DC - Token-based security for web applications using OAuth2 ...
2019 - Tech Talk DC - Token-based security for web applications using OAuth2 ...2019 - Tech Talk DC - Token-based security for web applications using OAuth2 ...
2019 - Tech Talk DC - Token-based security for web applications using OAuth2 ...
 
2019 - Nova Code Camp - AuthZ fundamentals with ASP.NET Core
2019 - Nova Code Camp - AuthZ fundamentals with ASP.NET Core2019 - Nova Code Camp - AuthZ fundamentals with ASP.NET Core
2019 - Nova Code Camp - AuthZ fundamentals with ASP.NET Core
 
AllTheTalks.Online 2020: "Basics of OAuth 2.0 and OpenID Connect"
AllTheTalks.Online 2020: "Basics of OAuth 2.0 and OpenID Connect"AllTheTalks.Online 2020: "Basics of OAuth 2.0 and OpenID Connect"
AllTheTalks.Online 2020: "Basics of OAuth 2.0 and OpenID Connect"
 
ASP.NET Single Sign On
ASP.NET Single Sign OnASP.NET Single Sign On
ASP.NET Single Sign On
 
Wso2 is integration with .net core
Wso2 is   integration with .net coreWso2 is   integration with .net core
Wso2 is integration with .net core
 

More from Torsten Lodderstedt

Comprehensive overview FAPI 1 and FAPI 2
Comprehensive overview FAPI 1 and FAPI 2Comprehensive overview FAPI 1 and FAPI 2
Comprehensive overview FAPI 1 and FAPI 2Torsten Lodderstedt
 
Comprehensive overview FAPI 1 and 2
Comprehensive overview FAPI 1 and 2Comprehensive overview FAPI 1 and 2
Comprehensive overview FAPI 1 and 2Torsten Lodderstedt
 
OpenID Connect 4 Identity Assurance at IIW #32
OpenID Connect 4 Identity Assurance at IIW #32OpenID Connect 4 Identity Assurance at IIW #32
OpenID Connect 4 Identity Assurance at IIW #32Torsten Lodderstedt
 
Identity Assurance with OpenID Connect
Identity Assurance with OpenID ConnectIdentity Assurance with OpenID Connect
Identity Assurance with OpenID ConnectTorsten Lodderstedt
 
NextGenPSD2 OAuth SCA Mode Security Recommendations
NextGenPSD2 OAuth SCA Mode Security RecommendationsNextGenPSD2 OAuth SCA Mode Security Recommendations
NextGenPSD2 OAuth SCA Mode Security RecommendationsTorsten Lodderstedt
 
OpenID Connect for Identity Assurance
OpenID Connect for Identity AssuranceOpenID Connect for Identity Assurance
OpenID Connect for Identity AssuranceTorsten Lodderstedt
 
NextGenPSD2 OAuth SCA Mode Security Recommendations
NextGenPSD2 OAuth SCA Mode Security Recommendations NextGenPSD2 OAuth SCA Mode Security Recommendations
NextGenPSD2 OAuth SCA Mode Security Recommendations Torsten Lodderstedt
 
Identiverse: PSD2, Open Banking, and Technical Interoperability
Identiverse: PSD2, Open Banking, and Technical InteroperabilityIdentiverse: PSD2, Open Banking, and Technical Interoperability
Identiverse: PSD2, Open Banking, and Technical InteroperabilityTorsten Lodderstedt
 
Identity Proofing with OpenID Connect
Identity Proofing with OpenID ConnectIdentity Proofing with OpenID Connect
Identity Proofing with OpenID ConnectTorsten Lodderstedt
 

More from Torsten Lodderstedt (14)

GAIN Presentation.pptx
GAIN Presentation.pptxGAIN Presentation.pptx
GAIN Presentation.pptx
 
Comprehensive overview FAPI 1 and FAPI 2
Comprehensive overview FAPI 1 and FAPI 2Comprehensive overview FAPI 1 and FAPI 2
Comprehensive overview FAPI 1 and FAPI 2
 
Comprehensive overview FAPI 1 and 2
Comprehensive overview FAPI 1 and 2Comprehensive overview FAPI 1 and 2
Comprehensive overview FAPI 1 and 2
 
OpenID Connect 4 Identity Assurance at IIW #32
OpenID Connect 4 Identity Assurance at IIW #32OpenID Connect 4 Identity Assurance at IIW #32
OpenID Connect 4 Identity Assurance at IIW #32
 
Identity Assurance with OpenID Connect
Identity Assurance with OpenID ConnectIdentity Assurance with OpenID Connect
Identity Assurance with OpenID Connect
 
NextGenPSD2 OAuth SCA Mode Security Recommendations
NextGenPSD2 OAuth SCA Mode Security RecommendationsNextGenPSD2 OAuth SCA Mode Security Recommendations
NextGenPSD2 OAuth SCA Mode Security Recommendations
 
Rich Authorization Requests
Rich Authorization RequestsRich Authorization Requests
Rich Authorization Requests
 
Pushed Authorization Requests
Pushed Authorization RequestsPushed Authorization Requests
Pushed Authorization Requests
 
OpenID Connect for Identity Assurance
OpenID Connect for Identity AssuranceOpenID Connect for Identity Assurance
OpenID Connect for Identity Assurance
 
NextGenPSD2 OAuth SCA Mode Security Recommendations
NextGenPSD2 OAuth SCA Mode Security Recommendations NextGenPSD2 OAuth SCA Mode Security Recommendations
NextGenPSD2 OAuth SCA Mode Security Recommendations
 
Identiverse: PSD2, Open Banking, and Technical Interoperability
Identiverse: PSD2, Open Banking, and Technical InteroperabilityIdentiverse: PSD2, Open Banking, and Technical Interoperability
Identiverse: PSD2, Open Banking, and Technical Interoperability
 
OAuth 2.0 Security Reinforced
OAuth 2.0 Security ReinforcedOAuth 2.0 Security Reinforced
OAuth 2.0 Security Reinforced
 
OAuth Security 4 Dummies iiw#27
OAuth Security 4 Dummies iiw#27OAuth Security 4 Dummies iiw#27
OAuth Security 4 Dummies iiw#27
 
Identity Proofing with OpenID Connect
Identity Proofing with OpenID ConnectIdentity Proofing with OpenID Connect
Identity Proofing with OpenID Connect
 

Recently uploaded

Making an RFC in Today's IETF, presented by Geoff Huston at IETF 119
Making an RFC in Today's IETF, presented by Geoff Huston at IETF 119Making an RFC in Today's IETF, presented by Geoff Huston at IETF 119
Making an RFC in Today's IETF, presented by Geoff Huston at IETF 119APNIC
 
IP addressing and IPv6, presented by Paul Wilson at IETF 119
IP addressing and IPv6, presented by Paul Wilson at IETF 119IP addressing and IPv6, presented by Paul Wilson at IETF 119
IP addressing and IPv6, presented by Paul Wilson at IETF 119APNIC
 
Power of Social Media for E-commerce.pdf
Power of Social Media for E-commerce.pdfPower of Social Media for E-commerce.pdf
Power of Social Media for E-commerce.pdfrajats19920
 
IPv6 Operational Issues (with DNS), presented by Geoff Huston at IETF 119
IPv6 Operational Issues (with DNS), presented by Geoff Huston at IETF 119IPv6 Operational Issues (with DNS), presented by Geoff Huston at IETF 119
IPv6 Operational Issues (with DNS), presented by Geoff Huston at IETF 119APNIC
 
Summary IGF 2013 Bali - English (tata kelola internet / internet governance)
Summary  IGF 2013 Bali - English (tata kelola internet / internet governance)Summary  IGF 2013 Bali - English (tata kelola internet / internet governance)
Summary IGF 2013 Bali - English (tata kelola internet / internet governance)ICT Watch - Indonesia
 
draft-harrison-sidrops-manifest-number-01, presented at IETF 119
draft-harrison-sidrops-manifest-number-01, presented at IETF 119draft-harrison-sidrops-manifest-number-01, presented at IETF 119
draft-harrison-sidrops-manifest-number-01, presented at IETF 119APNIC
 
Basic Security.pptx is a awsome PPT on your mobiel
Basic Security.pptx is a awsome PPT on your mobielBasic Security.pptx is a awsome PPT on your mobiel
Basic Security.pptx is a awsome PPT on your mobielpratamakiki860
 
Summary ID-IGF 2016 National Dialogue - English (tata kelola internet / int...
Summary  ID-IGF 2016 National Dialogue  - English (tata kelola internet / int...Summary  ID-IGF 2016 National Dialogue  - English (tata kelola internet / int...
Summary ID-IGF 2016 National Dialogue - English (tata kelola internet / int...ICT Watch - Indonesia
 
Is DNS ready for IPv6, presented by Geoff Huston at IETF 119
Is DNS ready for IPv6, presented by Geoff Huston at IETF 119Is DNS ready for IPv6, presented by Geoff Huston at IETF 119
Is DNS ready for IPv6, presented by Geoff Huston at IETF 119APNIC
 
2024_hackersuli_mobil_ios_android ______
2024_hackersuli_mobil_ios_android ______2024_hackersuli_mobil_ios_android ______
2024_hackersuli_mobil_ios_android ______hackersuli
 
办理澳洲USYD文凭证书学历认证【Q微/1954292140】办理悉尼大学毕业证书真实成绩单GPA修改/办理澳洲大学文凭证书Offer录取通知书/在读证明...
办理澳洲USYD文凭证书学历认证【Q微/1954292140】办理悉尼大学毕业证书真实成绩单GPA修改/办理澳洲大学文凭证书Offer录取通知书/在读证明...办理澳洲USYD文凭证书学历认证【Q微/1954292140】办理悉尼大学毕业证书真实成绩单GPA修改/办理澳洲大学文凭证书Offer录取通知书/在读证明...
办理澳洲USYD文凭证书学历认证【Q微/1954292140】办理悉尼大学毕业证书真实成绩单GPA修改/办理澳洲大学文凭证书Offer录取通知书/在读证明...vmzoxnx5
 
Tari Eason Warriors Come Out To Play T Shirts
Tari Eason Warriors Come Out To Play T ShirtsTari Eason Warriors Come Out To Play T Shirts
Tari Eason Warriors Come Out To Play T Shirtsrahman018755
 
Cyber Shield Up - They Shall Not Pass - Andreas Sfakianakis - Lecture at CSD ...
Cyber Shield Up - They Shall Not Pass - Andreas Sfakianakis - Lecture at CSD ...Cyber Shield Up - They Shall Not Pass - Andreas Sfakianakis - Lecture at CSD ...
Cyber Shield Up - They Shall Not Pass - Andreas Sfakianakis - Lecture at CSD ...Andreas Sfakianakis
 

Recently uploaded (13)

Making an RFC in Today's IETF, presented by Geoff Huston at IETF 119
Making an RFC in Today's IETF, presented by Geoff Huston at IETF 119Making an RFC in Today's IETF, presented by Geoff Huston at IETF 119
Making an RFC in Today's IETF, presented by Geoff Huston at IETF 119
 
IP addressing and IPv6, presented by Paul Wilson at IETF 119
IP addressing and IPv6, presented by Paul Wilson at IETF 119IP addressing and IPv6, presented by Paul Wilson at IETF 119
IP addressing and IPv6, presented by Paul Wilson at IETF 119
 
Power of Social Media for E-commerce.pdf
Power of Social Media for E-commerce.pdfPower of Social Media for E-commerce.pdf
Power of Social Media for E-commerce.pdf
 
IPv6 Operational Issues (with DNS), presented by Geoff Huston at IETF 119
IPv6 Operational Issues (with DNS), presented by Geoff Huston at IETF 119IPv6 Operational Issues (with DNS), presented by Geoff Huston at IETF 119
IPv6 Operational Issues (with DNS), presented by Geoff Huston at IETF 119
 
Summary IGF 2013 Bali - English (tata kelola internet / internet governance)
Summary  IGF 2013 Bali - English (tata kelola internet / internet governance)Summary  IGF 2013 Bali - English (tata kelola internet / internet governance)
Summary IGF 2013 Bali - English (tata kelola internet / internet governance)
 
draft-harrison-sidrops-manifest-number-01, presented at IETF 119
draft-harrison-sidrops-manifest-number-01, presented at IETF 119draft-harrison-sidrops-manifest-number-01, presented at IETF 119
draft-harrison-sidrops-manifest-number-01, presented at IETF 119
 
Basic Security.pptx is a awsome PPT on your mobiel
Basic Security.pptx is a awsome PPT on your mobielBasic Security.pptx is a awsome PPT on your mobiel
Basic Security.pptx is a awsome PPT on your mobiel
 
Summary ID-IGF 2016 National Dialogue - English (tata kelola internet / int...
Summary  ID-IGF 2016 National Dialogue  - English (tata kelola internet / int...Summary  ID-IGF 2016 National Dialogue  - English (tata kelola internet / int...
Summary ID-IGF 2016 National Dialogue - English (tata kelola internet / int...
 
Is DNS ready for IPv6, presented by Geoff Huston at IETF 119
Is DNS ready for IPv6, presented by Geoff Huston at IETF 119Is DNS ready for IPv6, presented by Geoff Huston at IETF 119
Is DNS ready for IPv6, presented by Geoff Huston at IETF 119
 
2024_hackersuli_mobil_ios_android ______
2024_hackersuli_mobil_ios_android ______2024_hackersuli_mobil_ios_android ______
2024_hackersuli_mobil_ios_android ______
 
办理澳洲USYD文凭证书学历认证【Q微/1954292140】办理悉尼大学毕业证书真实成绩单GPA修改/办理澳洲大学文凭证书Offer录取通知书/在读证明...
办理澳洲USYD文凭证书学历认证【Q微/1954292140】办理悉尼大学毕业证书真实成绩单GPA修改/办理澳洲大学文凭证书Offer录取通知书/在读证明...办理澳洲USYD文凭证书学历认证【Q微/1954292140】办理悉尼大学毕业证书真实成绩单GPA修改/办理澳洲大学文凭证书Offer录取通知书/在读证明...
办理澳洲USYD文凭证书学历认证【Q微/1954292140】办理悉尼大学毕业证书真实成绩单GPA修改/办理澳洲大学文凭证书Offer录取通知书/在读证明...
 
Tari Eason Warriors Come Out To Play T Shirts
Tari Eason Warriors Come Out To Play T ShirtsTari Eason Warriors Come Out To Play T Shirts
Tari Eason Warriors Come Out To Play T Shirts
 
Cyber Shield Up - They Shall Not Pass - Andreas Sfakianakis - Lecture at CSD ...
Cyber Shield Up - They Shall Not Pass - Andreas Sfakianakis - Lecture at CSD ...Cyber Shield Up - They Shall Not Pass - Andreas Sfakianakis - Lecture at CSD ...
Cyber Shield Up - They Shall Not Pass - Andreas Sfakianakis - Lecture at CSD ...
 

How to Build Interoperable Decentralized Identity Systems with OpenID for Verifiable Credentials

  • 1. How to Build Interoperable Decentralized Identity Systems with OpenID for Verifiable Credentials Kristina Yasuda, Microsoft Dr. Torsten Lodderstedt, yes
  • 2. Kristina Identity Standards Architect Yasuda Microsoft Dr. Torsten Managing Director Lodderstedt yes IDP GmbH
  • 3. Issuer (Website) Verifier (Website) Wallet (user’s device, cloud or hybrid) Credential Issuance Credential Presentation User Interactions ● The User presenting the Identity data directly to the Verifier from the Wallet ○ <> In the federated model where Identity data is sent directly from the IdP to the Verifier ● Usually expressed with the flow below: What is Decentralized Identity?
  • 4. Verifiable Credentials: Benefits ● End-Users gain more privacy, and portability over their identity information. ● Cheaper, faster, and more secure identity verification, when transforming physical credentials into digital ones. ● Universal approach to handle identification, authentication, and authorization in digital and physical space.
  • 5. Issuer (Website) Issuer (Website) Issuer (Website) Why Protocol Layer Interoperability is Crucial. Credential Issuance Credential Presentation One entity needs to talk to the large the number of entities, to increase the value of “Decentralized Identity”. Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) User Interactions Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Issuer (Website) Wallet (user’s device, cloud or hybrid) Verifier (Website) Issuer (Website)
  • 6. Problems we identified & how we solved them Problem Solution A lot of entirely new Protocols. (Hard to get security right, steep learning curve) ⇒ Building upon currently widely used protocols: OAuth 2.0 and OpenID Connect. (Secure, already understood) No clear winner among Credential Formats ⇒ Designing a Credential Format agnostic protocol Reluctance to use only DIDs. No clear winner among DID methods ⇒ Designing a protocol agnostic to the Key Resolution mechanism. (No need to use DIDs) Participating entities cannot typically establish trust upfront, using traditional mechanisms. ⇒ Flexibility in Trust Management. Third Party Trust.
  • 7. OpenID for Verifiable Credential Issuance Issuer (Website) Verifier (Website) Wallet (user’s device, cloud or hybrid) Credential Issuance Credential Presentation User Interactions OpenID for Verifiable Presentations Self-Issued OP v2 ...so here comes OpenID for Verifiable Credentials!
  • 8. Adoption (selected use-cases) The European Digital Identity Wallet Architecture and Reference Framework[1] (eIDAS ARF/EUDIW) requires OID4VCI, OID4VP and SIOPv2 for online use-cases NIST National Cybersecurity Center of Excellence[2] plans to implement reference implementation for OID4VP to present mdocs/mDL DIF JWT VC Presentation Profile[3] uses OID4VP for request and presentation of W3C JWT VCs and SIOPv2 for user authentication. Implementers: Ping Identity, Microsoft, IBM, Spruce, Auth0, Gen Digital [1] https://cloudsignatureconsortium.org/new-eu-eidas-regulation-a-quantum-leap-for-electronic-identity/ [2] https://www.nccoe.nist.gov/projects/digital-identities-mdl [3] https://identity.foundation/jwt-vc-presentation-profile/#workplace-credential
  • 9. Open Source libraries ● Walt.id ○ https://github.com/walt-id/waltid-ssikit (Kotlin) ● Sphereon ○ https://github.com/Sphereon-Opensource/SIOP-OpenID4VP (Typescript) ○ https://github.com/Sphereon-Opensource/OpenID4VCI-client (Typescript) ○ https://github.com/Sphereon-Opensource/ssi-sdk (Typescript) ● Microsoft ○ https://github.com/microsoft/VerifiableCredential-SDK-Android (Kotlin) ○ https://github.com/microsoft/VerifiableCredential-SDK-iOS (Swift) ● Spruce ○ https://github.com/spruceid/oidc4vci-rs (Rust) ○ https://github.com/spruceid/oidc4vci-issuer (Rust) ● EBSI ○ https://api-pilot.ebsi.eu/docs/libraries (Javascript) ● Impierce Technologies ○ https://github.com/impierce/openid4vc (Rust)
  • 10. Let us tell you more about the protocol
  • 11. OpenID for Verifiable Credential Issuance (Highlights) - It’s an OAuth-protected API (Credential Endpoint at the Resource Server) - Supports various Security levels (including high security with hardware bound keys) - Various business requirements supported (ex. remote and in-person provisioning) - Different user-experiences can be achieved (multiple ways to initiate the flow) - Issuer can check Wallet’s capabilities & Wallet can discover Issuer metadata
  • 12. Wallet ⓪ Wallet requests & User authorizes credential issuance ③ Credential is issued ① access token(, refresh token) ② Wallet requests credential issuance Protocol Flow Alice Credential Issuer
  • 15. OpenID for Verifiable Presentations (Highlights) - Designed for high degree of privacy - Supports various Security levels (e.g. mutual authentication among the parties) - Different user-experience can be achieved (same-device and cross-device) - Presentation of multiple Credentials supported - Various Wallet deployment models supported - All local to a native app - Cloud Wallet with a backend - Browser wallet
  • 18. Features of OpenID for Verifiable Credentials 1) It is NOT only about W3C Verifiable Credentials. 2) Does not require the usage of DLT (or Blockchain). 3) We are an open standardization community. Implementer’s feedback is incorporated in an agile and transparent manner. 4) It is modular and flexible to cater for the needs of different legislations and use-cases. 5) Complemented by active work on profiles to help the developers interoperate.
  • 19. User Interactions New additions to the family coming! OpenID for Verifiable Credential Issuance Self-Issued OP v2 OpenID for Verifiable Presentations OpenID for Verifiable Presentations over BLE Security and Trust in OpenID for Verifiable Credentials Core specs additional specs Certification Suite High-Assurance Profile Issuer (Website) Verifier (Website) Wallet (user’s device, cloud or hybrid) Issue Credentials Present Credentials
  • 20. High Assurance Profile of OpenID4VC with SD-JWT-VC
  • 21. Profiling OpenID4VC - OpenID4VC is a framework - Interoperability requires “profiling” - Profile defines: - mandatory to implement elements of the protocols, (e.g., grant types, etc.) - wallet invocation mechanism (i.e., custom URL scheme) - authentication requirements for Verifiers and Wallets - Credential Format(s) with ■ issuer identification and key resolution ■ holder key binding - Crypto algorithms
  • 22. High Assurance Profile of OpenID4VC with SD-JWT-VC - Interoperability across parties while being privacy preserving and able to fulfill security and regulatory requirements - Intended audience - eIDAS ARF (through OIDF/EC liaison) - CA DMV wallet - Basis for OWF project(s) - Basis for Userinfo Interoperability profile - IDunion Tech Stack - GAIN PoC - Japanese government (Trusted Web project) - other jurisdictions - private companies / infrastructure companies
  • 23. OID4VC High Assurance Interoperability Profile with SD-JWT VC SIOPv2 OID4VP OID4VCI custom scheme crypto suites custom scheme credential profile client id scheme custom scheme credential profile wallet attestation scheme Protocols - Custom Scheme: haip:// - issuer key resolution: web-based, x509 - Crypto Suites: P-256(ecp256r1), SHA256 Basic Choices Attestation based Client Authentication crypto suites issuer key resolution Wallet Attestation Scheme Credential profile: VC-SD-JWT VC-SD-JWT JWT/CWT Statuslist crypto suites issuer key resolution crypto suites issuer key resolution Profiles need to: ● fill the extension points ● define mandatory to implement features
  • 24. OpenID for Verifiable Credential Issuance - Pre-authorization code flow and authorization code flow are both required. - Sender-constrained Tokens using DPoP required - Credential Offer - for both pre-authorization code flow and authorization code - custom scheme “haip://” for wallet invocation - Authorization at Issuer with Pushed Authorization Requests (PAR) - Wallet Authentication with sender-constrained JWTs - "scope” parameter to requesting authorization for credential issuance - Only required endpoint is Credential Endpoint - Batch Credential Endpoint is required for dual issuance of SD-JWT-VC and mdocs
  • 25. OpenID for Verifiable Presentations - custom scheme “haip://” for wallet invocation. - Response type: “vp_token”. - Response mode: “direct_post” with redirect_uri. - Using “request_uri” to send Authorization Request is required. - Presentation Definition is sent using “presentation_definition” parameter - Subset of the Presentation Exchange Syntax in order to simplify implementation and prevent security issues - Verifier Authentication with - x.509 Certificates or - Sender-constrained JWTs
  • 26. SIOP v2 - custom URL scheme “haip://” for wallet invocation - subject_syntax_types_supported value MUST be urn:ietf:params:oauth:jwk-thumbprint - Verifier Authentication with - x.509 Certificates or - Sender-constrained JWTs
  • 27. Credential Format - SD-JWT VC with JSON payload (“typ”: “vc+sd-jwt”) - both compact and JSON serialization - Definition of mapping to VCDM base media type - Issuer identification and key resolution 1. Web PKI based: iss=issuer URL used to obtain jwks_uri + key id in the `kid` JWS header 2. x.509: iss=SAN in x.509 cert + x.509 cert chain in the `x5c` JWS header - Holder binding: - `cnf` JWT claim with jwk - Credential Revocation: Bitmap type style Status list using JWTs
  • 28. SD-JWT VC with web PKI based Issuer key resolution { "alg": "ES256", "typ": "vc+sd-jwt", "kid":"4" } { "iss": "https://credential-issuer.example.com", "iat": 1516239022, "exp": 1516247022, "type": "Identity", "_sd": [ "UiuRGkTW7e_5UQauGeQRQdF8u3WYevS4Fs0IuB_DgYM", "tmPlXq0MID-oRXbUNHyoVZrc9Qkm8cwJTohVyOVlUgQ", "vTz0JI103v4k4pKIloT83Yzi33L1SdZlWBPmsfJBefk" ], "_sd_alg": "sha-256", "cnf": { "jwk": { "kty": "EC", "crv": "P-256", "x": "TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc", "y": "ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ" } } }
  • 29. Crypto - For signing and signature validation: - ES256 algorithm and ECDSA keys using the P-256 (secp256k1) - As hash algorithm to generate and validate the digests in the SD-JWT VC: - SHA256
  • 30. Call to Action: Implement, Implement, Implement The information can be found at https://openid.net/openid4vc/