Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Draft for wallet attestation #408

Open
wants to merge 20 commits into
base: main
Choose a base branch
from
Open

Draft for wallet attestation #408

wants to merge 20 commits into from

Conversation

paulbastian
Copy link
Contributor

@paulbastian paulbastian commented Oct 28, 2024 •
edited
Loading

Closes #355
Closes #406

  • JWT format
  • References in Token Request?

@Sakurann
Copy link
Collaborator

Sakurann commented Oct 28, 2024 •
edited
Loading

can this PR also address #150 ?
and might be worth looking into #366 and #44 jfyi

David-Chadwick
David-Chadwick reviewed Nov 12, 2024
View reviewed changes
Copy link
Contributor

@David-Chadwick David-Chadwick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not see anywhere in this draft that says that the wallet attestation should be displayable to the user, as a means of engendering the user's trust in the wallet app. The current text is concerned with transferring the wallet attestation between system components, which is important. But so is display to the user.

@paulbastian @tlodderstedt
Apply suggestions from code review
fc78c4a 
Co-authored-by: Torsten Lodderstedt <[email protected]>
paulbastian
paulbastian commented Dec 5, 2024
View reviewed changes
openid-4-verifiable-credential-issuance-1_0.md Outdated

Some Wallet architectures require a backend service from the Wallet Provider that verifies the Client's authenticity before providing Wallet Attestations. Mobile application attestations provided by operating systems, like iOS's DeviceCheck or Android's Play Integrity, enable the Wallet Provider's backend to confirm communication with a legitimate instance. These mechanisms help validate the Wallet's internal integrity.

A Wallet MAY provide Wallet Attestations to inform the Authorization Server about the authenticity of the Client and its `client_id`. Authorization Server may want to evaluate these Wallet Attestations to determine whether they communicate to a Wallet that meets its security, compliance or governance requirements, based on the trust framework in use, regulatory requirements, laws, or internal design decisions. A Credential Issuer SHOULD communicate this requirement to evaluate Wallet Attestations through its metadata using `token_endpoint_auth_method` or using some sort of out-of-band mechanism.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
A Wallet MAY provide Wallet Attestations to inform the Authorization Server about the authenticity of the Client and its `client_id`. Authorization Server may want to evaluate these Wallet Attestations to determine whether they communicate to a Wallet that meets its security, compliance or governance requirements, based on the trust framework in use, regulatory requirements, laws, or internal design decisions. A Credential Issuer SHOULD communicate this requirement to evaluate Wallet Attestations through its metadata using `token_endpoint_auth_method` or using some sort of out-of-band mechanism.
A Wallet MAY provide Wallet Attestations to inform the Authorization Server about the authenticity of the Client and its `client_id`. Authorization Server may want to evaluate these Wallet Attestations to determine whether they communicate to a Wallet that meets its security, compliance or governance requirements, based on the trust framework in use, regulatory requirements, laws, or internal design decisions. A Credential Issuer SHOULD communicate this requirement to evaluate Wallet Attestations through its metadata using `token_endpoint_auth_method` or using some sort of out-of-band mechanism. The Wallet Attestation MUST be signed by an wallet provider that the Authorization Server trusts for this purpose.

@pmhsfelix
Copy link
Contributor

Still not clear to me what are the concrete things being specified here:

  • Is it that [@!I-D.ietf-oauth-attestation-based-client-auth] MUST be used if wallet attestation is required by the credential issuer?
  • Is it a profile on the "Client Attestation JWT", defined by [@!I-D.ietf-oauth-attestation-based-client-auth], where this spec defined additional claims and their semantics?

By using [@!I-D.ietf-oauth-attestation-based-client-auth] we turn wallet attestation into a client authentication problem, which happens exclusively at the AS (token request, PAR). The only thing that the issuer gets is an access token, which when introspected provides a client ID.

@TomCJones
Copy link

why is there an authorization server in a three-party interaction? Or is this another name for the wallet provider. I recommend removing the concept of the Authz server altogether.

@paulbastian
Copy link
Contributor Author

@pmhsfelix Torsten and I simplified the text a lot, please have a look

c2bo
c2bo approved these changes Dec 6, 2024
View reviewed changes
openid-4-verifiable-credential-issuance-1_0.md Outdated Show resolved Hide resolved
openid-4-verifiable-credential-issuance-1_0.md Outdated Show resolved Hide resolved
peppelinux
peppelinux reviewed Dec 8, 2024
View reviewed changes
openid-4-verifiable-credential-issuance-1_0.md
@@ -2257,6 +2251,52 @@ The following is a non-normative example of a Credential Response containing a C

<{{examples/credential_response_sd_jwt_vc.txt}}

# Wallet Attestations in JWT format {#walletattestation}

The Wallet Attestation defined in this section is a client authentication method especially designed for native App Wallets. Instead of using platform-specific key, app, and/or device attestations directly, it uses a key-bound, platform agnostic common format based on JWTs. This allows Authorization Servers to authenticate Wallets across different platforms in a unified fashion and exposes only a minimum dataset. Also, it allows the Wallet app to directly interact with the Credential Issuer without involving the Wallet Provider's backend. The Wallet Attestation MUST be signed by an issuer that the Authorization Server of the Credential Issuer trusts for this purpose.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

technically the wallet attestation is a signed attestation that can be used in the client authentication mechanisms, as outlined in my previous comment.

if agreed, I can therefore purpose a rewording also here

@paulbastian @peppelinux
Apply suggestions from code review
e7f7105 
Co-authored-by: Giuseppe De Marco <[email protected]>
@Sakurann Sakurann requested review from tplooker and Sakurann December 9, 2024 11:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@peppelinux peppelinux peppelinux requested changes

@c2bo c2bo c2bo approved these changes

@David-Chadwick David-Chadwick David-Chadwick approved these changes

@tlodderstedt tlodderstedt tlodderstedt approved these changes

@danielfett danielfett Awaiting requested review from danielfett

@jogu jogu Awaiting requested review from jogu

@pmhsfelix pmhsfelix Awaiting requested review from pmhsfelix

@samuelgoto samuelgoto Awaiting requested review from samuelgoto

@selfissued selfissued Awaiting requested review from selfissued

@awoie awoie Awaiting requested review from awoie

@bc-pi bc-pi Awaiting requested review from bc-pi

@babisRoutis babisRoutis Awaiting requested review from babisRoutis

@tplooker tplooker Awaiting requested review from tplooker

@Sakurann Sakurann Awaiting requested review from Sakurann

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

define how is wallet attestation used with VCI Issuer Trust Evidence / key attestations for OpenID4VCI
9 participants
@paulbastian @Sakurann @c2bo @pmhsfelix @TomCJones @tlodderstedt @peppelinux @David-Chadwick @tplooker