Copyright © 2023 World Wide Web Consortium. W3C® liability, trademark and permissive document license rules apply.
This specification defines how to secure credentials and presentations conforming to the [VC-DATA-MODEL], with JSON Object Signing and Encryption (JOSE), and CBOR Object Signing and Encryption (COSE) [RFC9052]. This enables the Verifiable Credential data model [VC-DATA-MODEL]to be implemented with standards for signing and encryption that are widely adopted.
This section describes the status of this document at the time of its publication. A list of current W3C publications and the latest revision of this technical report can be found in the W3C technical reports index at https://www.w3.org/TR/.
This document was published by the Verifiable Credentials Working Group as a Working Draft using the Recommendation track.
Publication as a Working Draft does not imply endorsement by W3C and its Members.
This is a draft document and may be updated, replaced or obsoleted by other documents at any time. It is inappropriate to cite this document as other than work in progress.
This document was produced by a group operating under the W3C Patent Policy. W3C maintains a public list of any patent disclosures made in connection with the deliverables of the group; that page also includes instructions for disclosing a patent. An individual who has actual knowledge of a patent which the individual believes contains Essential Claim(s) must disclose the information in accordance with section 6 of the W3C Patent Policy.
This document is governed by the 12 June 2023 W3C Process Document.
This specification describes how to secure media types expressing Verifiable Credentials and Verifiable Presentations as described in the [VC-DATA-MODEL], using approaches described by the OAUTH, JOSE, and COSE working groups at IETF. This includes JWTs [RFC7519], JWS [RFC7515], SD-JWT [SD-JWT], and COSE [RFC9052], and provides an approach using well-defined content types [RFC6838] and structured suffixes [MULTIPLE-SUFFIXES] to distinguish the data types of documents conforming to [VC-DATA-MODEL] from the data types of secured documents conforming to [VC-DATA-MODEL], defined in this specification.
JSON Web Signatures (JWS) [RFC7515] provide a standardized mechanism for digitally signing JSON documents. It provides a means to ensure the integrity, authenticity, and non-repudiation of the information contained in a JSON document. JWS enables secure communication and trust between parties by adding a cryptographic signature to a payload. This signature is generated using a private key and can be verified using the corresponding public key. JWS enables content integrity, authentication and non repudiation, protecting data from unauthorized modifications. The versatility and wide adoption of JWS make it an essential component for verifying the authenticity and integrity of various application media types, including authentication, authorization, and secure data exchange. These properties make JWS especially well suited to securing the JSON-LD [VC-DATA-MODEL] and through this to provide a means of supporting the three party model (issuer, holder, verifier) for exchange of verifiable credentials and verifiable presentations.
JSON Web Token (JWT) [RFC7519] is a widely-used means of expressing claims, represented in JSON, to be transferred between two parties. Providing a representation of the [VC-DATA-MODEL] for JWT allows existing systems and libraries to participate in the ecosystem described in Section ecosystem overview. A JWT encodes a set of claims as a JSON object that is secured via a JSON Web Signature (JWS) [RFC7515] and/or JSON Web Encryption (JWE) [RFC7516]. For this specification, the use of JWE is out of scope.
The working group is discussing how we might comment on recent work, that does make use of encryption in OpenID for Verifiable Presentations.
CBOR Object Signing and Encryption (COSE) [RFC9052] is a specification that defines a framework for representing signed and encrypted data using (Concise Binary Object Representation) [RFC8949] data structures. COSE provides a standardized way to secure the integrity, authenticity, and confidentiality of CBOR-encoded information. It offers a flexible and extensible set of cryptographic options, allowing for a wide range of algorithms to be used for signing and encryption. COSE supports two main operations: signing and encryption. For signing, COSE allows the creation of digital signatures over CBOR data using various algorithms such as HMAC, RSA, ECDSA, or EdDSA. These signatures provide assurance of data integrity and authenticity. COSE also supports encryption, enabling the confidentiality of CBOR data by encrypting it with symmetric or asymmetric encryption algorithms.
This section outlines how to secure documents conforming to the [VC-DATA-MODEL] using JOSE and COSE.
Documents conforming to the [VC-DATA-MODEL], and their associated media types, rely on JSON-LD, which is a flexible and extensible format for describing linked data, see JSON-LD Relationship to RDF.
A benefit to this approach is that payloads can be made to conform directly to the [VC-DATA-MODEL] without any mappings or transformation, while at the same time supporting registered claims that are understood in the context of JOSE and COSE.
It is RECOMMENDED that media types be used to distinguish verifiable credentials and verifiable presentations from other kinds of secured JSON or CBOR.
The most specific media type (or subtype) available SHOULD be used, instead of
more generic media types (or supertypes). For example, rather than the general
application/sd-jwt
, application/vc+ld+json+sd-jwt
ought to be used, unless there is a more specific media type that would even
better identify the secured envelope format.
If implementations do not know which media type to use, media types defined in this specification MUST be used.
This section details how to secure data payloads with the type
application/vc+ld+json
with JOSE.
[rfc7515] MAY be used to secure this media type.
The typ
parameter SHOULD be vc+ld+json+sd-jwt
When present, the cty
SHOULD be
vc+ld+json
See Common JOSE Header
Parameters
for additional details regarding usage of typ
and
cty
.
{
"@context": ["https://www.w3.org/ns/credentials/v2",
"https://www.w3.org/ns/credentials/examples/v2"
],
"id": "http://example.edu/credentials/3732",
"type": ["VerifiableCredential",
"UniversityDegreeCredential"
],
"issuer": "https://example.edu/issuers/14",
"issuanceDate": "2010-01-01T19:23:24Z",
"credentialSubject": {
"id": "did:example:123",
"degree": {
"type": "BachelorDegree",
"name": "Bachelor of Science and Arts"
}
}
}
graph LR
0("VerifiableCredential")
1{{"id"}}
2("http://example.edu/credentials/3732")
3(("type"))
4("UniversityDegreeCredential")
5("issuer")
6("https://example.edu/issuers/14")
7("issuanceDate")
8("2010-01-01T19:23:24Z")
9("credentialSubject")
10{{"id"}}
11("did:example:123")
12("degree")
13(("type"))
14("BachelorDegree")
15("name")
16("Bachelor of Science and Arts")
0 --- 1
1 --- 2
0 --- 3
3 --- 4
0 --- 5
5 --- 6
0 --- 7
7 --- 8
0 --- 9
9 --- 10
10 --- 11
9 --- 12
12 --- 13
13 --- 14
12 --- 15
15 --- 16
---------------- Issuer Claims ---------------- "@context": - https://www.w3.org/ns/credentials/v2 - https://www.w3.org/ns/credentials/examples/v2 !sd id: http://example.edu/credentials/3732 !sd type: - VerifiableCredential - UniversityDegreeCredential issuer: https://example.edu/issuers/14 issuanceDate: 2010-01-01T19:23:24Z credentialSubject: !sd id: did:example:123 degree: !sd type: BachelorDegree name: Bachelor of Science and Arts ---------------- Holder Disclosure ---------------- issuer: id: True credentialStatus: id: True credentialSubject: id: True type: False ---------------- Decoded Protected Header ---------------- { "alg": "ES384" } ---------------- Decoded Protected Claimset ---------------- { "@context": [ "https://www.w3.org/ns/credentials/v2", "https://www.w3.org/ns/credentials/examples/v2" ], "issuer": "https://example.edu/issuers/14", "issuanceDate": "2010-01-01T19:23:24Z", "credentialSubject": { "degree": { "name": "Bachelor of Science and Arts" }, "id": "did:example:123" }, "iss": "did:web:issuer.example", "iat": 1694131638, "exp": 1725754038, "cnf": { "jwk": { "kty": "EC", "crv": "P-384", "alg": "ES384", "x": "_3GhECmFQiEqcseS7o1E4-OtnFPCVYEkzZoRup7UJdD_fl_PhRZAsVUJ95aj8cns", "y": "GZYuZ5GQhOYJWrMZ-oGflX2zTiVAeyCMvC4ZANkxnFJ36_8aer74itTjdg9Vx4rs" } } } ---------------- Compact Encoded Selective Disclosure JSON Web Token ---------------- eyJhbGciOiJFUzM4NCJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiLCJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvZXhhbXBsZXMvdjIiXSwiaXNzdWVyIjoiaHR0cHM6Ly9leGFtcGxlLmVkdS9pc3N1ZXJzLzE0IiwiaXNzdWFuY2VEYXRlIjoiMjAxMC0wMS0wMVQxOToyMzoyNFoiLCJjcmVkZW50aWFsU3ViamVjdCI6eyJkZWdyZWUiOnsibmFtZSI6IkJhY2hlbG9yIG9mIFNjaWVuY2UgYW5kIEFydHMiLCJfc2QiOlsiMjVsNVBYMnFqdGRjelU5LUZzbDRkR2hWYmoxMjB6WUhMbnoxR2gyMjR0TSJdfSwiX3NkIjpbIkRMcVpEY1lVVDdmU1dvaTlfSktmR2x2aTRURVlzYl9lLWM1QTVCWWphMWciXX0sIl9zZCI6WyIwSTVqUXN3M3A2X01LMnF6QXFtdTh2enpjdzg5SDJMLWo1dXcycmhVOG00Iiwic2lIT1V4U3lvU3VwYWRIWHJCcWtNVHhXS2hBcVV6a1FrVmVQejhQRk1WVSJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImlzcyI6ImRpZDp3ZWI6aXNzdWVyLmV4YW1wbGUiLCJpYXQiOjE2OTQxMzE2MzgsImV4cCI6MTcyNTc1NDAzOCwiY25mIjp7Imp3ayI6eyJrdHkiOiJFQyIsImNydiI6IlAtMzg0IiwiYWxnIjoiRVMzODQiLCJ4IjoiXzNHaEVDbUZRaUVxY3NlUzdvMUU0LU90bkZQQ1ZZRWt6Wm9SdXA3VUpkRF9mbF9QaFJaQXNWVUo5NWFqOGNucyIsInkiOiJHWll1WjVHUWhPWUpXck1aLW9HZmxYMnpUaVZBZXlDTXZDNFpBTmt4bkZKMzZfOGFlcjc0aXRUamRnOVZ4NHJzIn19fQ.7seTIAAot7HrfTzykoQweZ6P1BNNFOYc0hYpFY1-2RtsdiBJwZVtV_mnNzutT6_F2VGbMN90wdx7-R3jPMWGitPXMO3g9Ko-94wfA7KZUAbN_m1WCxmV3hXy0z0TdkVC~WyJMX1hsSV9ZUFdnVzJlNTVPV1RiSGdnIiwgImlkIiwgImRpZDpleGFtcGxlOjEyMyJd~eyJhbGciOiJFUzM4NCIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6Im54X3R6aXpZbm9KLTRNQ1VhMVkwUWciLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTQxMzE2Mzh9.iK25jsgBFRAgfJdvBMQFz1bwXPzHh8wpZJXzB4WRoScOZX0Ri9lsC-3jkzganL1Axe12z_MwLKfvFF70wd0--pISJmT6uhyd5-sXfC5FUE7X_Z7SwTnhmQzFKe4abSMg
This section details how to secure verifiable presentations
with the type
application/vp+ld+json
with JOSE.
[rfc7515] MAY be used to secure this media type.
The typ
parameter SHOULD be
vp+ld+json+jwt
When present, the cty
parameter SHOULD be
vp+ld+json
See Common JOSE Header
Parameters
for additional details regarding usage of typ
and
cty
.
{
"@context": ["https://www.w3.org/ns/credentials/v2"],
"type": ["VerifiablePresentation"]
}
graph LR
69("VerifiablePresentation")
+sd-jwt does not support algorithm none.
{
"@context": ["https://www.w3.org/ns/credentials/v2"],
"type": ["VerifiablePresentation"]
}
graph LR
70("VerifiablePresentation")
---------------- Issuer Claims ---------------- "@context": - https://www.w3.org/ns/credentials/v2 !sd type: - VerifiablePresentation ---------------- Holder Disclosure ---------------- id: True type: True holder: id: True ---------------- Decoded Protected Header ---------------- { "alg": "ES384" } ---------------- Decoded Protected Claimset ---------------- { "@context": [ "https://www.w3.org/ns/credentials/v2" ], "iss": "did:web:issuer.example", "iat": 1694131638, "exp": 1725754038, "cnf": { "jwk": { "kty": "EC", "crv": "P-384", "alg": "ES384", "x": "EHrG599mUiOdwy-mDhaFevmA5hnpayoysUQnlBKi3mZx6mvucfB9JufpCwazdMVV", "y": "7E6mRWX3IxJGJQE8nRjOqdkb8rrPdAZH_S0BBYZnaOzEZLNV5HgRM3IkfNczRaHs" } }, "type": [ "VerifiablePresentation" ] } ---------------- Compact Encoded Selective Disclosure JSON Web Token ---------------- eyJhbGciOiJFUzM4NCJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwiX3NkIjpbIlVhSG1yYzRMUDhMbWVZX213dzVUQVFBY1Q4YUU5Y1dYTnZaVDNQSUc0aEkiXSwiX3NkX2FsZyI6InNoYS0yNTYiLCJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwiaWF0IjoxNjk0MTMxNjM4LCJleHAiOjE3MjU3NTQwMzgsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJjcnYiOiJQLTM4NCIsImFsZyI6IkVTMzg0IiwieCI6IkVIckc1OTltVWlPZHd5LW1EaGFGZXZtQTVobnBheW95c1VRbmxCS2kzbVp4Nm12dWNmQjlKdWZwQ3dhemRNVlYiLCJ5IjoiN0U2bVJXWDNJeEpHSlFFOG5Sak9xZGtiOHJyUGRBWkhfUzBCQllabmFPekVaTE5WNUhnUk0zSWtmTmN6UmFIcyJ9fX0.MKjMWrOtqPSPbLTTj_12RMZ4SlXroJ-XXM__645fT9RMJ9tBj0jV4RDzFMzo3Y4Rkozl8Iu6L44p_jSsJGrIPRgjj95cj90Bq41DIUDZQouw7vMb1HGk6zeyLHec4p1c~WyJQOGJXejc2aHVBSklzd1paOXRaajFBIiwgInR5cGUiLCBbIlZlcmlmaWFibGVQcmVzZW50YXRpb24iXV0~eyJhbGciOiJFUzM4NCIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6IjhfRFJFTTVHQ2xzLVp0WTZxTmVlVFEiLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTQxMzE2Mzh9.s0Ky0Mirkm09X2eJJCv6-AeWJlYrlOYSYjpgNz4g0eIINGC3TDbGf4yHkcnwhqBdn-nlzlNlSpyDgNGWY9jVoYgMW43zE3y1L_HWMC2YUPihiS2GWyNOSg6cDWwRXoxT
{
"@context": ["https://www.w3.org/ns/credentials/v2",
"https://www.w3.org/ns/credentials/examples/v2"
],
"type": ["VerifiablePresentation"],
"holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
}
graph LR
71("VerifiablePresentation")
72("holder")
73("urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs")
71 --- 72
72 --- 73
---------------- Issuer Claims ---------------- "@context": - https://www.w3.org/ns/credentials/v2 - https://www.w3.org/ns/credentials/examples/v2 !sd type: - VerifiablePresentation holder: urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs ---------------- Holder Disclosure ---------------- id: True type: True holder: id: True ---------------- Decoded Protected Header ---------------- { "alg": "ES384" } ---------------- Decoded Protected Claimset ---------------- { "@context": [ "https://www.w3.org/ns/credentials/v2", "https://www.w3.org/ns/credentials/examples/v2" ], "holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs", "iss": "did:web:issuer.example", "iat": 1694131638, "exp": 1725754038, "cnf": { "jwk": { "kty": "EC", "crv": "P-384", "alg": "ES384", "x": "ku5tpHYUIL7XJQY5eSYptGleAxSbBt3Lv-WCJFaM50BnI_xT5TzUDp2s8GkI2o2o", "y": "ugGhmFSIPqIektqSgNEF44bqIul6in_WyFCWWwJORgvqHWhXJPiCqv59mcJ9wzYy" } }, "type": [ "VerifiablePresentation" ] } ---------------- Compact Encoded Selective Disclosure JSON Web Token ---------------- eyJhbGciOiJFUzM4NCJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiLCJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvZXhhbXBsZXMvdjIiXSwiaG9sZGVyIjoidXJuOmlldGY6cGFyYW1zOm9hdXRoOmp3ay10aHVtYnByaW50OnNoYS0yNTY6TnpiTHNYaDh1RENjZC02TU53WEY0V183bm9XWEZaQWZIa3hac1JHQzlYcyIsIl9zZCI6WyI3bGdvMXpnLUNNYnVaNGdyUmJ4blVXeVRPRTBhUTJGZkM0NXhzNnBnckp3Il0sIl9zZF9hbGciOiJzaGEtMjU2IiwiaXNzIjoiZGlkOndlYjppc3N1ZXIuZXhhbXBsZSIsImlhdCI6MTY5NDEzMTYzOCwiZXhwIjoxNzI1NzU0MDM4LCJjbmYiOnsiandrIjp7Imt0eSI6IkVDIiwiY3J2IjoiUC0zODQiLCJhbGciOiJFUzM4NCIsIngiOiJrdTV0cEhZVUlMN1hKUVk1ZVNZcHRHbGVBeFNiQnQzTHYtV0NKRmFNNTBCbklfeFQ1VHpVRHAyczhHa0kybzJvIiwieSI6InVnR2htRlNJUHFJZWt0cVNnTkVGNDRicUl1bDZpbl9XeUZDV1d3Sk9SZ3ZxSFdoWEpQaUNxdjU5bWNKOXd6WXkifX19.qgaAy_VvuLrXaiublmS6OgSvaWzl-eZ74hPRv034daKouOmcijuQTiD5WzXipTL6olcpoUAL9lr_zS5j8XI_WkWZQh_Z_r15Wr_87GbS5A-zq0PP-GWNvR2gG3HCxh9Y~WyJhMTY4ZC1STG9hcVNpVGNxd1RZcUp3IiwgInR5cGUiLCBbIlZlcmlmaWFibGVQcmVzZW50YXRpb24iXV0~eyJhbGciOiJFUzM4NCIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6IlZZYy16RmFkTG0zWC1BdDZQN2EtMGciLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTQxMzE2Mzh9.x6x-Cj4Cb4ARqZwT-eB0ik7Ksni6rBj5n8YMx1ZrMTKVvMDJ830d3aWQ824eEd2wy5-maOw3hpg5fsxpFsnDHnXm-N8eKgVSQuGjJSjbboaoQEhRvcu-VSJkVXYuFheT
{
"@context": ["https://www.w3.org/ns/credentials/v2"],
"type": ["VerifiablePresentation"],
"holder": {
"id": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs",
"type": "Organization",
"name": "Contoso"
}
}
graph LR
74("VerifiablePresentation")
75("holder")
76{{"id"}}
77("urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs")
78(("type"))
79("Organization")
80("name")
81("Contoso")
74 --- 75
75 --- 76
76 --- 77
75 --- 78
78 --- 79
75 --- 80
80 --- 81
---------------- Issuer Claims ---------------- "@context": - https://www.w3.org/ns/credentials/v2 !sd type: - VerifiablePresentation holder: !sd id: urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs !sd type: Organization name: Contoso ---------------- Holder Disclosure ---------------- id: True type: True holder: id: True ---------------- Decoded Protected Header ---------------- { "alg": "ES384" } ---------------- Decoded Protected Claimset ---------------- { "@context": [ "https://www.w3.org/ns/credentials/v2" ], "holder": { "name": "Contoso", "id": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs" }, "iss": "did:web:issuer.example", "iat": 1694131638, "exp": 1725754038, "cnf": { "jwk": { "kty": "EC", "crv": "P-384", "alg": "ES384", "x": "JN_u6Og_L6DNvots4Bh0myqoYDBzEUZCKW4t8puND8Nxa2ep-v1KvNXRVkxeU7Pu", "y": "-ZjIJi_fLseoi_x6QDFX7iWTt5WUdy7LGp4SJgGmTnVJQDpQ7_7tNXkWhwRyIKlq" } }, "type": [ "VerifiablePresentation" ] } ---------------- Compact Encoded Selective Disclosure JSON Web Token ---------------- eyJhbGciOiJFUzM4NCJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwiaG9sZGVyIjp7Im5hbWUiOiJDb250b3NvIiwiX3NkIjpbIjA2REw2dTc5bWdtbzRpdjdoSE1veHpwRUx0WGVpaTd4blI0MWZiM1NnMmciLCJ2RmxocXhxX3FucVFLeFJBbHU0VWV1bllkQzhvWG1sWVp0bUU1MVlPYUpFIl19LCJfc2QiOlsiRE1EQnl1elZ4NkhJSVNMM1ZUZFp3WDRRQ1dKcXY5SE9udnNJNXBmRUVjUSJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImlzcyI6ImRpZDp3ZWI6aXNzdWVyLmV4YW1wbGUiLCJpYXQiOjE2OTQxMzE2MzgsImV4cCI6MTcyNTc1NDAzOCwiY25mIjp7Imp3ayI6eyJrdHkiOiJFQyIsImNydiI6IlAtMzg0IiwiYWxnIjoiRVMzODQiLCJ4IjoiSk5fdTZPZ19MNkROdm90czRCaDBteXFvWURCekVVWkNLVzR0OHB1TkQ4TnhhMmVwLXYxS3ZOWFJWa3hlVTdQdSIsInkiOiItWmpJSmlfZkxzZW9pX3g2UURGWDdpV1R0NVdVZHk3TEdwNFNKZ0dtVG5WSlFEcFE3Xzd0TlhrV2h3UnlJS2xxIn19fQ.eOI027Nc-X1Rb5WN_9j-nCyA0n3PrPs4ZLYDJpxRAj-o-6T-fnI9JOcVVbzBnUoyj_DyHGLjlj4VU6whqsG1tV4ZUzXQahWMm28XxZ04U9sSresfEyGJIWepsRvH0lr3~WyJBZWFnMnFkREdCUG5NYV9LWmRERzJBIiwgImlkIiwgInVybjppZXRmOnBhcmFtczpvYXV0aDpqd2stdGh1bWJwcmludDpzaGEtMjU2Ok56YkxzWGg4dURDY2QtNk1Od1hGNFdfN25vV1hGWkFmSGt4WnNSR0M5WHMiXQ~WyJqbEV6UTJaZGdQS2hkbkFXbDRTVGNBIiwgInR5cGUiLCBbIlZlcmlmaWFibGVQcmVzZW50YXRpb24iXV0~eyJhbGciOiJFUzM4NCIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6IjNzMVBvX0pBeTJ1VXRHdUdROFNXcnciLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTQxMzE2Mzh9.72WmHF_B5s2-T3zSCt4vsm9jWqimLJzPuEWn7mFL6NOiAfeGXR6Ce_5v-0-itzhfXvsYHD14yP5zsfErsvgQLHb3SSjZhNSMvx_rksQHQB6Y7M7uI5i28M09nGMKB8Jh
COSE [rfc9052] is a common approach to encoding and securing information using CBOR [rfc8949]. Verifiable credentials MAY be secured using COSE [rfc9052] and SHOULD be identified through use of content types as outlined in this section.
This section details how to secure data with the type
application/vc+ld+json
with COSE.
[rfc9052] MAY be used to secure this media type.
When using this approach, the type (TBD)
SHOULD be
vc+ld+json+cose
See draft-jones-cose-typ-header-parameter, regarding progress towards explicit typing for COSE.
When using this approach, the content type (3)
SHOULD be application/vc+ld+json
See Common COSE Header Parameters for additional details.
See Concise Binary Object Representation (CBOR) Tags for additional details.
There is no registered tag for typ
in COSE.
This prevents following the guidance from the JWT BCP
This section is non-normative.
Issuers, holders and verifiers might rely on clients, as defined in RFC4949. Such clients are often referred to as wallets or digital credential wallets, when they support storing and presenting digital credentials.
In order to meet verifier requirements, some issuers might need to assess the quality of a wallet used by a holder, prior to issuing and delivering credentials to a holder.
For example, some verifiers might require that cryptographic material associated with a holder, be protected at specific assurance levels. (See NIST 800-63-3: Authenticator Assurance Levels.)
Also see OAuth 2.0 Attestation-Based Client Authentication .
The working group is still discussing how to close many related issues.
Originally posted by @TallTed in #111 (comment)
line 377 says (and another line says the same) --
If <code>kid</code> is also present, it is expected to be useful to distinguish the specific key used.
-- in response to which I ask --
how is
kid
to beuseful to distinguish the specific key used
? This cries out for an example, or a fair amount of additional prose.
Just read that section, and I have to say that it's not intuitive at all. I think it would be worth either: adding an example that refers to this controller document, pointing to the spec you mentioned, or explicitly stating the relationship between controller docs and `iss` & `kid`.
Originally posted by @andresuribe87 in #104 (comment)
https://www.w3.org/TR/vc-data-model/#jwt-encoding shows:
kid MAY be used if there are multiple keys associated with the issuer of the JWT. The key discovery is out of the scope of this specification. For example, the kid can refer to a key in a DID document, or can be the identifier of a key inside a JWKS.
I'd like some clarification on the optionality of the "kid" field. My guess is that VCs/VPs are trying to be generic regarding issuers/holders, allowing for URIs, which precludes the possibility of giving any more details about how the "kid" field should be used. Is that right?
I'm coming from a DID-centric ecosystem, and in that scenario it seems that there's no reason not to set the "kid" field on a JWT-formatted VC/VP to the DID fragment URL of the specific key used to sign. From w3c/vc-data-model#914 I understand that it would still be necessary to tie the "kid" to the "iss" field, but that seems fine.
As far as I can tell, if the "kid" field is missing, and assuming we're working with DIDs here, the process to resolve the signing key has to be:
To me, this seems sloppy, involving unnecessary complexity and computation, and making detecting errors in implementations harder. It also wouldn't scale if for whatever reason a DID had very many keys (inefficient at best, possible DoS at worst). Maybe I'm missing something here. Can anyone comment on this? Thanks.
See https://github.com/decentralized-identity/did-jose-extensions/blob/master/options.md
^ this guidance is ancient, I believe we can do better.
Can we add an explanation why do these members need to be translated to the equivalents of the JWT claims?
iss, nbf, all of them are optional in RFC 7519 itself. They only become required when the JWT is used for a specific purpose, and the only place I can think of right now is an ID Token.
See: #11 (comment)
Originally posted by @TallTed in #111 (comment)
line 377 says (and another line says the same) --
If <code>kid</code> is also present, it is expected to be useful to distinguish the specific key used.
-- in response to which I ask --
how is
kid
to beuseful to distinguish the specific key used
? This cries out for an example, or a fair amount of additional prose.
Originally posted by @TallTed in #111 (comment)
line 377 says (and another line says the same) --
If <code>kid</code> is also present, it is expected to be useful to distinguish the specific key used.
-- in response to which I ask --
how is
kid
to beuseful to distinguish the specific key used
? This cries out for an example, or a fair amount of additional prose.
In order to complete the verification process, a verifier needs to obtain the cryptographic keys used to secure the credential.
There are several different ways to discover the verification keys of the issuers and holders.
When found in the Protected Header, or the Protected Claimset, members present in IANA Assignments for JSON Web Token (JWT) and IANA Assignments for JSON Object Signing and Encryption (JOSE) are to be interpreted according to the associated specifications referenced by IANA.
Registered claims that are present in either the Protected Header or the Claimset can be used to help verifiers discover verification keys.
If kid
is present in the Protected Header,
a verifier can use this parameter
to obtain a JSON Web Key to use in the
verification process.
If iss
is present in the Protected Header
or the JWT Claims ,
a verifier can use this parameter
to obtain a JSON Web Key to use in the
verification process.
If kid
is also present in the
Protected Header, it is expected to be useful to
distinguish the specific key used.
If cnf
is present in the Protected Header
or the JWT Claims ,
a verifier can use this parameter
to obtain a JSON Web Key to use in the
verification process.
If kid
is also present in the
Protected Header, it is expected to be
useful to distinguish the specific key used.
The working group is currently exploring how Defining Well-Known Uniform Resource Identifiers (URIs) could be leveraged to assist a verifier in discovering verification keys for issuers and holders.
OpenID Connect uses Well-Known Uniform Resource Identifiers (URIs) to enable issuer key discovery.
The verifier (or relying party)
decodes the JWT claimset, and obtains the iss
claim.
The iss
value is converted to the well-known OpenID Connect Configuration
Endpoint URL by applying the following URI template:
https://{iss}/.well-known/openid-configuration
The OIDC Configuration Endpoint URL is dereferenced to a JSON document which contains issuer configuration details,
one of which is the jwks_uri
. This URL might also be well-known, for example:
https://{iss}/.well-known/jwks
The OIDC jwks_uri
is dereferenced to a JSON Web Key Set.
The content type of the key set could be application/jwk-set+json or application/json.
Here is an example of a key set used by an issuer:
{
"keys": [
{
"alg": "RS256",
"kty": "RSA",
"use": "sig",
"n": "wW9TkSbcn5FV3iUJ-812sqTvwTGCFrDm6vD2U-g23gn6rrBdFZQbf2bgEnSkolph6CanOYTQ1lKVhKjHLd6Q4MDVGidbVBhESxib2YIzJVUS-0oQgizkBEJxyHI4Zl3xX_sdA_yegLUi-Ykt_gaMPSw_vpxe-pBxu-jd14i-jDfwoPJUdF8ZJGS9orCPRiHCYLDgOscC9XibH9rUbTvG8q4bAPx9Ox6malx4OLvU3pXVjew6LG3iBi2YhpCWe6voMvZJYXqC1n5Mk_KOdGcCFtDgu3I56SGSfsF7-tI7qG1ZO8RMuzqH0LkJVirujYzXrnMZ7WgbMPXmHU8i4z04zw",
"e": "AQAB",
"kid": "NTBGNTJEMDc3RUE3RUVEOTM4NDcyOEFDNzEyOTY5NDNGOUQ4OEU5OA",
"x5t": "NTBGNTJEMDc3RUE3RUVEOTM4NDcyOEFDNzEyOTY5NDNGOUQ4OEU5OA",
"x5c": [
"MIIDCzCCAfOgAwIBAgIJANPng0XRWwsdMA0GCSqGSIb3DQEBBQUAMBwxGjAYBgNVBAMMEWNvbnRvc28uYXV0aDAuY29tMB4XDTE0MDcxMTE2NTQyN1oXDTI4MDMxOTE2NTQyN1owHDEaMBgGA1UEAwwRY29udG9zby5hdXRoMC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDBb1ORJtyfkVXeJQn7zXaypO/BMYIWsObq8PZT6DbeCfqusF0VlBt/ZuASdKSiWmHoJqc5hNDWUpWEqMct3pDgwNUaJ1tUGERLGJvZgjMlVRL7ShCCLOQEQnHIcjhmXfFf+x0D/J6AtSL5iS3+Bow9LD++nF76kHG76N3XiL6MN/Cg8lR0XxkkZL2isI9GIcJgsOA6xwL1eJsf2tRtO8byrhsA/H07HqZqXHg4u9TeldWN7DosbeIGLZiGkJZ7q+gy9klheoLWfkyT8o50ZwIW0OC7cjnpIZJ+wXv60juobVk7xEy7OofQuQlWKu6NjNeucxntaBsw9eYdTyLjPTjPAgMBAAGjUDBOMB0GA1UdDgQWBBTLarHdkNa5CzPyiKJU51t8JWn9WTAfBgNVHSMEGDAWgBTLarHdkNa5CzPyiKJU51t8JWn9WTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQA2FOjm+Bpbqk59rQBC0X6ops1wBcXH8clnXfG1G9qeRwLEwSef5HPz4TTh1f2lcf4Pcq2vF0HbVNJFnLVV+PjR9ACkto+v1n84i/U4BBezZyYuX2ZpEbv7hV/PWxg8tcVrtyPaj60UaA/pUA86CfYy+LckY4NRKmD7ZrcCzjxW2hFGNanfm2FEryxXA3RMNf6IiW7tbJ9ZGTEfA/DhVnZgh/e82KVX7EZnkB4MjCQrwj9QsWSMBtBiYp0/vRi9cxDFHlUwnYAUeZdHWTW+Rp2JX7Qwf0YycxgyjkGAUEZc4WpdNiQlwYf5G5epfOtHGiwiJS+u/nSYvqCFt57+g3R+"
]
},
{
"alg": "RS256",
"kty": "RSA",
"use": "sig",
"n": "ylgVZbNR4nlsU_AbU8Zd7ZhVfmYuwq-RB1_YQWHY362pAed-qgSXV1QmKwCukQ2WDsPHWgpPuEf3O_acmJcCiSxhctpBr5WKkji5o50YX2FqC3xymGkYW5NilvFznKaKU45ulBVByrcb3Vt8BqqBAhaD4YywZZKo7mMudcq_M__f0_tB4fHsHHe7ehWobWtzAW7_NRP0_FjB4Kw4PiqJnChPvfbuxTCEUcIYrshRwD6GF4D_oLdeR44dwx4wtEgvPOtkQ5XIGrhQC_sgWcb2jh7YXauVUjuPezP-VkK7Wm9mZRe758q43SWxwT3afo5BLa3_YLWazqcpWRXn9QEDWw",
"e": "AQAB",
"kid": "aMIKy_brQk3nLd0PKd9ln",
"x5t": "-xcTyx47q3ddycG7LtE6QCcETbs",
"x5c": [
"MIIC/TCCAeWgAwIBAgIJH62yWyX7VxxQMA0GCSqGSIb3DQEBCwUAMBwxGjAYBgNVBAMTEWNvbnRvc28uYXV0aDAuY29tMB4XDTIwMDMxMTE5Mjk0N1oXDTMzMTExODE5Mjk0N1owHDEaMBgGA1UEAxMRY29udG9zby5hdXRoMC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKWBVls1HieWxT8BtTxl3tmFV+Zi7Cr5EHX9hBYdjfrakB536qBJdXVCYrAK6RDZYOw8daCk+4R/c79pyYlwKJLGFy2kGvlYqSOLmjnRhfYWoLfHKYaRhbk2KW8XOcpopTjm6UFUHKtxvdW3wGqoECFoPhjLBlkqjuYy51yr8z/9/T+0Hh8ewcd7t6Fahta3MBbv81E/T8WMHgrDg+KomcKE+99u7FMIRRwhiuyFHAPoYXgP+gt15Hjh3DHjC0SC8862RDlcgauFAL+yBZxvaOHthdq5VSO497M/5WQrtab2ZlF7vnyrjdJbHBPdp+jkEtrf9gtZrOpylZFef1AQNbAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFPVdE4SPvuhlODV0GOcPE4QZ7xNuMA4GA1UdDwEB/wQEAwIChDANBgkqhkiG9w0BAQsFAAOCAQEAu2nhfiJk/Sp49LEsR1bliuVMP9nycbSz0zdp2ToAy0DZffTd0FKk/wyFtmbb0UFTD2aOg/WZJLDc+3dYjWQ15SSLDRh6LV45OHU8Dkrc2qLjiRdoh2RI+iQFakDn2OgPNgquL+3EEIpbBDA/uVoOYCbkqJNaNM/egN/s2vZ6Iq7O+BprWX/eM25xw8PMi+MU4K2sJpkcDRwoK9Wy8eeSSRIGYnpKO42g/3QI9+BRa5uD+9shG6n7xgzAPGeldUXajCThomwO8vInp6VqY8k3IeLEYoboJj5KMfJgOWUkmaoh6ZBJHnCogvSXI35jbxCxmHAbK+KdTka/Yg2MadFZdA=="
]
}
]
}
The verifier (or relying party)
uses kid
from the protected header of the JWT
to identify the public key, controlled by the issuer, and uses it to verify
the token.
The verifier (or relying party) verifies the signature on the JWT. After verification, the claims the issuer has made about the subject can be reviewed or processed, because the integrity of the claims has been protected by a digital signature verification.
The normative statements in Registered Header Parameter Names apply to securing credentials and presentations.
The normative statements in JOSE Header apply to securing credentials and presentations.
The data model for the protected header is JSON (application/json), not JSON-LD (application/ld+json).
The normative statements in Replicating Claims as Header Parameters apply to securing claims about a credential subject.
When replicating claims from the claimset to the header, it is
RECOMMENDED to use [RFC7519], IANA
Assignments for Header Parameters, and IANA
Assignments for JSON Web Token (JWT)
to identify any reserved claims that might be confused with
members of the [[VC-DATA-MODEL]. This includes but is not
limited to: iss
, kid
,
alg
, iat
,
exp
and cnf
.
The registered claim names vc
and vp
MUST NOT be present as header parameters.
When present, members of the header are to be interpreted and processed according to IANA Assignments for JSON Web Token (JWT) and IANA Assignments for JSON Object Signing and Encryption (JOSE).
Additional members may be present, if they are not understood, they MUST be ignored.
As well as sections marked as non-normative, all authoring guidelines, diagrams, examples, and notes in this specification are non-normative. Everything else in this specification is normative.
The key words MAY, MUST, MUST NOT, RECOMMENDED, and SHOULD in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.
The Verifiable Credentials Data Model v1.1 describes the approach taken by JSON Web
Tokens to secure claimsets as applying an
external proof
.
The normative statements in Securing
Verifiable Credentials apply to securing
application/vc+ld+json
and
application/vp+ld+json
as application/vc+ld+json+jwt
and
application/vp+ld+json+jwt
.
For clarity, these requirements are repeated here:
At least one securing mechanism, and the details necessary to evaluate it, MUST be expressed for a credential or presentation to be a verifiable credential or verifiable presentation; that is, to be verifiable.
Methods of securing credentials or presentations that embed a proof in the data model MUST use the proof property.
Methods of securing credentials or presentations that use an external proof MAY use the proof property.
One or more cryptographic proofs that can be used to detect tampering and verify the authorship of a credential or presentation. The specific method used for an embedded proof MUST be included using the type property.
The type VerifiableCredential
and
VerifiablePresentation
are RDF Classes.
The presence of the word "Verifiable" does not convey a
cryptographic verification capability exists.
The presence of the JSON proof
member does not
convey a cryptographic verification capability exists.
The presence of the JSON proof
member is
optional in both VerifiableCredential
and
VerifiablePresentation
.
The presence of the JSON proof
member is
optional in both application/vc+ld+json
and
application/vp+ld+json
.
JSON Web Token implementers are advised to review Implementation Requirements.
Accordingly, Issuers, Holders and Verifiers MUST understand the
JSON Web Token header parameter
"alg": "none"
when securing the [VC-DATA-MODEL]
with JSON Web Tokens.
When content types from the [VC-DATA-MODEL] are secured using
JSON Web Tokens, the header parameter "alg":
"none"
, MUST be used to communicate that a claimset (a
Verifiable Credential or a Verifiable Presentation) has no
integrity protection.
When a JSON Web Token claimset (a Verifiable Credential or a
Verifiable Presentation) contains
proof
, and the JSON Web Token header contains
"alg": "none"
, the claimset MUST be considered to
have no integrity protection.
Verifiable Credentials and Verifiable Presenatations are not
required to be secured or integrity protected or to contain a
proof
member.
Issuers, Holders and Verifiers MUST ignore all claimsets that have no integrity protection.
This specification registers the
application/vc+ld+json+jwt
Media Type for
identifying a Verifiable Credential that has been secured
using a JWT.
Type name: | application |
Subtype name: | vc+ld+json+jwt |
Required parameters: | None |
Encoding considerations: |
application/vc+ld+json+jwt values are encoded as a
series of base64url encoded values (some of which may be the
empty string) each separated from the next by a single
period ('.') character.
|
Security considerations: |
As defined in this specification. See also the security considerations in [RFC7519]. |
Contact: | W3C Verifiable Credentials Working Group public-vc-wg@w3.org |
This specification registers the
application/vp+ld+json+jwt
Media Type for
identifying a Verifiable Presentation that has been secured
using a JWT.
Type name: | application |
Subtype name: | vp+ld+json+jwt |
Required parameters: | None |
Encoding considerations: |
application/vp+ld+json+jwt values are encoded as a
series of base64url encoded values (some of which may be the
empty string) each separated from the next by a single
period ('.') character.
|
Security considerations: |
As defined in this specification. See also the security considerations in [RFC7519]. Be advised, per the [VC-DATA-MODEL], verifiable presentations are not required to be secured. This "typ" value might be paired with "alg: none", in headers. |
Contact: | W3C Verifiable Credentials Working Group public-vc-wg@w3.org |
This specification registers the
application/vc+ld+json+sd-jwt
Media Type specifically for
identifying a Selective Disclosure for JWTs (SD-JWT)
conforming to the Verifiable Credentials.
Type name: | application |
Subtype name: | vc+ld+json+sd-jwt |
Required parameters: | None |
Encoding considerations: | binary; application/sd-jwt values are a series of base64url-encoded values (some of which may be the empty string) separated by period ('.') or tilde ('~') characters. |
Security considerations: |
As defined in this specification. See also the security considerations in Selective Disclosure for JWTs (SD-JWT). |
Contact: | W3C Verifiable Credentials Working Group public-vc-wg@w3.org |
This section retains deprecated registered claim names that were previously submitted to the Internet Engineering Steering Group (IESG) for review, approval, and registration with IANA in the "JSON Web Token Claims Registry".
These are registered claims at:
As it says, the change controller is IESG, but it references v1.0 of the data model, specifically:
In v2, we removed these from the core data model, and we removed them from this specification.
Should we tell the IESG to update the registry in any way?
Claim Name: | "vc" |
---|---|
Claim Description: | Verifiable Credential |
Change Controller: | W3C |
Specification Document(s): | Section 6.3.1.2: JSON Web Token Extensions of Verifiable Credentials Data Model 1.0 |
Claim Name: | "vp" |
---|---|
Claim Description: | Verifiable Presentation |
Change Controller: | W3C |
Specification Document(s): | Section 6.3.1.2: JSON Web Token Extensions of Verifiable Credentials Data Model 1.0 |
Verifiable Credentials often contain sensitive information that needs to be protected to ensure the privacy and security of organizations and individuals. This section outlines some privacy considerations relevant to implementers and users.
Implementers are advised to note and abide by all privacy considerations called out in the [VC-DATA-MODEL].
Implementers are additionally advised to reference the Privacy Consideration section of the JWT specification for privacy guidance.
In addition to the privacy recommendations in the [VC-DATA-MODEL], the following considerations are given:
Minimization of data: It is considered best practice for Verifiable Credentials to only contain the minimum amount of data necessary to achieve their intended purpose. This helps to limit the amount of sensitive information that is shared or stored unnecessarily.
Informed consent: It is considered best practice that individuals be fully informed about how their data will be used and provide the ability to consent to or decline the use of their data. This helps to ensure that individuals maintain control over their own personal information.
Data protection: It is considered best practice to protect Verifiable Credentials using strong encryption and other security measures to prevent unauthorized access, modification, or disclosure.
These considerations are not exhaustive, and implementers and users are advised to consult additional privacy resources and best practices to ensure the privacy and security of Verifiable Credentials implemented using VC-JWT.
This section outlines security considerations for implementers and users of this specification. It is important to carefully consider these factors to ensure the security and integrity of Verifiable Credentials when implemented using JWTs.
When implementing VC-JWTs, it is essential to address all security issues relevant to broad cryptographic applications. This especially includes protecting the user's asymmetric private and symmetric secret keys, as well as employing countermeasures against various attacks. Failure to adequately address these issues could compromise the security and integrity of Verifiable Credentials, potentially leading to unauthorized access, modification, or disclosure of sensitive information.
Implementers are advised to follow best practices and established cryptographic standards to ensure the secure handling of keys and other sensitive data. Additionally, conduct regular security assessments and audits to identify and address any vulnerabilities or threats.
Follow all security considerations outlined in [rfc7515] and [rfc7519].
When utilizing JSON-LD, take special care around remote retrieval of contexts and follow the additional security considerations noted in [json-ld11].
As noted in [rfc7515] when utilizing JSON [rfc7159], strict validation is a security requirement. If malformed JSON is received, it may be impossible to reliably interpret the producer's intent, potentially leading to ambiguous or exploitable situations. To prevent these risks, it is essential to use a JSON parser that strictly validates the syntax of all input data. It is essential that any JSON inputs that do not conform to the JSON-text syntax defined in [rfc7159] be rejected in their entirety by JSON parsers. Failure to reject invalid input could compromise the security and integrity of Verifiable Credentials.
This section is non-normative.
When implementing the VC-JWT specification, it is crucial for technical implementers to consider various accessibility factors. Ignoring accessibility concerns renders the information unusable for a significant portion of the population. To ensure equal access for all individuals, regardless of their abilities, it is vital to adhere to accessibility guidelines and standards, such as the Web Content Accessibility Guidelines (WCAG 2.1) [WCAG21]. This becomes even more critical when establishing systems that involve cryptography, as they have historically posed challenges for assistive technologies.
Implementers are advised to note and abide by all accessibility considerations called out in the [VC-DATA-MODEL].
This section is non-normative.
Implementers should take into account several internationalization considerations when publishing data described in this specification. Disregarding internationalization hampers the production and consumption of data across diverse languages and societies, thereby restricting the applicability and significantly reducing the value of the specification as a standard.
Implementers are advised to note and abide by all internationalization considerations called out in the [VC-DATA-MODEL], see also i18n, URL Standard
This section is non-normative.
{
"@context": ["https://www.w3.org/ns/did/v1", {
"@vocab": "https://vendor.example#"
}],
"id": "did:web:vendor.example",
"alsoKnownAs": ["https://vendor.example",
"did:jwk:eyJraWQiOiJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6andrLXRodW1icHJpbnQ6c2hhLTI1NjpGZk1iek9qTW1RNGVmVDZrdndUSUpqZWxUcWpsMHhqRUlXUTJxb2JzUk1NIiwia3R5IjoiT0tQIiwiY3J2IjoiRWQyNTUxOSIsImFsZyI6IkVkRFNBIiwieCI6IkFOUmpIX3p4Y0tCeHNqUlBVdHpSYnA3RlNWTEtKWFE5QVBYOU1QMWo3azQifQ"
],
"verificationMethod": [{
"id": "#urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs",
"type": "JsonWebKey",
"controller": "did:web:vendor.example",
"publicKeyJwk": {
"kty": "EC",
"crv": "P-521",
"alg": "ES512",
"x": "AFTyMw-fIYJNg6fBVJvOPOsLxmnNj8HgqMChyRL0swLaefVAc7wrWZ8okQJqMmvv03JRUp277meQZM3JcvXFkH1v",
"y": "ALn96CrD88b4TClmkl1sk0xk2FgAIda97ZF8TUOjbeWSzbKnN2KB6pqlpbuJ2xIRXvsn5BWQVlAT2JGpGwDNMyV1"
}
}, {
"id": "#z6MkhEdpG12jyQegrr62ACRmNY8gc531W2j9Xo39cHphuCEH",
"type": "JsonWebKey2020",
"controller": "https://vendor.example",
"publicKeyJwk": {
"kid": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:FfMbzOjMmQ4efT6kvwTIJjelTqjl0xjEIWQ2qobsRMM",
"kty": "OKP",
"crv": "Ed25519",
"alg": "EdDSA",
"x": "ANRjH_zxcKBxsjRPUtzRbp7FSVLKJXQ9APX9MP1j7k4"
}
}, {
"id": "#subject-authenticaton",
"type": "JsonWebKey",
"controller": "did:web:vendor.example",
"publicKeyJwk": {
"kty": "EC",
"crv": "P-384",
"alg": "ES384",
"x": "PxgAmVYOQvSNcMYL2tOzoLwSWn4Ta3tIMPEUKR8pxeb-gmR11-DyKHBoIiY-2LhM",
"y": "BZEBTkImVdpwvxR9THIRw16eblnj5-tZa7m-ww5uVd4kyPJNRoWUn2aT9ZuarAe-"
}
}, {
"id": "#credential-issuance",
"type": "JsonWebKey",
"controller": "did:web:vendor.example",
"publicKeyJwk": {
"kty": "EC",
"crv": "P-256",
"alg": "ES256",
"x": "MYvnaI87pfrn3FpTqW-yNiFcF1K7fedJiqapm20_q7c",
"y": "9YEbT6Tyuc7xp9yRvhOUVKK_NIHkn5HpK9ZMgvK5pVw"
}
}, {
"id": "#key-agreement",
"type": "JsonWebKey",
"controller": "did:web:vendor.example",
"publicKeyJwk": {
"kty": "OKP",
"crv": "X25519",
"alg": "ECDH-ES+A128KW",
"x": "qLZkSTbstvMWPTivmiQglEFWG2Ff7gNDVoVisdZTr1I"
}
}],
"authentication": ["#subject-authenticaton"],
"assertionMethod": ["#credential-issuance"],
"keyAgreement": ["#key-agreement"]
}
{
"@context": ["https://www.w3.org/ns/credentials/v2",
"https://www.w3.org/ns/credentials/examples/v2"
],
"id": "https://contoso.example/credentials/23894672394",
"type": ["VerifiableCredential", "K9UnitCredential"],
"issuer": {
"id": "https://contoso.example"
},
"validFrom": "2015-04-16T05:11:32.432Z",
"credentialStatus": {
"id": "https://contoso.example/credentials/status/4#273762",
"type": "StatusList2021Entry",
"statusPurpose": "revocation",
"statusListIndex": "273762",
"statusListCredential": "https://contoso.example/credentials/status/4"
},
"credentialSubject": [{
"id": "did:example:1312387641",
"type": "Person"
}, {
"id": "did:example:63888231",
"type": "Dog"
}]
}
graph LR
17("VerifiableCredential")
18{{"id"}}
19("https://contoso.example/credentials/23894672394")
20(("type"))
21("K9UnitCredential")
22("issuer")
23{{"id"}}
24("https://contoso.example")
25("validFrom")
26("2015-04-16T05:11:32.432Z")
27("credentialStatus")
28{{"id"}}
29("https://contoso.example/credentials/status/4#273762")
30(("type"))
31("StatusList2021Entry")
32("statusPurpose")
33("revocation")
34("statusListIndex")
35("273762")
36("statusListCredential")
37("https://contoso.example/credentials/status/4")
38("credentialSubject")
39{{"id"}}
40("did:example:1312387641")
41(("type"))
42("Person")
43("credentialSubject")
44{{"id"}}
45("did:example:63888231")
46(("type"))
47("Dog")
17 --- 18
18 --- 19
17 --- 20
20 --- 21
17 --- 22
22 --- 23
23 --- 24
17 --- 25
25 --- 26
17 --- 27
27 --- 28
28 --- 29
27 --- 30
30 --- 31
27 --- 32
32 --- 33
27 --- 34
34 --- 35
27 --- 36
36 --- 37
17 --- 38
38 --- 39
39 --- 40
38 --- 41
41 --- 42
17 --- 43
43 --- 44
44 --- 45
43 --- 46
46 --- 47
---------------- Issuer Claims ---------------- "@context": - https://www.w3.org/ns/credentials/v2 - https://www.w3.org/ns/credentials/examples/v2 !sd id: https://contoso.example/credentials/23894672394 !sd type: - VerifiableCredential - K9UnitCredential issuer: !sd id: https://contoso.example validFrom: 2015-04-16T05:11:32.432Z credentialStatus: !sd id: https://contoso.example/credentials/status/4#273762 !sd type: StatusList2021Entry statusPurpose: revocation statusListIndex: "273762" statusListCredential: https://contoso.example/credentials/status/4 credentialSubject: - !sd id: did:example:1312387641 !sd type: Person - !sd id: did:example:63888231 !sd type: Dog ---------------- Holder Disclosure ---------------- id: False type: True issuer: id: True credentialStatus: id: True ---------------- Decoded Protected Header ---------------- { "alg": "ES256", "typ": "vc+ld+json+jwt", "cty": "vc+ld+json" } ---------------- Decoded Protected Claimset ---------------- { "@context": [ "https://www.w3.org/ns/credentials/v2", "https://www.w3.org/ns/credentials/examples/v2" ], "issuer": { "id": "https://contoso.example" }, "validFrom": "2015-04-16T05:11:32.432Z", "credentialStatus": { "statusPurpose": "revocation", "statusListIndex": "273762", "statusListCredential": "https://contoso.example/credentials/status/4", "id": "https://contoso.example/credentials/status/4#273762" }, "credentialSubject": [ {}, {} ], "iss": "did:web:issuer.example", "iat": 1694131638, "exp": 1725754038, "cnf": { "jwk": { "kty": "EC", "crv": "P-256", "alg": "ES256", "x": "K4c6WJ4nmvbpllUwHAYxXnZ7O9veI8rj-_FseBXe7fE", "y": "oJf-FuhqCkNBjCpBL5S5SztBJBQ5I-1t_3uUdXEQ9Ds" } }, "type": [ "VerifiableCredential", "K9UnitCredential" ] } ---------------- Compact Encoded Selective Disclosure JSON Web Token ---------------- eyJhbGciOiJFUzI1NiIsInR5cCI6InZjK2xkK2pzb24rand0IiwiY3R5IjoidmMrbGQranNvbiJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiLCJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvZXhhbXBsZXMvdjIiXSwiaXNzdWVyIjp7Il9zZCI6WyJ5Rk9CWklPc1FKUmZKQ3BSVndaQmRzME5ZZUxhV2ZrWUliSTREdV8yUEZvIl19LCJ2YWxpZEZyb20iOiIyMDE1LTA0LTE2VDA1OjExOjMyLjQzMloiLCJjcmVkZW50aWFsU3RhdHVzIjp7InN0YXR1c1B1cnBvc2UiOiJyZXZvY2F0aW9uIiwic3RhdHVzTGlzdEluZGV4IjoiMjczNzYyIiwic3RhdHVzTGlzdENyZWRlbnRpYWwiOiJodHRwczovL2NvbnRvc28uZXhhbXBsZS9jcmVkZW50aWFscy9zdGF0dXMvNCIsIl9zZCI6WyJuME9TUHg3aHZkeVRGdXNSTWE4MTlEMnJ3X3BPbWdUTzIya1Rjc0xkcUk0Iiwic0szX0c3X1lOOXdYQ2dYbFV3QkVaSjhxYVBPUFVkR1d0YUx0eWV4U0tPayJdfSwiY3JlZGVudGlhbFN1YmplY3QiOlt7Il9zZCI6WyItZTRBdFY2Zy0xT2JfcWJoTmJXdmxfdTg1aE5vYUVILVl6Ymppb3FtLUtVIiwiQXMtZjhmZk9pLVJnWDhIUWhxSDZaVVN4amxWOGo1SHRic2tBeUY5ZTVWdyJdfSx7Il9zZCI6WyJTbW9BN1ZDb1hFYlhHb0cyejhETkxRbjFlZGdWYjJZNmhGSTFTTS0zVllrIiwibXkwbHFnaWNEenV0ZmV2cExId0dlSWJ3aDNRQlFFWnM3ZUZIMGtSZVE0RSJdfV0sIl9zZCI6WyJ2MzcwR0RLUUU1SGl3ZS1nV2kxUjVuOVkxeDItTGd1SnhMTy14clZvMDBBIiwidnNNbkVoMmIzYTZVVnVQcTdvLURYUXo0RnBybTBNckZ2WXI1VjkzZ0o4MCJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImlzcyI6ImRpZDp3ZWI6aXNzdWVyLmV4YW1wbGUiLCJpYXQiOjE2OTQxMzE2MzgsImV4cCI6MTcyNTc1NDAzOCwiY25mIjp7Imp3ayI6eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2IiwiYWxnIjoiRVMyNTYiLCJ4IjoiSzRjNldKNG5tdmJwbGxVd0hBWXhYblo3Tzl2ZUk4cmotX0ZzZUJYZTdmRSIsInkiOiJvSmYtRnVocUNrTkJqQ3BCTDVTNVN6dEJKQlE1SS0xdF8zdVVkWEVROURzIn19fQ.reV0f9dw0MbD3qrWgWLw8krQKapFqldGJXxlIxgywi29nj_58IINqnxc0Vx4rDDY5qurqODbfB-SWDd0G8gejg~WyJrWUFNbmJNdlIwaC0wa2pnVFBoVzVRIiwgImlkIiwgImh0dHBzOi8vY29udG9zby5leGFtcGxlIl0~WyI2LXJFZThnRUo1UkZZSktTT3ZnSXp3IiwgImlkIiwgImh0dHBzOi8vY29udG9zby5leGFtcGxlL2NyZWRlbnRpYWxzL3N0YXR1cy80IzI3Mzc2MiJd~WyJpZkdOaEk5dVZaM3Y2emtXcWZOOGFBIiwgInR5cGUiLCBbIlZlcmlmaWFibGVDcmVkZW50aWFsIiwgIks5VW5pdENyZWRlbnRpYWwiXV0~eyJhbGciOiJFUzI1NiIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6ImVRVldrNzlLM1FkNVVnRVFVcHpSS2ciLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTQxMzE2Mzh9.-U6nBKD_XprjkQisDVAwRqh75ef8t840EFXJnR4yI1t5Xl9gsyC_kqF7HvKcjQdkmvKUY4KfbWEFo5gw8htZCA
{
"@context": [
"https://www.w3.org/ns/credentials/v2",
"https://www.w3.org/ns/credentials/examples/v2"
],
"id": "https://contoso.example/credentials/35327255",
"type": ["VerifiableCredential", "KYCExample"],
"issuer": "did:web:contoso.example",
"validFrom": "2019-05-25T03:10:16.992Z",
"validUntil": "2027-05-25T03:10:16.992Z",
"credentialSchema": {
"id": "https://contoso.example/bafybeigdyr...lqabf3oclgtqy55fbzdi",
"type": "JsonSchema"
},
"credentialSubject": {
"id": "did:example:1231588",
"type": "Person"
}
}
graph LR
48("VerifiableCredential")
49{{"id"}}
50("https://contoso.example/credentials/35327255")
51(("type"))
52("KYCExample")
53("issuer")
54("did:web:contoso.example")
55("validFrom")
56("2019-05-25T03:10:16.992Z")
57("validUntil")
58("2027-05-25T03:10:16.992Z")
59("credentialSchema")
60{{"id"}}
61("https://contoso.example/bafybeigdyr...lqabf3oclgtqy55fbzdi")
62(("type"))
63("JsonSchema")
64("credentialSubject")
65{{"id"}}
66("did:example:1231588")
67(("type"))
68("Person")
48 --- 49
49 --- 50
48 --- 51
51 --- 52
48 --- 53
53 --- 54
48 --- 55
55 --- 56
48 --- 57
57 --- 58
48 --- 59
59 --- 60
60 --- 61
59 --- 62
62 --- 63
48 --- 64
64 --- 65
65 --- 66
64 --- 67
67 --- 68
---------------- Issuer Claims ---------------- "@context": - https://www.w3.org/ns/credentials/v2 - https://www.w3.org/ns/credentials/examples/v2 !sd id: https://contoso.example/credentials/35327255 !sd type: - VerifiableCredential - KYCExample issuer: did:web:contoso.example validFrom: 2019-05-25T03:10:16.992Z validUntil: 2027-05-25T03:10:16.992Z credentialSchema: !sd id: https://contoso.example/bafybeigdyr...lqabf3oclgtqy55fbzdi !sd type: JsonSchema credentialSubject: !sd id: did:example:1231588 !sd type: Person ---------------- Holder Disclosure ---------------- issuer: id: True credentialStatus: id: True credentialSubject: id: True type: False ---------------- Decoded Protected Header ---------------- { "alg": "ES384" } ---------------- Decoded Protected Claimset ---------------- { "@context": [ "https://www.w3.org/ns/credentials/v2", "https://www.w3.org/ns/credentials/examples/v2" ], "issuer": "did:web:contoso.example", "validFrom": "2019-05-25T03:10:16.992Z", "validUntil": "2027-05-25T03:10:16.992Z", "credentialSchema": {}, "credentialSubject": { "id": "did:example:1231588" }, "iss": "did:web:issuer.example", "iat": 1694131638, "exp": 1725754038, "cnf": { "jwk": { "kty": "EC", "crv": "P-384", "alg": "ES384", "x": "0UBg_--G5Gq-v2OITOEe3Q4hU_Knneys9mTsprHMfxVQx9GhCjWpgMHR3v4f14Sl", "y": "jAzSTlLwtw0F584Q6Bq5kRVFsOufYyKSkiukLk8WfcAb3RhkUsjwnhNX4-x1CnVD" } } } ---------------- Compact Encoded Selective Disclosure JSON Web Token ---------------- eyJhbGciOiJFUzM4NCJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiLCJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvZXhhbXBsZXMvdjIiXSwiaXNzdWVyIjoiZGlkOndlYjpjb250b3NvLmV4YW1wbGUiLCJ2YWxpZEZyb20iOiIyMDE5LTA1LTI1VDAzOjEwOjE2Ljk5MloiLCJ2YWxpZFVudGlsIjoiMjAyNy0wNS0yNVQwMzoxMDoxNi45OTJaIiwiY3JlZGVudGlhbFNjaGVtYSI6eyJfc2QiOlsiLWpaREQzYlJ4cGVINGQxT243UF9RWWhqN3JJbk1leWFqMzIwb1NtalpmZyIsImZvUGtFTDN1dzRSSXZLR1RVOEFTSVVXTWFtYnFJTmR5QWk2TFQ5UFFPTkkiXX0sImNyZWRlbnRpYWxTdWJqZWN0Ijp7Il9zZCI6WyJjVXdCRHNZN2RQWkVVZWl1SjZHem5MeG51UDdqZkZRbWFfa2lBV0NwOTgwIiwicjh5c2c0eUlST1VmSlNvbzl5WXpCUnBsN2Y1YVJ3SWJFTmNLSjNETk9hYyJdfSwiX3NkIjpbImJHNmZMNVkzRmtYT21iQi1LZXd1YXBQamhNTHF4WWNlM0VIOFRYcFdfU1EiLCJweHJJVHYwdGlGaVNFV2VGcThrZ092TVFSbW9wRGFLUjhIbXdSSDFOV1Z3Il0sIl9zZF9hbGciOiJzaGEtMjU2IiwiaXNzIjoiZGlkOndlYjppc3N1ZXIuZXhhbXBsZSIsImlhdCI6MTY5NDEzMTYzOCwiZXhwIjoxNzI1NzU0MDM4LCJjbmYiOnsiandrIjp7Imt0eSI6IkVDIiwiY3J2IjoiUC0zODQiLCJhbGciOiJFUzM4NCIsIngiOiIwVUJnXy0tRzVHcS12Mk9JVE9FZTNRNGhVX0tubmV5czltVHNwckhNZnhWUXg5R2hDaldwZ01IUjN2NGYxNFNsIiwieSI6ImpBelNUbEx3dHcwRjU4NFE2QnE1a1JWRnNPdWZZeUtTa2l1a0xrOFdmY0FiM1Joa1VzanduaE5YNC14MUNuVkQifX19.8l1vfVLxt4P5KA5AMxHZthZ9RBdm6STj9rlS3FVOisJY7Oh2I7efAN80Oqo2h8INtTkiJMgxf7TaayfLfzI7p8pk1txphpbEU2lZtdLCY6eXunWxuJTJzr9yp6k1AIu7~WyJmMkRrQk5BYmxzVXY3eU4yby1SV053IiwgImlkIiwgImRpZDpleGFtcGxlOjEyMzE1ODgiXQ~eyJhbGciOiJFUzM4NCIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6IkxqQkVfUElTc3lpSmRaaGRuV3pUUHciLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTQxMzE2Mzh9.MYpSMno8d2Ni5HSKUEHFdsRI0oLS0dpMCbHWS0GfJ-7Uy1eX4dpkiNJlmxQ42nFto7-NBUoZ5YbMf573CxRxBBcz9SijyN0US3K1yfRyQVmHNI35eJj5EtCfNu_rCErA
{
"@context": ["https://www.w3.org/ns/credentials/v2"],
"type": ["VerifiablePresentation"],
"holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI",
"verifiableCredential": [{
"@context": [
"https://www.w3.org/ns/credentials/v2"
],
"type": [
"VerifiableCredential"
],
"issuer": "https://issuer.example/issuers/68",
"validFrom": "2023-06-07T21:14:14.148Z",
"credentialSubject": {
"id": "https://subject.vendor.example"
}
},
"https://vendor.example/credentials/42", "did:example:123",
"urn:uuid:01ec9426-c175-4e39-a006-d30050e28214",
"urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI",
"data:application/vc+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0=",
"data:application/vc+ld+json+jwt;base64,ZXlKaGJHY2lPaUpGWkVSVFFTSXNJbWx6Y3lJNkltUnBaRHBxZDJzNlpYbEtjbUZYVVdsUGFVb3hZMjAwTm1GWFZqQmFhbkIzV1ZoS2FHSllUVFppTWtZeFpFZG5ObUZ1WkhKTVdGSnZaRmN4YVdOSVNuQmlibEUyWXpKb2FFeFVTVEZPYW5CMlVXMVNiV1J0V2tSUFdHZzJUVVk1UWxWWVdsSk9NMWt4VFZoc1JGZHNPWHBsUjNBMVRucFdRMVJJU2tsbGF6RlBVbXByZVU5WFZUUkphWGRwWVROU05VbHFiMmxVTUhSUlNXbDNhVmt6U2pKSmFtOXBVbGRSZVU1VVZYaFBVMGx6U1cxR2MxcDVTVFpKYTFaclVrWk9Ra2xwZDJsbFEwazJTV3BPYVdOdFRuTmlNRWswWVVSU1RsZHNWa2xpYXpsUlZVZHNhMU50ZDNSVGFtUjFWV3hHU2xkSVVsUmhSbkF6V2pJMWJXTnNjREZVTWpocFpsRWlMQ0pyYVdRaU9pSWpNQ0lzSW5SNWNDSTZJblpqSzJ4a0sycDNkQ0lzSW1saGRDSTZNVFk0TmpJMU1UVTNOSDAuZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSmthV1E2YW5kck9tVjVTbkpoVjFGcFQybEtNV050TkRaaFYxWXdXbXB3ZDFsWVNtaGlXRTAyWWpKR01XUkhaelpoYm1SeVRGaFNiMlJYTVdsalNFcHdZbTVSTm1NeWFHaE1WRWt4VG1wd2RsRnRVbTFrYlZwRVQxaG9OazFHT1VKVldGcFNUak5aTVUxWWJFUlhiRGw2WlVkd05VNTZWa05VU0VwSlpXc3hUMUpxYTNsUFYxVTBTV2wzYVdFelVqVkphbTlwVkRCMFVVbHBkMmxaTTBveVNXcHZhVkpYVVhsT1ZGVjRUMU5KYzBsdFJuTmFlVWsyU1d0V2ExSkdUa0pKYVhkcFpVTkpOa2xxVG1samJVNXpZakJKTkdGRVVrNVhiRlpKWW1zNVVWVkhiR3RUYlhkMFUycGtkVlZzUmtwWFNGSlVZVVp3TTFveU5XMWpiSEF4VkRJNGFXWlJJaXdpZG1Gc2FXUkdjbTl0SWpvaU1qQXlNeTB3Tmkwd04xUXlNVG94TkRveE5DNHhORGhhSWl3aVkzSmxaR1Z1ZEdsaGJGTjFZbXBsWTNRaU9uc2lhV1FpT2lKb2RIUndjem92TDNOMVltcGxZM1F1ZG1WdVpHOXlMbVY0WVcxd2JHVWlmWDAubmczZlpDQXJyNUYwb1hOS1J1UlFNUXYtdnh4YlozUWJKVkJpcU1QUlVnSEFiSDVkMXptYjhLeUNkNnlVS3IxbmlsZmZiZ2pGUmRpRjFsWUdNRGNhQ0E="
]
}
graph LR
82("VerifiablePresentation")
83("holder")
84("urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI")
85("verifiableCredential")
86("issuer")
87("https://issuer.example/issuers/68")
88("validFrom")
89("2023-06-07T21:14:14.148Z")
90("credentialSubject")
91{{"id"}}
92("https://subject.vendor.example")
93("verifiableCredential")
94("https://vendor.example/credentials/42")
95("verifiableCredential")
96("did:example:123")
97("verifiableCredential")
98("urn:uuid:01ec9426-c175-4e39-a006-d30050e28214")
99("verifiableCredential")
100("urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI")
101("verifiableCredential")
102("data:application/vc+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0=")
103("verifiableCredential")
104("data:application/vc+ld+json+jwt;base64,ZXlKaGJHY2lPaUpGWkVSVFFTSXNJbWx6Y3lJNkltUnBaRHBxZDJzNlpYbEtjbUZYVVdsUGFVb3hZMjAwTm1GWFZqQmFhbkIzV1ZoS2FHSllUVFppTWtZeFpFZG5ObUZ1WkhKTVdGSnZaRmN4YVdOSVNuQmlibEUyWXpKb2FFeFVTVEZPYW5CMlVXMVNiV1J0V2tSUFdHZzJUVVk1UWxWWVdsSk9NMWt4VFZoc1JGZHNPWHBsUjNBMVRucFdRMVJJU2tsbGF6RlBVbXByZVU5WFZUUkphWGRwWVROU05VbHFiMmxVTUhSUlNXbDNhVmt6U2pKSmFtOXBVbGRSZVU1VVZYaFBVMGx6U1cxR2MxcDVTVFpKYTFaclVrWk9Ra2xwZDJsbFEwazJTV3BPYVdOdFRuTmlNRWswWVVSU1RsZHNWa2xpYXpsUlZVZHNhMU50ZDNSVGFtUjFWV3hHU2xkSVVsUmhSbkF6V2pJMWJXTnNjREZVTWpocFpsRWlMQ0pyYVdRaU9pSWpNQ0lzSW5SNWNDSTZJblpqSzJ4a0sycDNkQ0lzSW1saGRDSTZNVFk0TmpJMU1UVTNOSDAuZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSmthV1E2YW5kck9tVjVTbkpoVjFGcFQybEtNV050TkRaaFYxWXdXbXB3ZDFsWVNtaGlXRTAyWWpKR01XUkhaelpoYm1SeVRGaFNiMlJYTVdsalNFcHdZbTVSTm1NeWFHaE1WRWt4VG1wd2RsRnRVbTFrYlZwRVQxaG9OazFHT1VKVldGcFNUak5aTVUxWWJFUlhiRGw2WlVkd05VNTZWa05VU0VwSlpXc3hUMUpxYTNsUFYxVTBTV2wzYVdFelVqVkphbTlwVkRCMFVVbHBkMmxaTTBveVNXcHZhVkpYVVhsT1ZGVjRUMU5KYzBsdFJuTmFlVWsyU1d0V2ExSkdUa0pKYVhkcFpVTkpOa2xxVG1samJVNXpZakJKTkdGRVVrNVhiRlpKWW1zNVVWVkhiR3RUYlhkMFUycGtkVlZzUmtwWFNGSlVZVVp3TTFveU5XMWpiSEF4VkRJNGFXWlJJaXdpZG1Gc2FXUkdjbTl0SWpvaU1qQXlNeTB3Tmkwd04xUXlNVG94TkRveE5DNHhORGhhSWl3aVkzSmxaR1Z1ZEdsaGJGTjFZbXBsWTNRaU9uc2lhV1FpT2lKb2RIUndjem92TDNOMVltcGxZM1F1ZG1WdVpHOXlMbVY0WVcxd2JHVWlmWDAubmczZlpDQXJyNUYwb1hOS1J1UlFNUXYtdnh4YlozUWJKVkJpcU1QUlVnSEFiSDVkMXptYjhLeUNkNnlVS3IxbmlsZmZiZ2pGUmRpRjFsWUdNRGNhQ0E=")
82 --- 83
83 --- 84
82 --- 85
85 --- 86
86 --- 87
85 --- 88
88 --- 89
85 --- 90
90 --- 91
91 --- 92
82 --- 93
93 --- 94
82 --- 95
95 --- 96
82 --- 97
97 --- 98
82 --- 99
99 --- 100
82 --- 101
101 --- 102
82 --- 103
103 --- 104
---------------- Issuer Claims ---------------- "@context": - https://www.w3.org/ns/credentials/v2 !sd type: - VerifiablePresentation holder: urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI verifiableCredential: - "@context": - https://www.w3.org/ns/credentials/v2 !sd type: - VerifiableCredential issuer: https://issuer.example/issuers/68 validFrom: 2023-06-07T21:14:14.148Z credentialSubject: !sd id: https://subject.vendor.example - https://vendor.example/credentials/42 - did:example:123 - urn:uuid:01ec9426-c175-4e39-a006-d30050e28214 - urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI - data:application/vc+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0= - data:application/vc+ld+json+jwt;base64,ZXlKaGJHY2lPaUpGWkVSVFFTSXNJbWx6Y3lJNkltUnBaRHBxZDJzNlpYbEtjbUZYVVdsUGFVb3hZMjAwTm1GWFZqQmFhbkIzV1ZoS2FHSllUVFppTWtZeFpFZG5ObUZ1WkhKTVdGSnZaRmN4YVdOSVNuQmlibEUyWXpKb2FFeFVTVEZPYW5CMlVXMVNiV1J0V2tSUFdHZzJUVVk1UWxWWVdsSk9NMWt4VFZoc1JGZHNPWHBsUjNBMVRucFdRMVJJU2tsbGF6RlBVbXByZVU5WFZUUkphWGRwWVROU05VbHFiMmxVTUhSUlNXbDNhVmt6U2pKSmFtOXBVbGRSZVU1VVZYaFBVMGx6U1cxR2MxcDVTVFpKYTFaclVrWk9Ra2xwZDJsbFEwazJTV3BPYVdOdFRuTmlNRWswWVVSU1RsZHNWa2xpYXpsUlZVZHNhMU50ZDNSVGFtUjFWV3hHU2xkSVVsUmhSbkF6V2pJMWJXTnNjREZVTWpocFpsRWlMQ0pyYVdRaU9pSWpNQ0lzSW5SNWNDSTZJblpqSzJ4a0sycDNkQ0lzSW1saGRDSTZNVFk0TmpJMU1UVTNOSDAuZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSmthV1E2YW5kck9tVjVTbkpoVjFGcFQybEtNV050TkRaaFYxWXdXbXB3ZDFsWVNtaGlXRTAyWWpKR01XUkhaelpoYm1SeVRGaFNiMlJYTVdsalNFcHdZbTVSTm1NeWFHaE1WRWt4VG1wd2RsRnRVbTFrYlZwRVQxaG9OazFHT1VKVldGcFNUak5aTVUxWWJFUlhiRGw2WlVkd05VNTZWa05VU0VwSlpXc3hUMUpxYTNsUFYxVTBTV2wzYVdFelVqVkphbTlwVkRCMFVVbHBkMmxaTTBveVNXcHZhVkpYVVhsT1ZGVjRUMU5KYzBsdFJuTmFlVWsyU1d0V2ExSkdUa0pKYVhkcFpVTkpOa2xxVG1samJVNXpZakJKTkdGRVVrNVhiRlpKWW1zNVVWVkhiR3RUYlhkMFUycGtkVlZzUmtwWFNGSlVZVVp3TTFveU5XMWpiSEF4VkRJNGFXWlJJaXdpZG1Gc2FXUkdjbTl0SWpvaU1qQXlNeTB3Tmkwd04xUXlNVG94TkRveE5DNHhORGhhSWl3aVkzSmxaR1Z1ZEdsaGJGTjFZbXBsWTNRaU9uc2lhV1FpT2lKb2RIUndjem92TDNOMVltcGxZM1F1ZG1WdVpHOXlMbVY0WVcxd2JHVWlmWDAubmczZlpDQXJyNUYwb1hOS1J1UlFNUXYtdnh4YlozUWJKVkJpcU1QUlVnSEFiSDVkMXptYjhLeUNkNnlVS3IxbmlsZmZiZ2pGUmRpRjFsWUdNRGNhQ0E= ---------------- Holder Disclosure ---------------- id: True type: True holder: id: True ---------------- Decoded Protected Header ---------------- { "alg": "ES256", "typ": "vp+ld+json+jwt", "cty": "vp+ld+json" } ---------------- Decoded Protected Claimset ---------------- { "@context": [ "https://www.w3.org/ns/credentials/v2" ], "holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI", "verifiableCredential": [ { "@context": [ "https://www.w3.org/ns/credentials/v2" ], "issuer": "https://issuer.example/issuers/68", "validFrom": "2023-06-07T21:14:14.148Z", "credentialSubject": {} }, "https://vendor.example/credentials/42", "did:example:123", "urn:uuid:01ec9426-c175-4e39-a006-d30050e28214", "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI", "data:application/vc+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0=", "data:application/vc+ld+json+jwt;base64,ZXlKaGJHY2lPaUpGWkVSVFFTSXNJbWx6Y3lJNkltUnBaRHBxZDJzNlpYbEtjbUZYVVdsUGFVb3hZMjAwTm1GWFZqQmFhbkIzV1ZoS2FHSllUVFppTWtZeFpFZG5ObUZ1WkhKTVdGSnZaRmN4YVdOSVNuQmlibEUyWXpKb2FFeFVTVEZPYW5CMlVXMVNiV1J0V2tSUFdHZzJUVVk1UWxWWVdsSk9NMWt4VFZoc1JGZHNPWHBsUjNBMVRucFdRMVJJU2tsbGF6RlBVbXByZVU5WFZUUkphWGRwWVROU05VbHFiMmxVTUhSUlNXbDNhVmt6U2pKSmFtOXBVbGRSZVU1VVZYaFBVMGx6U1cxR2MxcDVTVFpKYTFaclVrWk9Ra2xwZDJsbFEwazJTV3BPYVdOdFRuTmlNRWswWVVSU1RsZHNWa2xpYXpsUlZVZHNhMU50ZDNSVGFtUjFWV3hHU2xkSVVsUmhSbkF6V2pJMWJXTnNjREZVTWpocFpsRWlMQ0pyYVdRaU9pSWpNQ0lzSW5SNWNDSTZJblpqSzJ4a0sycDNkQ0lzSW1saGRDSTZNVFk0TmpJMU1UVTNOSDAuZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSmthV1E2YW5kck9tVjVTbkpoVjFGcFQybEtNV050TkRaaFYxWXdXbXB3ZDFsWVNtaGlXRTAyWWpKR01XUkhaelpoYm1SeVRGaFNiMlJYTVdsalNFcHdZbTVSTm1NeWFHaE1WRWt4VG1wd2RsRnRVbTFrYlZwRVQxaG9OazFHT1VKVldGcFNUak5aTVUxWWJFUlhiRGw2WlVkd05VNTZWa05VU0VwSlpXc3hUMUpxYTNsUFYxVTBTV2wzYVdFelVqVkphbTlwVkRCMFVVbHBkMmxaTTBveVNXcHZhVkpYVVhsT1ZGVjRUMU5KYzBsdFJuTmFlVWsyU1d0V2ExSkdUa0pKYVhkcFpVTkpOa2xxVG1samJVNXpZakJKTkdGRVVrNVhiRlpKWW1zNVVWVkhiR3RUYlhkMFUycGtkVlZzUmtwWFNGSlVZVVp3TTFveU5XMWpiSEF4VkRJNGFXWlJJaXdpZG1Gc2FXUkdjbTl0SWpvaU1qQXlNeTB3Tmkwd04xUXlNVG94TkRveE5DNHhORGhhSWl3aVkzSmxaR1Z1ZEdsaGJGTjFZbXBsWTNRaU9uc2lhV1FpT2lKb2RIUndjem92TDNOMVltcGxZM1F1ZG1WdVpHOXlMbVY0WVcxd2JHVWlmWDAubmczZlpDQXJyNUYwb1hOS1J1UlFNUXYtdnh4YlozUWJKVkJpcU1QUlVnSEFiSDVkMXptYjhLeUNkNnlVS3IxbmlsZmZiZ2pGUmRpRjFsWUdNRGNhQ0E=" ], "iss": "did:web:issuer.example", "iat": 1694131638, "exp": 1725754038, "cnf": { "jwk": { "kty": "EC", "crv": "P-256", "alg": "ES256", "x": "h3uP1LO_-Y715TFx6lxkNRJv9lzKayaYyHmg44w1MJM", "y": "mc85Hhm-5OvDSyn41XHpA22jS0natDt-8jqX812azGU" } }, "type": [ "VerifiablePresentation" ] } ---------------- Compact Encoded Selective Disclosure JSON Web Token ---------------- eyJhbGciOiJFUzI1NiIsInR5cCI6InZwK2xkK2pzb24rand0IiwiY3R5IjoidnArbGQranNvbiJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwiaG9sZGVyIjoidXJuOmlldGY6cGFyYW1zOm9hdXRoOmp3ay10aHVtYnByaW50OnNoYS0yNTY6X0ZwZmUyN0F1R21FbGpaRTlzMmx3MlVILXFyWkxSRk5yV2JKcldJZTRTSSIsInZlcmlmaWFibGVDcmVkZW50aWFsIjpbeyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwiaXNzdWVyIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9pc3N1ZXJzLzY4IiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiX3NkIjpbIjdfRE1LMUVaeFZUVkZDV0VqSU1Sa3B6aUZPXzJjVms3VnhuWnE3bzZ4OW8iXX0sIl9zZCI6WyJSc2U2ZWFiZUtZWEJPNmszQ1EwV1RGSlgxWm5NUllLc2JIelBZSTYzbkdzIl19LCJodHRwczovL3ZlbmRvci5leGFtcGxlL2NyZWRlbnRpYWxzLzQyIiwiZGlkOmV4YW1wbGU6MTIzIiwidXJuOnV1aWQ6MDFlYzk0MjYtYzE3NS00ZTM5LWEwMDYtZDMwMDUwZTI4MjE0IiwidXJuOmlldGY6cGFyYW1zOm9hdXRoOmp3ay10aHVtYnByaW50OnNoYS0yNTY6X0ZwZmUyN0F1R21FbGpaRTlzMmx3MlVILXFyWkxSRk5yV2JKcldJZTRTSSIsImRhdGE6YXBwbGljYXRpb24vdmMrbGQranNvbjtiYXNlNjQsZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSmthV1E2YW5kck9tVjVTbkpoVjFGcFQybEtNV050TkRaaFYxWXdXbXB3ZDFsWVNtaGlXRTAyWWpKR01XUkhaelpoYm1SeVRGaFNiMlJYTVdsalNFcHdZbTVSTm1NeWFHaE1WRWt4VG1wd2RsRnRVbTFrYlZwRVQxaG9OazFHT1VKVldGcFNUak5aTVUxWWJFUlhiRGw2WlVkd05VNTZWa05VU0VwSlpXc3hUMUpxYTNsUFYxVTBTV2wzYVdFelVqVkphbTlwVkRCMFVVbHBkMmxaTTBveVNXcHZhVkpYVVhsT1ZGVjRUMU5KYzBsdFJuTmFlVWsyU1d0V2ExSkdUa0pKYVhkcFpVTkpOa2xxVG1samJVNXpZakJKTkdGRVVrNVhiRlpKWW1zNVVWVkhiR3RUYlhkMFUycGtkVlZzUmtwWFNGSlVZVVp3TTFveU5XMWpiSEF4VkRJNGFXWlJJaXdpZG1Gc2FXUkdjbTl0SWpvaU1qQXlNeTB3Tmkwd04xUXlNVG94TkRveE5DNHhORGhhSWl3aVkzSmxaR1Z1ZEdsaGJGTjFZbXBsWTNRaU9uc2lhV1FpT2lKb2RIUndjem92TDNOMVltcGxZM1F1ZG1WdVpHOXlMbVY0WVcxd2JHVWlmWDA9IiwiZGF0YTphcHBsaWNhdGlvbi92YytsZCtqc29uK2p3dDtiYXNlNjQsWlhsS2FHSkhZMmxQYVVwR1drVlNWRkZUU1hOSmJXeDZZM2xKTmtsdFVuQmFSSEJ4WkRKek5scFliRXRqYlVaWVZWZHNVR0ZWYjNoWk1qQXdUbTFHV0ZacVFtRmhia0l6VjFab1MyRkhTbGxVVkZwcFRXdFplRnBGWkc1T2JVWjFXa2hLVFZkR1NuWmFSbU40WVZkT1NWTnVRbWxpYkVVeVdYcEtiMkZGZUZWVFZFWlBZVzVDTWxWWE1WTmlWMUowVjJ0U1VGZEhaekpVVlZrMVVXeFdXVmRzU2s5Tk1XdDRWRlpvYzFKR1pITlBXSEJzVWpOQk1WUnVjRmRSTVZKSlUydHNiR0Y2UmxCVmJYQnlaVlU1V0ZaVVVrcGhXR1J3V1ZST1UwNVZiSEZpTW14VlRVaFNVbE5YYkROaFZtdDZVMnBLU21GdE9YQlZiR1JTWlZVMVZWWllhRkJWTUd4NlUxY3hSMk14Y0RWVFZGcEtZVEZhY2xWcldrOVJhMnh3WkRKc2JGRXdhekpUVjNCUFlWZE9kRlJ1VG1sTlJXc3dXVlZTVTFSc1pITldhMnhwWVhwc1VsWlZaSE5oTVU1MFpETlNWR0Z0VWpGV1YzaEhVMnhrU1ZWc1VtaFNia0Y2VjJwSk1XSlhUbk5qUkVaVlRXcG9jRnBzUldsTVEwcHlZVmRSYVU5cFNXcE5RMGx6U1c1U05XTkRTVFpKYmxwcVN6SjRhMHN5Y0ROa1EwbHpTVzFzYUdSRFNUWk5WRmswVG1wSk1VMVVWVE5PU0RBdVpYbEtRVmt5T1hWa1IxWTBaRU5KTmxkNVNtOWtTRkozWTNwdmRrd3paRE5rZVRVelRYazFkbU50WTNaaWJrMTJXVE5LYkZwSFZuVmtSMnhvWWtoTmRtUnFTV2xZVTNkcFpFaHNkMXBUU1RaWGVVcFhXbGhLY0ZwdGJHaFpiWGhzVVROS2JGcEhWblZrUjJ4b1lrTktaRXhEU25Cak0wNHhXbGhKYVU5cFNtdGhWMUUyWVc1a2NrOXRWalZUYmtwb1ZqRkdjRlF5YkV0TlYwNTBUa1JhYUZZeFdYZFhiWEIzWkRGc1dWTnRhR2xYUlRBeVdXcEtSMDFYVWtoYWVscG9ZbTFTZVZSR2FGTmlNbEpZVFZkc2FsTkZjSGRaYlRWU1RtMU5lV0ZIYUUxV1JXdDRWRzF3ZDJSc1JuUlZiVEZyWWxad1JWUXhhRzlPYXpGSFQxVktWbGRHY0ZOVWFrNWFUVlV4V1dKRlVsaGlSR3cyV2xWa2QwNVZOVFpXYTA1VlUwVndTbHBYYzNoVU1VcHhZVE5zVUZZeFZUQlRWMnd6WVZkRmVsVnFWa3BoYlRsd1ZrUkNNRlZWYkhCa01teGFUVEJ2ZVZOWGNIWmhWa3BZVlZoc1QxWkdWalJVTVU1S1l6QnNkRkp1VG1GbFZXc3lVMWQwVjJFeFNrZFVhMHBLWVZoa2NGcFZUa3BPYTJ4eFZHMXNhbUpWTlhwWmFrSktUa2RHUlZWck5WaGlSbHBLV1cxek5WVldWa2hpUjNSVVlsaGtNRlV5Y0d0a1ZsWnpVbXR3V0ZOR1NsVlpWVnAzVFRGdmVVNVhNV3BpU0VGNFZrUkpOR0ZYV2xKSmFYZHBaRzFHYzJGWFVrZGpiVGwwU1dwdmFVMXFRWGxOZVRCM1Rta3dkMDR4VVhsTlZHOTRUa1J2ZUU1RE5IaE9SR2hoU1dsM2FWa3pTbXhhUjFaMVpFZHNhR0pHVGpGWmJYQnNXVE5SYVU5dWMybGhWMUZwVDJsS2IyUklVbmRqZW05MlRETk9NVmx0Y0d4Wk0xRjFaRzFXZFZwSE9YbE1iVlkwV1ZjeGQySkhWV2xtV0RBdWJtY3pabHBEUVhKeU5VWXdiMWhPUzFKMVVsRk5VWFl0ZG5oNFlsb3pVV0pLVmtKcGNVMVFVbFZuU0VGaVNEVmtNWHB0WWpoTGVVTmtObmxWUzNJeGJtbHNabVppWjJwR1VtUnBSakZzV1VkTlJHTmhRMEU9Il0sIl9zZCI6WyJVd1NRaUcyb1RTNERGXzZPdUR4RVNjWmZlSzhZZmo3aHhuSzJWZmhHWHlRIl0sIl9zZF9hbGciOiJzaGEtMjU2IiwiaXNzIjoiZGlkOndlYjppc3N1ZXIuZXhhbXBsZSIsImlhdCI6MTY5NDEzMTYzOCwiZXhwIjoxNzI1NzU0MDM4LCJjbmYiOnsiandrIjp7Imt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJhbGciOiJFUzI1NiIsIngiOiJoM3VQMUxPXy1ZNzE1VEZ4Nmx4a05SSnY5bHpLYXlhWXlIbWc0NHcxTUpNIiwieSI6Im1jODVIaG0tNU92RFN5bjQxWEhwQTIyalMwbmF0RHQtOGpxWDgxMmF6R1UifX19.ufwnCtLZFUFLWH6-YnP5-lJMM4BLR2Brd7XFh7n22_nadPzFBLRcuyCmfZf3ErMJ3mNFD5bMUiufoZ61BhE5Nw~WyJzaWp5X2F6OXBaOWIwd0tXNzlEV1dBIiwgInR5cGUiLCBbIlZlcmlmaWFibGVQcmVzZW50YXRpb24iXV0~eyJhbGciOiJFUzI1NiIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6IkRKSmlhTVJwYjZ6UHNmWnl6UmRoMEEiLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTQxMzE2Mzh9.AZDgNu7au0VBLLQ8Hs8o3r6dLKkJ9BnQmakh0pr8Ig-LXyBazj7eFF386CQ5oYykTb-YMeNlKvFtrEo-Zh06PA
data:application/vc+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0=
data:application/vc+ld+json+jwt;base64,ZXlKaGJHY2lPaUpGWkVSVFFTSXNJbWx6Y3lJNkltUnBaRHBxZDJzNlpYbEtjbUZYVVdsUGFVb3hZMjAwTm1GWFZqQmFhbkIzV1ZoS2FHSllUVFppTWtZeFpFZG5ObUZ1WkhKTVdGSnZaRmN4YVdOSVNuQmlibEUyWXpKb2FFeFVTVEZPYW5CMlVXMVNiV1J0V2tSUFdHZzJUVVk1UWxWWVdsSk9NMWt4VFZoc1JGZHNPWHBsUjNBMVRucFdRMVJJU2tsbGF6RlBVbXByZVU5WFZUUkphWGRwWVROU05VbHFiMmxVTUhSUlNXbDNhVmt6U2pKSmFtOXBVbGRSZVU1VVZYaFBVMGx6U1cxR2MxcDVTVFpKYTFaclVrWk9Ra2xwZDJsbFEwazJTV3BPYVdOdFRuTmlNRWswWVVSU1RsZHNWa2xpYXpsUlZVZHNhMU50ZDNSVGFtUjFWV3hHU2xkSVVsUmhSbkF6V2pJMWJXTnNjREZVTWpocFpsRWlMQ0pyYVdRaU9pSWpNQ0lzSW5SNWNDSTZJblpqSzJ4a0sycDNkQ0lzSW1saGRDSTZNVFk0TmpJMU1UVTNOSDAuZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSmthV1E2YW5kck9tVjVTbkpoVjFGcFQybEtNV050TkRaaFYxWXdXbXB3ZDFsWVNtaGlXRTAyWWpKR01XUkhaelpoYm1SeVRGaFNiMlJYTVdsalNFcHdZbTVSTm1NeWFHaE1WRWt4VG1wd2RsRnRVbTFrYlZwRVQxaG9OazFHT1VKVldGcFNUak5aTVUxWWJFUlhiRGw2WlVkd05VNTZWa05VU0VwSlpXc3hUMUpxYTNsUFYxVTBTV2wzYVdFelVqVkphbTlwVkRCMFVVbHBkMmxaTTBveVNXcHZhVkpYVVhsT1ZGVjRUMU5KYzBsdFJuTmFlVWsyU1d0V2ExSkdUa0pKYVhkcFpVTkpOa2xxVG1samJVNXpZakJKTkdGRVVrNVhiRlpKWW1zNVVWVkhiR3RUYlhkMFUycGtkVlZzUmtwWFNGSlVZVVp3TTFveU5XMWpiSEF4VkRJNGFXWlJJaXdpZG1Gc2FXUkdjbTl0SWpvaU1qQXlNeTB3Tmkwd04xUXlNVG94TkRveE5DNHhORGhhSWl3aVkzSmxaR1Z1ZEdsaGJGTjFZbXBsWTNRaU9uc2lhV1FpT2lKb2RIUndjem92TDNOMVltcGxZM1F1ZG1WdVpHOXlMbVY0WVcxd2JHVWlmWDAubmczZlpDQXJyNUYwb1hOS1J1UlFNUXYtdnh4YlozUWJKVkJpcU1QUlVnSEFiSDVkMXptYjhLeUNkNnlVS3IxbmlsZmZiZ2pGUmRpRjFsWUdNRGNhQ0E=
data:application/vp+ld+json+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0=
data:application/vp+ld+json+jwt;base64,ZXlKaGJHY2lPaUpGWkVSVFFTSXNJbWx6Y3lJNkltUnBaRHBxZDJzNlpYbEtjbUZYVVdsUGFVb3hZMjAwTm1GWFZqQmFhbkIzV1ZoS2FHSllUVFppTWtZeFpFZG5ObUZ1WkhKTVdGSnZaRmN4YVdOSVNuQmlibEUyWXpKb2FFeFVTVEZPYW5CMlVXMVNiV1J0V2tSUFdHZzJUVVk1UWxWWVdsSk9NMWt4VFZoc1JGZHNPWHBsUjNBMVRucFdRMVJJU2tsbGF6RlBVbXByZVU5WFZUUkphWGRwWVROU05VbHFiMmxVTUhSUlNXbDNhVmt6U2pKSmFtOXBVbGRSZVU1VVZYaFBVMGx6U1cxR2MxcDVTVFpKYTFaclVrWk9Ra2xwZDJsbFEwazJTV3BPYVdOdFRuTmlNRWswWVVSU1RsZHNWa2xpYXpsUlZVZHNhMU50ZDNSVGFtUjFWV3hHU2xkSVVsUmhSbkF6V2pJMWJXTnNjREZVTWpocFpsRWlMQ0pyYVdRaU9pSWpNQ0lzSW5SNWNDSTZJblpqSzJ4a0sycDNkQ0lzSW1saGRDSTZNVFk0TmpJMU1UVTNOSDAuZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSmthV1E2YW5kck9tVjVTbkpoVjFGcFQybEtNV050TkRaaFYxWXdXbXB3ZDFsWVNtaGlXRTAyWWpKR01XUkhaelpoYm1SeVRGaFNiMlJYTVdsalNFcHdZbTVSTm1NeWFHaE1WRWt4VG1wd2RsRnRVbTFrYlZwRVQxaG9OazFHT1VKVldGcFNUak5aTVUxWWJFUlhiRGw2WlVkd05VNTZWa05VU0VwSlpXc3hUMUpxYTNsUFYxVTBTV2wzYVdFelVqVkphbTlwVkRCMFVVbHBkMmxaTTBveVNXcHZhVkpYVVhsT1ZGVjRUMU5KYzBsdFJuTmFlVWsyU1d0V2ExSkdUa0pKYVhkcFpVTkpOa2xxVG1samJVNXpZakJKTkdGRVVrNVhiRlpKWW1zNVVWVkhiR3RUYlhkMFUycGtkVlZzUmtwWFNGSlVZVVp3TTFveU5XMWpiSEF4VkRJNGFXWlJJaXdpZG1Gc2FXUkdjbTl0SWpvaU1qQXlNeTB3Tmkwd04xUXlNVG94TkRveE5DNHhORGhhSWl3aVkzSmxaR1Z1ZEdsaGJGTjFZbXBsWTNRaU9uc2lhV1FpT2lKb2RIUndjem92TDNOMVltcGxZM1F1ZG1WdVpHOXlMbVY0WVcxd2JHVWlmWDAubmczZlpDQXJyNUYwb1hOS1J1UlFNUXYtdnh4YlozUWJKVkJpcU1QUlVnSEFiSDVkMXptYjhLeUNkNnlVS3IxbmlsZmZiZ2pGUmRpRjFsWUdNRGNhQ0E=
data:application/vp+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlUHJlc2VudGF0aW9uIl0sInZlcmlmaWFibGVDcmVkZW50aWFsIjpbImRhdGE6YXBwbGljYXRpb24vdmMrbGQranNvbjtiYXNlNjQsZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSm9kSFJ3Y3pvdkwybHpjM1ZsY2k1MlpXNWtiM0l1WlhoaGJYQnNaU0lzSW5aaGJHbGtSbkp2YlNJNklqSXdNak10TURZdE1EZFVNakU2TVRRNk1UUXVNVFE0V2lJc0ltTnlaV1JsYm5ScFlXeFRkV0pxWldOMElqcDdJbWxrSWpvaWFIUjBjSE02THk5emRXSnFaV04wTG5abGJtUnZjaTVsZUdGdGNHeGxJbjE5Il19
data:application/vp+ld+json+jwt;base64,ZXlKaGJHY2lPaUp1YjI1bElpd2lkSGx3SWpvaWRuQXJiR1FyYW5kMEluMC5leUpBWTI5dWRHVjRkQ0k2V3lKb2RIUndjem92TDNkM2R5NTNNeTV2Y21jdmJuTXZZM0psWkdWdWRHbGhiSE12ZGpJaVhTd2lkSGx3WlNJNld5SldaWEpwWm1saFlteGxVSEpsYzJWdWRHRjBhVzl1SWwwc0luWmxjbWxtYVdGaWJHVkRjbVZrWlc1MGFXRnNJanBiSW1SaGRHRTZZWEJ3YkdsallYUnBiMjR2ZG1NcmJHUXJhbmQwTzJKaGMyVTJOQ3hhV0d4TFlVZEtTRmt5YkZCaFZYQXhXV3BKTVdKRmJIQmtNbXhyVTBkNE0xTlhjSFpoVjFKMFZGaEthVkl4Um5sWlZ6VnJUVVZzZFUxRE5XeGxWWEJDVjFSSk5XUlhVa2hXYWxKclVUQnJNbFl6YkV0aU1sSkpWVzVrYW1WdE9USlVSRTVyVFRKU05VNVVUazVsVkZZeVdUSXhhbVJ0U25WVVdGcGFUVEJ3YzFkclpGZGtWMUpJWWtkb2FWTkZNVEphUjNCS1lWWm9WR1F5Ykd0VFIzZ3pWMnhPU2s1c1pEVlRiR1JoVjBWd2QxZHRNWE5oUm14MFpVZDRVazB3Y0hOWGEyUlhaRmRTU0dKSGFHbFJNSEJyVkVWT1MyTkhUWHBVYWtaaFYwVnNjRlF5YkV0aU1sSkpWVzVrYW1WdE9USlVSRXB6WlcxTmVsWnRlR3BoVkZWNVYyeGpNV0V5U1hwVFdGWmhWMGRvYjFsc2FFTmpNWEJVVTFoT1NtSnNjRzlaYTJSellURktkVk51V21sVk1Hc3lVMWR3U21Rd01YRlVXRkpPVWtac01GUlZVbXRXVlRGeFVsUmFUbFpHUlRKVVZsSlNaRlV4VlZWVVVsaGhWV3g2VTFjeFQyVldjRmhWYlhocFlteEtkMWRXWkRSV1IxSllVMjVHWVZZd05IZFRWM0IzVGpCc2RHSkhkRXBoYlRsd1dWVm9VMDFIVGtsVVZGcE5aVlJzTmxwR1pFdGpWbkJZVkdwQ1RXSnNjSE5aYlRGVFpHMU9jRTVYZUd4U01Gb3dXVEJrTkdKRmJIVk5WR3QxSWwxOS4=
{
"@context": ["https://www.w3.org/ns/credentials/v2"],
"type": [
"VerifiableCredential"
],
"issuer": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI",
"validFrom": "2023-06-07T21:14:14.148Z",
"credentialSubject": {
"id": "https://subject.vendor.example"
}
}
eyJhbGciOiJFUzM4NCIsInR5cCI6InZjK2xkK2p3dCIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19..Z-s5JgWQK91e1bzk-87ofJcRqGrw7wGehepSYH3U18u9-BNi9QOcgHWMFAN72HGNNhmn9xyT7UF59om7Wbb_IQTPAlzjMdPbzfq3bRffutP-Swg_Sz2R1VwpufVJ5Ult
{
"@context": ["https://www.w3.org/ns/credentials/v2"],
"type": [
"VerifiablePresentation"
],
"holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI"
}
eyJhbGciOiJFUzM4NCIsInR5cCI6InZwK2xkK2p3dCIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19..TsKRjY56LWTPPXWKLYfDs-NKmZZHIcrZ2pndwEDtO5DaGiDW3OtABr-esL9y6CdZTxwshoqZCs_RnPRx17-uO8k_SBugAQwnzN8bnulkSN4gXaST0kxk23X4bVmw6sBD
TODO add COSE Sign1 detached payload examples
The following examples are taken from Selective Disclosure for JWTs (SD-JWT).
These example are from a work in progress draft.
An issuer might start with a vc+ld+json
claimset, for example:
{
"@context": [
"https://www.w3.org/2018/credentials/v1",
"https://w3id.org/vaccination/v1"
],
"type": [
"VerifiableCredential",
"VaccinationCertificate"
],
"issuer": "https://example.com/issuer",
"issuanceDate": "2023-02-09T11:01:59Z",
"expirationDate": "2028-02-08T11:01:59Z",
"name": "COVID-19 Vaccination Certificate",
"description": "COVID-19 Vaccination Certificate",
"credentialSubject": {
"vaccine": {
"type": "Vaccine",
"atcCode": "J07BX03",
"medicinalProductName": "COVID-19 Vaccine Moderna",
"marketingAuthorizationHolder": "Moderna Biotech"
},
"nextVaccinationDate": "2021-08-16T13:40:12Z",
"countryOfVaccination": "GE",
"dateOfVaccination": "2021-06-23T13:40:12Z",
"order": "3/3",
"recipient": {
"type": "VaccineRecipient",
"gender": "Female",
"birthDate": "1961-08-17",
"givenName": "Marion",
"familyName": "Mustermann"
},
"type": "VaccinationEvent",
"administeringCentre": "Praxis Sommergarten",
"batchNumber": "1626382736",
"healthProfessional": "883110000015376"
}
}
The issuer converts this claimset into the SD-JWT payload, and encodes the token, for example:
eyJhbGciOiAiRVMyNTYifQ.eyJpc3MiOiAiaHR0cHM6Ly9leGFtcGxlLmNvbS9pc3N1Z
XIiLCAiaWF0IjogMTY4MzAwMDAwMCwgImV4cCI6IDE4ODMwMDAwMDAsICJAY29udGV4d
CI6IFsiaHR0cHM6Ly93d3cudzMub3JnLzIwMTgvY3JlZGVudGlhbHMvdjEiLCAiaHR0c
HM6Ly93M2lkLm9yZy92YWNjaW5hdGlvbi92MSJdLCAidHlwZSI6IFsiVmVyaWZpYWJsZ
UNyZWRlbnRpYWwiLCAiVmFjY2luYXRpb25DZXJ0aWZpY2F0ZSJdLCAiaXNzdWVyIjogI
mh0dHBzOi8vZXhhbXBsZS5jb20vaXNzdWVyIiwgImlzc3VhbmNlRGF0ZSI6ICIyMDIzL
TAyLTA5VDExOjAxOjU5WiIsICJleHBpcmF0aW9uRGF0ZSI6ICIyMDI4LTAyLTA4VDExO
jAxOjU5WiIsICJuYW1lIjogIkNPVklELTE5IFZhY2NpbmF0aW9uIENlcnRpZmljYXRlI
iwgImRlc2NyaXB0aW9uIjogIkNPVklELTE5IFZhY2NpbmF0aW9uIENlcnRpZmljYXRlI
iwgImNyZWRlbnRpYWxTdWJqZWN0IjogeyJfc2QiOiBbIjFWX0stOGxEUThpRlhCRlhiW
lk5ZWhxUjRIYWJXQ2k1VDB5Ykl6WlBld3ciLCAiSnpqTGd0UDI5ZFAtQjN0ZDEyUDY3N
GdGbUsyenk4MUhNdEJnZjZDSk5XZyIsICJSMmZHYmZBMDdaX1lsa3FtTlp5bWExeHl5e
DFYc3RJaVM2QjFZYmwySlo0IiwgIlRDbXpybDdLMmdldl9kdTdwY01JeXpSTEhwLVllZ
y1GbF9jeHRyVXZQeGciLCAiVjdrSkJMSzc4VG1WRE9tcmZKN1p1VVBIdUtfMmNjN3laU
mE0cVYxdHh3TSIsICJiMGVVc3ZHUC1PRERkRm9ZNE5semxYYzN0RHNsV0p0Q0pGNzVOd
zhPal9nIiwgInpKS19lU01YandNOGRYbU1aTG5JOEZHTTA4ekozX3ViR2VFTUotNVRCe
TAiXSwgInZhY2NpbmUiOiB7Il9zZCI6IFsiMWNGNWhMd2toTU5JYXFmV0pyWEk3Tk1XZ
WRMLTlmNlkyUEE1MnlQalNaSSIsICJIaXk2V1d1ZUxENWJuMTYyOTh0UHY3R1hobWxkT
URPVG5CaS1DWmJwaE5vIiwgIkxiMDI3cTY5MWpYWGwtakM3M3ZpOGViT2o5c214M0MtX
29nN2dBNFRCUUUiXSwgInR5cGUiOiAiVmFjY2luZSJ9LCAicmVjaXBpZW50IjogeyJfc
2QiOiBbIjFsU1FCTlkyNHEwVGg2T0d6dGhxLTctNGw2Y0FheHJZWE9HWnBlV19sbkEiL
CAiM256THE4MU0yb04wNndkdjFzaEh2T0VKVnhaNUtMbWREa0hFREpBQldFSSIsICJQb
jFzV2kwNkc0TEpybm4tX1JUMFJiTV9IVGR4blBKUXVYMmZ6V3ZfSk9VIiwgImxGOXV6Z
HN3N0hwbEdMYzcxNFRyNFdPN01HSnphN3R0N1FGbGVDWDRJdHciXSwgInR5cGUiOiAiV
mFjY2luZVJlY2lwaWVudCJ9LCAidHlwZSI6ICJWYWNjaW5hdGlvbkV2ZW50In0sICJfc
2RfYWxnIjogInNoYS0yNTYifQ.5jJEqiRViN_DJ4VMxHQIN4KK-Cdfn30nY3nRe5jGxS
5Pths5G7mF1GWy9TawYuyFwCze7qiCIx_MhJ68Uu5zeQ~WyIyR0xDNDJzS1F2ZUNmR2Z
yeU5STjl3IiwgImF0Y0NvZGUiLCAiSjA3QlgwMyJd~WyJlbHVWNU9nM2dTTklJOEVZbn
N4QV9BIiwgIm1lZGljaW5hbFByb2R1Y3ROYW1lIiwgIkNPVklELTE5IFZhY2NpbmUgTW
9kZXJuYSJd~WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgIm1hcmtldGluZ0F1dGhvc
ml6YXRpb25Ib2xkZXIiLCAiTW9kZXJuYSBCaW90ZWNoIl0~WyJlSThaV205UW5LUHBOU
GVOZW5IZGhRIiwgIm5leHRWYWNjaW5hdGlvbkRhdGUiLCAiMjAyMS0wOC0xNlQxMzo0M
DoxMloiXQ~WyJRZ19PNjR6cUF4ZTQxMmExMDhpcm9BIiwgImNvdW50cnlPZlZhY2Npbm
F0aW9uIiwgIkdFIl0~WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgImRhdGVPZlZhY2
NpbmF0aW9uIiwgIjIwMjEtMDYtMjNUMTM6NDA6MTJaIl0~WyJQYzMzSk0yTGNoY1VfbE
hnZ3ZfdWZRIiwgIm9yZGVyIiwgIjMvMyJd~WyJHMDJOU3JRZmpGWFE3SW8wOXN5YWpBI
iwgImdlbmRlciIsICJGZW1hbGUiXQ~WyJsa2x4RjVqTVlsR1RQVW92TU5JdkNBIiwgIm
JpcnRoRGF0ZSIsICIxOTYxLTA4LTE3Il0~WyJuUHVvUW5rUkZxM0JJZUFtN0FuWEZBIi
wgImdpdmVuTmFtZSIsICJNYXJpb24iXQ~WyI1YlBzMUlxdVpOYTBoa2FGenp6Wk53Iiw
gImZhbWlseU5hbWUiLCAiTXVzdGVybWFubiJd~WyI1YTJXMF9OcmxFWnpmcW1rXzdQcS
13IiwgImFkbWluaXN0ZXJpbmdDZW50cmUiLCAiUHJheGlzIFNvbW1lcmdhcnRlbiJd~W
yJ5MXNWVTV3ZGZKYWhWZGd3UGdTN1JRIiwgImJhdGNoTnVtYmVyIiwgIjE2MjYzODI3M
zYiXQ~WyJIYlE0WDhzclZXM1FEeG5JSmRxeU9BIiwgImhlYWx0aFByb2Zlc3Npb25hbC
IsICI4ODMxMTAwMDAwMTUzNzYiXQ~
Notice that, in the case of sd-jwt, the decoded payload is different from the input claimset:
{
"iss": "https://example.com/issuer",
"iat": 1683000000,
"exp": 1883000000,
"@context": [
"https://www.w3.org/2018/credentials/v1",
"https://w3id.org/vaccination/v1"
],
"type": [
"VerifiableCredential",
"VaccinationCertificate"
],
"issuer": "https://example.com/issuer",
"issuanceDate": "2023-02-09T11:01:59Z",
"expirationDate": "2028-02-08T11:01:59Z",
"name": "COVID-19 Vaccination Certificate",
"description": "COVID-19 Vaccination Certificate",
"credentialSubject": {
"_sd": [
"1V_K-8lDQ8iFXBFXbZY9ehqR4HabWCi5T0ybIzZPeww",
"JzjLgtP29dP-B3td12P674gFmK2zy81HMtBgf6CJNWg",
"R2fGbfA07Z_YlkqmNZyma1xyyx1XstIiS6B1Ybl2JZ4",
"TCmzrl7K2gev_du7pcMIyzRLHp-Yeg-Fl_cxtrUvPxg",
"V7kJBLK78TmVDOmrfJ7ZuUPHuK_2cc7yZRa4qV1txwM",
"b0eUsvGP-ODDdFoY4NlzlXc3tDslWJtCJF75Nw8Oj_g",
"zJK_eSMXjwM8dXmMZLnI8FGM08zJ3_ubGeEMJ-5TBy0"
],
"vaccine": {
"_sd": [
"1cF5hLwkhMNIaqfWJrXI7NMWedL-9f6Y2PA52yPjSZI",
"Hiy6WWueLD5bn16298tPv7GXhmldMDOTnBi-CZbphNo",
"Lb027q691jXXl-jC73vi8ebOj9smx3C-_og7gA4TBQE"
],
"type": "Vaccine"
},
"recipient": {
"_sd": [
"1lSQBNY24q0Th6OGzthq-7-4l6cAaxrYXOGZpeW_lnA",
"3nzLq81M2oN06wdv1shHvOEJVxZ5KLmdDkHEDJABWEI",
"Pn1sWi06G4LJrnn-_RT0RbM_HTdxnPJQuX2fzWv_JOU",
"lF9uzdsw7HplGLc714Tr4WO7MGJza7tt7QFleCX4Itw"
],
"type": "VaccineRecipient"
},
"type": "VaccinationEvent"
},
"_sd_alg": "sha-256"
}
{
"@context": [
"https://www.w3.org/2018/credentials/v1",
"https://w3id.org/vaccination/v1"
],
"type": [
"VerifiableCredential",
"VaccinationCertificate"
],
"issuer": "https://example.com/issuer",
"issuanceDate": "2023-02-09T11:01:59Z",
"expirationDate": "2028-02-08T11:01:59Z",
"name": "COVID-19 Vaccination Certificate",
"description": "COVID-19 Vaccination Certificate",
"credentialSubject": {
"vaccine": {
"type": "Vaccine",
"medicinalProductName": "COVID-19 Vaccine Moderna",
"atcCode": "J07BX03"
},
"recipient": {
"type": "VaccineRecipient"
},
"type": "VaccinationEvent",
"order": "3/3",
"dateOfVaccination": "2021-06-23T13:40:12Z"
},
"_sd_alg": "sha-256",
"cnf": {
"jwk": {
"kty": "EC",
"crv": "P-256",
"x": "TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc",
"y": "ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ"
}
}
}
See Selective Disclosure for JWTs (SD-JWT) for a detailed explanation of each disclosable claim, and the mandatory to disclose claims.
The holder, converts the issued sd-jwt to its presentation form, redacting any fields they don't wish to disclose to the verifier, for example:
eyJhbGciOiAiRVMyNTYifQ.eyJpc3MiOiAiaHR0cHM6Ly9leGFtcGxlLmNvbS9pc3N1Z
XIiLCAiaWF0IjogMTY4MzAwMDAwMCwgImV4cCI6IDE4ODMwMDAwMDAsICJAY29udGV4d
CI6IFsiaHR0cHM6Ly93d3cudzMub3JnLzIwMTgvY3JlZGVudGlhbHMvdjEiLCAiaHR0c
HM6Ly93M2lkLm9yZy92YWNjaW5hdGlvbi92MSJdLCAidHlwZSI6IFsiVmVyaWZpYWJsZ
UNyZWRlbnRpYWwiLCAiVmFjY2luYXRpb25DZXJ0aWZpY2F0ZSJdLCAiaXNzdWVyIjogI
mh0dHBzOi8vZXhhbXBsZS5jb20vaXNzdWVyIiwgImlzc3VhbmNlRGF0ZSI6ICIyMDIzL
TAyLTA5VDExOjAxOjU5WiIsICJleHBpcmF0aW9uRGF0ZSI6ICIyMDI4LTAyLTA4VDExO
jAxOjU5WiIsICJuYW1lIjogIkNPVklELTE5IFZhY2NpbmF0aW9uIENlcnRpZmljYXRlI
iwgImRlc2NyaXB0aW9uIjogIkNPVklELTE5IFZhY2NpbmF0aW9uIENlcnRpZmljYXRlI
iwgImNyZWRlbnRpYWxTdWJqZWN0IjogeyJfc2QiOiBbIjFWX0stOGxEUThpRlhCRlhiW
lk5ZWhxUjRIYWJXQ2k1VDB5Ykl6WlBld3ciLCAiSnpqTGd0UDI5ZFAtQjN0ZDEyUDY3N
GdGbUsyenk4MUhNdEJnZjZDSk5XZyIsICJSMmZHYmZBMDdaX1lsa3FtTlp5bWExeHl5e
DFYc3RJaVM2QjFZYmwySlo0IiwgIlRDbXpybDdLMmdldl9kdTdwY01JeXpSTEhwLVllZ
y1GbF9jeHRyVXZQeGciLCAiVjdrSkJMSzc4VG1WRE9tcmZKN1p1VVBIdUtfMmNjN3laU
mE0cVYxdHh3TSIsICJiMGVVc3ZHUC1PRERkRm9ZNE5semxYYzN0RHNsV0p0Q0pGNzVOd
zhPal9nIiwgInpKS19lU01YandNOGRYbU1aTG5JOEZHTTA4ekozX3ViR2VFTUotNVRCe
TAiXSwgInZhY2NpbmUiOiB7Il9zZCI6IFsiMWNGNWhMd2toTU5JYXFmV0pyWEk3Tk1XZ
WRMLTlmNlkyUEE1MnlQalNaSSIsICJIaXk2V1d1ZUxENWJuMTYyOTh0UHY3R1hobWxkT
URPVG5CaS1DWmJwaE5vIiwgIkxiMDI3cTY5MWpYWGwtakM3M3ZpOGViT2o5c214M0MtX
29nN2dBNFRCUUUiXSwgInR5cGUiOiAiVmFjY2luZSJ9LCAicmVjaXBpZW50IjogeyJfc
2QiOiBbIjFsU1FCTlkyNHEwVGg2T0d6dGhxLTctNGw2Y0FheHJZWE9HWnBlV19sbkEiL
CAiM256THE4MU0yb04wNndkdjFzaEh2T0VKVnhaNUtMbWREa0hFREpBQldFSSIsICJQb
jFzV2kwNkc0TEpybm4tX1JUMFJiTV9IVGR4blBKUXVYMmZ6V3ZfSk9VIiwgImxGOXV6Z
HN3N0hwbEdMYzcxNFRyNFdPN01HSnphN3R0N1FGbGVDWDRJdHciXSwgInR5cGUiOiAiV
mFjY2luZVJlY2lwaWVudCJ9LCAidHlwZSI6ICJWYWNjaW5hdGlvbkV2ZW50In0sICJfc
2RfYWxnIjogInNoYS0yNTYifQ.5jJEqiRViN_DJ4VMxHQIN4KK-Cdfn30nY3nRe5jGxS
5Pths5G7mF1GWy9TawYuyFwCze7qiCIx_MhJ68Uu5zeQ~WyJQYzMzSk0yTGNoY1VfbEh
nZ3ZfdWZRIiwgIm9yZGVyIiwgIjMvMyJd~WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIi
wgImRhdGVPZlZhY2NpbmF0aW9uIiwgIjIwMjEtMDYtMjNUMTM6NDA6MTJaIl0~WyIyR0
xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImF0Y0NvZGUiLCAiSjA3QlgwMyJd~WyJlbHVWN
U9nM2dTTklJOEVZbnN4QV9BIiwgIm1lZGljaW5hbFByb2R1Y3ROYW1lIiwgIkNPVklEL
TE5IFZhY2NpbmUgTW9kZXJuYSJd~
After validation, the Verifier will have the following data for further processing:
One benefit of using vc+ld+json+jwt
and vc+ld+json+sd-jwt
is that they both produce vc+ld+json
which
can be further processed as RDF by a verifier.
The working group is still discussing the relevance of the JWT BCP,
and distinguishing vc+ld+json+sd-jwt from vc+sd-jwt via type
.
{
"iss": "https://example.com/issuer",
"iat": 1683000000,
"exp": 1883000000,
"@context": [
"https://www.w3.org/2018/credentials/v1",
"https://w3id.org/vaccination/v1"
],
"type": [
"VerifiableCredential",
"VaccinationCertificate"
],
"issuer": "https://example.com/issuer",
"issuanceDate": "2023-02-09T11:01:59Z",
"expirationDate": "2028-02-08T11:01:59Z",
"name": "COVID-19 Vaccination Certificate",
"description": "COVID-19 Vaccination Certificate",
"credentialSubject": {
"vaccine": {
"type": "Vaccine",
"atcCode": "J07BX03",
"medicinalProductName": "COVID-19 Vaccine Moderna"
},
"recipient": {
"type": "VaccineRecipient"
},
"type": "VaccinationEvent",
"order": "3/3",
"dateOfVaccination": "2021-06-23T13:40:12Z"
},
"_sd_alg": "sha-256"
}