Securing Verifiable Credentials using JOSE and COSE

Abstract

This specification defines how to secure credentials and presentations conforming to the [VC-DATA-MODEL], with JSON Object Signing and Encryption (JOSE), and CBOR Object Signing and Encryption (COSE) [RFC9052]. This enables the Verifiable Credential data model [VC-DATA-MODEL]to be implemented with standards for signing and encryption that are widely adopted.

This section outlines how to secure documents conforming to the [VC-DATA-MODEL] using JOSE and COSE.

Documents conforming to the [VC-DATA-MODEL], and their associated media types, rely on JSON-LD, which is a flexible and extensible format for describing linked data, see JSON-LD Relationship to RDF.

A benefit to this approach is that payloads can be made to conform directly to the [VC-DATA-MODEL] without any mappings or transformation, while at the same time supporting registered claims that are understood in the context of JOSE and COSE.

It is RECOMMENDED that media types be used to distinguish verifiable credentials and verifiable presentations from other kinds of secured JSON or CBOR.

The most specific media type (or subtype) available SHOULD be used, instead of more generic media types (or supertypes). For example, rather than the general application/sd-jwt, application/vc+ld+json+sd-jwt ought to be used, unless there is a more specific media type that would even better identify the secured envelope format.

If implementations do not know which media type to use, media types defined in this specification MUST be used.

This section details how to use JOSE to secure verifiable credentials conforming to the [VC-DATA-MODEL].

[rfc7515] MAY be used to secure this media type.

The typ parameter SHOULD be vc+ld+json+sd-jwt

When present, the cty SHOULD be vc+ld+json

See Common JOSE Header Parameters for additional details regarding usage of typ and cty.

Example 1: Example Credential

application/vc+ld+json
text/vnd.mermaid
application/vc+ld+json+sd-jwt

{
  "@context": ["https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "id": "http://example.edu/credentials/3732",
  "type": ["VerifiableCredential",
    "UniversityDegreeCredential"
  ],
  "issuer": "https://example.edu/issuers/14",
  "issuanceDate": "2010-01-01T19:23:24Z",
  "credentialSubject": {
    "id": "did:example:123",
    "degree": {
      "type": "BachelorDegree",
      "name": "Bachelor of Science and Arts"
    }
  }
}

graph LR

0("VerifiableCredential")
1{{"id"}}
2("http://example.edu/credentials/3732")
3(("type"))
4("UniversityDegreeCredential")
5("issuer")
6("https://example.edu/issuers/14")
7("issuanceDate")
8("2010-01-01T19:23:24Z")
9("credentialSubject")
10{{"id"}}
11("did:example:123")
12("degree")
13(("type"))
14("BachelorDegree")
15("name")
16("Bachelor of Science and Arts")

0 --- 1
1 --- 2
0 --- 3
3 --- 4
0 --- 5
5 --- 6
0 --- 7
7 --- 8
0 --- 9
9 --- 10
10 --- 11
9 --- 12
12 --- 13
13 --- 14
12 --- 15
15 --- 16

---------------- Issuer Claims ----------------
"@context":
  - https://www.w3.org/ns/credentials/v2
  - https://www.w3.org/ns/credentials/examples/v2
!sd id: http://example.edu/credentials/3732
!sd type:
  - VerifiableCredential
  - UniversityDegreeCredential
issuer: https://example.edu/issuers/14
issuanceDate: 2010-01-01T19:23:24Z
credentialSubject:
  !sd id: did:example:123
  degree:
    !sd type: BachelorDegree
    name: Bachelor of Science and Arts
---------------- Holder Disclosure ----------------
issuer:
  id: True
credentialStatus:
  id: True
credentialSubject:
  id: True
  type: False
---------------- Decoded Protected Header ----------------
{
  "alg": "ES384"
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "issuer": "https://example.edu/issuers/14",
  "issuanceDate": "2010-01-01T19:23:24Z",
  "credentialSubject": {
    "degree": {
      "name": "Bachelor of Science and Arts"
    },
    "id": "did:example:123"
  },
  "iss": "did:web:issuer.example",
  "iat": 1695268650,
  "exp": 1726891050,
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-384",
      "alg": "ES384",
      "x": "km-SV855Yt6pm95SDDL6WExky4Ma1xTxGzR3IXCBjP-ZLENa7e94_F8dAYfdWzTC",
      "y": "GO9jZpJ2jNUohwBJ0cRxbVwHMJ1yl9EF5PWg1nWHRN82vo9_yMc9Jd4YxEBmH6vF"
    }
  }
}
---------------- Compact Encoded Selective Disclosure JSON Web Token ----------------
eyJhbGciOiJFUzM4NCJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiLCJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvZXhhbXBsZXMvdjIiXSwiaXNzdWVyIjoiaHR0cHM6Ly9leGFtcGxlLmVkdS9pc3N1ZXJzLzE0IiwiaXNzdWFuY2VEYXRlIjoiMjAxMC0wMS0wMVQxOToyMzoyNFoiLCJjcmVkZW50aWFsU3ViamVjdCI6eyJkZWdyZWUiOnsibmFtZSI6IkJhY2hlbG9yIG9mIFNjaWVuY2UgYW5kIEFydHMiLCJfc2QiOlsiMkwxTWI1bkJ0VTZpTGxvUV9iaXM5Z1ZQYXl1WUttSXFfNXJXc0hxWEgzWSJdfSwiX3NkIjpbIlRhR3N6emhENFF1aEdFYWpkRjdEYTZmSWd0bXltZ2MyU0t3QjVBWFoteDQiXX0sIl9zZCI6WyJWcmVZZlpneXdVbWNYUWxiQjFhVGt1Sk5qa0ozbGp4elhhLTdZLUxodDhNIiwiZjFMSXJqc0EtcmtZVlNfUncyMG9lQk5JNXhaVUN1X29fVkxKOE80VG9EMCJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImlzcyI6ImRpZDp3ZWI6aXNzdWVyLmV4YW1wbGUiLCJpYXQiOjE2OTUyNjg2NTAsImV4cCI6MTcyNjg5MTA1MCwiY25mIjp7Imp3ayI6eyJrdHkiOiJFQyIsImNydiI6IlAtMzg0IiwiYWxnIjoiRVMzODQiLCJ4Ijoia20tU1Y4NTVZdDZwbTk1U0RETDZXRXhreTRNYTF4VHhHelIzSVhDQmpQLVpMRU5hN2U5NF9GOGRBWWZkV3pUQyIsInkiOiJHTzlqWnBKMmpOVW9od0JKMGNSeGJWd0hNSjF5bDlFRjVQV2cxbldIUk44MnZvOV95TWM5SmQ0WXhFQm1INnZGIn19fQ.IzTGgIl6-5S3WMC0qVe1GNL7A03YQiz_H6EZiy0Cxxt_xnveV8d4LeeQZf4UACD2LmGORO7tEHVVFfTfOebmGCynAUPJFSEKZTwSO6lN3-ZtI90jxfJSvYfzGoFItFVV~WyI2UXVjUEREaExSRFdWbjBaZlB2TWdRIiwgImlkIiwgImRpZDpleGFtcGxlOjEyMyJd~eyJhbGciOiJFUzM4NCIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6Il9mNVhSN0xEUl9TeUZyd1NvVk9PM2ciLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTUyNjg2NTB9.7OAZgkd5noQaRsghDOItu5cdM7TRj66E5JB7UZwq-agm7RFxf8XkS4UKxFxKWT2drDbsN2kHGZQLYvvTUMHwjcmqNDgN6XcG3t5NW9LPx2Cbcqj8aCrwN30VczzcJ3om

This section details how to use JOSE to secure verifiable presentations conforming to the [VC-DATA-MODEL].

[rfc7515] MAY be used to secure this media type.

The typ parameter SHOULD be vp+ld+json+sd-jwt

When present, the cty parameter SHOULD be vp+ld+json

See Common JOSE Header Parameters for additional details regarding usage of typ and cty.

Example 2: The minimal unsecured verifiable presentation

application/vp+ld+json
text/vnd.mermaid
application/vp+ld+json+sd-jwt

{
  "@context": ["https://www.w3.org/ns/credentials/v2"],
  "type": ["VerifiablePresentation"]
}

graph LR

69("VerifiablePresentation")

+sd-jwt does not support algorithm none.

Example 3: The minimal secured verifiable presentation

application/vp+ld+json
text/vnd.mermaid
application/vp+ld+json+sd-jwt

{
  "@context": ["https://www.w3.org/ns/credentials/v2"],
  "type": ["VerifiablePresentation"]
}

graph LR

70("VerifiablePresentation")

---------------- Issuer Claims ----------------
"@context":
  - https://www.w3.org/ns/credentials/v2
!sd type:
  - VerifiablePresentation
---------------- Holder Disclosure ----------------
id: True
type: True
holder:
  id: True
---------------- Decoded Protected Header ----------------
{
  "alg": "ES384"
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2"
  ],
  "iss": "did:web:issuer.example",
  "iat": 1695268650,
  "exp": 1726891050,
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-384",
      "alg": "ES384",
      "x": "J15o4bxD1CZmrNCEngUiaPOTqrQ1Z5iDIj1VKqfjnoY9cLTSEDKeiMG3MMpO0qgc",
      "y": "hqP_VyfUGPb4cJE14vw7uvWKeAissxpRvsvxas8LAmmTzChifWM-1xNtltuGIwS5"
    }
  },
  "type": [
    "VerifiablePresentation"
  ]
}
---------------- Compact Encoded Selective Disclosure JSON Web Token ----------------
eyJhbGciOiJFUzM4NCJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwiX3NkIjpbIlRGVE9FQTdDMXkya21qZFVnY0pobFJxN1hxTFVKYUh6T2laMDBUWHRUbGsiXSwiX3NkX2FsZyI6InNoYS0yNTYiLCJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwiaWF0IjoxNjk1MjY4NjUwLCJleHAiOjE3MjY4OTEwNTAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJjcnYiOiJQLTM4NCIsImFsZyI6IkVTMzg0IiwieCI6IkoxNW80YnhEMUNabXJOQ0VuZ1VpYVBPVHFyUTFaNWlESWoxVktxZmpub1k5Y0xUU0VES2VpTUczTU1wTzBxZ2MiLCJ5IjoiaHFQX1Z5ZlVHUGI0Y0pFMTR2dzd1dldLZUFpc3N4cFJ2c3Z4YXM4TEFtbVR6Q2hpZldNLTF4TnRsdHVHSXdTNSJ9fX0.-UHeFBIkXzsqZLAiX8n-rdb96jFOcY8EmVJ8CfkLqlbyPd9DqzKrx8AP847s5pbHdkaflY9x6TnlxbUqQYJ8hjx7wlQgytRM2ICGVuqXte-mrxF5R9TpDmB0bbyla2Hf~WyJkSlR3MVNYcUlsd1hVM256NE5FckdnIiwgInR5cGUiLCBbIlZlcmlmaWFibGVQcmVzZW50YXRpb24iXV0~eyJhbGciOiJFUzM4NCIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6IkktT3RZbnp5ZmRGMmFlR2dnc085SHciLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTUyNjg2NTB9.ejOP4lq2SOqWIFb0cEKbBSRwknF9Ck24-yuCn4kkTICjAklkNf9eMVSM6dv_b3ZYPYtF0i0aUigw9cH6tHQNhFyKOqME1Bpd6xjxdMIL9fWNGXBkDz-EM9_qA83GwVIS

Example 4: A secured verifiable presentation with a holder identifier

application/vp+ld+json
text/vnd.mermaid
application/vp+ld+json+sd-jwt

{
  "@context": ["https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "type": ["VerifiablePresentation"],
  "holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
}

graph LR

71("VerifiablePresentation")
72("holder")
73("urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs")

71 --- 72
72 --- 73

---------------- Issuer Claims ----------------
"@context":
  - https://www.w3.org/ns/credentials/v2
  - https://www.w3.org/ns/credentials/examples/v2
!sd type:
  - VerifiablePresentation
holder: urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs
---------------- Holder Disclosure ----------------
id: True
type: True
holder:
  id: True
---------------- Decoded Protected Header ----------------
{
  "alg": "ES384"
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs",
  "iss": "did:web:issuer.example",
  "iat": 1695268650,
  "exp": 1726891050,
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-384",
      "alg": "ES384",
      "x": "N3w9IYdTdZ2JVO4NPcnqD08_2mIU86xhzhobS8isTqff-vomoNE8bQSQJbZ1hUwx",
      "y": "Jgwf1z1ovHCKviRR_EhR7bechF5FQsbyLXGFOieS9GdETCB-VTYV7t1SLZDXsrB4"
    }
  },
  "type": [
    "VerifiablePresentation"
  ]
}
---------------- Compact Encoded Selective Disclosure JSON Web Token ----------------
eyJhbGciOiJFUzM4NCJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiLCJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvZXhhbXBsZXMvdjIiXSwiaG9sZGVyIjoidXJuOmlldGY6cGFyYW1zOm9hdXRoOmp3ay10aHVtYnByaW50OnNoYS0yNTY6TnpiTHNYaDh1RENjZC02TU53WEY0V183bm9XWEZaQWZIa3hac1JHQzlYcyIsIl9zZCI6WyJnSmpJempmZDJ2TElmcmE1QXZKTmlibGw3RGpBOVNyS1RRWWVxQ0ozMm1jIl0sIl9zZF9hbGciOiJzaGEtMjU2IiwiaXNzIjoiZGlkOndlYjppc3N1ZXIuZXhhbXBsZSIsImlhdCI6MTY5NTI2ODY1MCwiZXhwIjoxNzI2ODkxMDUwLCJjbmYiOnsiandrIjp7Imt0eSI6IkVDIiwiY3J2IjoiUC0zODQiLCJhbGciOiJFUzM4NCIsIngiOiJOM3c5SVlkVGRaMkpWTzROUGNucUQwOF8ybUlVODZ4aHpob2JTOGlzVHFmZi12b21vTkU4YlFTUUpiWjFoVXd4IiwieSI6Ikpnd2YxejFvdkhDS3ZpUlJfRWhSN2JlY2hGNUZRc2J5TFhHRk9pZVM5R2RFVENCLVZUWVY3dDFTTFpEWHNyQjQifX19._FVydQnqDBXj9FIXMkrQbqNsJ9paDJN3rorDwyCC7azdVcSrwAICEnKhjJ8bnYv2jUxMkSNHnVnfSaml65D2tJ0tjZYDPalfoHI2t0Pvm8wzKn8xkiH6E5wbynMQAukD~WyJMWE4za0NxQ3VtdFVJTlpvbDQ0dUx3IiwgInR5cGUiLCBbIlZlcmlmaWFibGVQcmVzZW50YXRpb24iXV0~eyJhbGciOiJFUzM4NCIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6IkV5Nmd6YVB0el9KMG1PYjdaQTBUaHciLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTUyNjg2NTB9.ON1HHysFlwcvVCVn_9F6CkdXfpL6Jp7Qf7HIBgwgqeAa6722hXWoeejq-XL5B6GBl8ohwuPKc_L_2VGJdC_MO6MhsZ3NeGb33M61EfVLlbbfxThp0mhmARGSNBg83-LE

Example 5: A secured verifiable presentation with a holder graph node

application/vp+ld+json
text/vnd.mermaid
application/vp+ld+json+sd-jwt

{
  "@context": ["https://www.w3.org/ns/credentials/v2"],
  "type": ["VerifiablePresentation"],
  "holder": {
    "id": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs",
    "type": "Organization",
    "name": "Contoso"
  }
}

graph LR

74("VerifiablePresentation")
75("holder")
76{{"id"}}
77("urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs")
78(("type"))
79("Organization")
80("name")
81("Contoso")

74 --- 75
75 --- 76
76 --- 77
75 --- 78
78 --- 79
75 --- 80
80 --- 81

---------------- Issuer Claims ----------------
"@context":
  - https://www.w3.org/ns/credentials/v2
!sd type:
  - VerifiablePresentation
holder:
  !sd id: urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs
  !sd type: Organization
  name: Contoso
---------------- Holder Disclosure ----------------
id: True
type: True
holder:
  id: True
---------------- Decoded Protected Header ----------------
{
  "alg": "ES384"
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2"
  ],
  "holder": {
    "name": "Contoso",
    "id": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
  },
  "iss": "did:web:issuer.example",
  "iat": 1695268650,
  "exp": 1726891050,
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-384",
      "alg": "ES384",
      "x": "ldo1ManvzWwDr_WvTC_9T0Z0KeclrTOOtOWV2xZMPpOo4NjWO8Nj3h2YaMdpJr_F",
      "y": "kNKVY7CFzzcxjKcpYg2qZUOfgAYsoi5Ee1dCMUW2avS1rEYRqkpzif5lMipaEhiX"
    }
  },
  "type": [
    "VerifiablePresentation"
  ]
}
---------------- Compact Encoded Selective Disclosure JSON Web Token ----------------
eyJhbGciOiJFUzM4NCJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwiaG9sZGVyIjp7Im5hbWUiOiJDb250b3NvIiwiX3NkIjpbImFaQXREMkVyZFRPOGtUR1k5a0Y4cGtjUTJTMHhSSExHcTJ5VW1ScEhqVVEiLCJ5TGgxcmI2RWpWV2dBeGFJb2dsYjViSV9JNThMNTVidWluLVBqdEwydkxFIl19LCJfc2QiOlsiSkVFck1WUS1fbEFzaXVXNzNvdVJWRV9xZ0JCZzhvSVV3aEtMSzNVRnRmayJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImlzcyI6ImRpZDp3ZWI6aXNzdWVyLmV4YW1wbGUiLCJpYXQiOjE2OTUyNjg2NTAsImV4cCI6MTcyNjg5MTA1MCwiY25mIjp7Imp3ayI6eyJrdHkiOiJFQyIsImNydiI6IlAtMzg0IiwiYWxnIjoiRVMzODQiLCJ4IjoibGRvMU1hbnZ6V3dEcl9XdlRDXzlUMFowS2VjbHJUT090T1dWMnhaTVBwT280TmpXTzhOajNoMllhTWRwSnJfRiIsInkiOiJrTktWWTdDRnp6Y3hqS2NwWWcycVpVT2ZnQVlzb2k1RWUxZENNVVcyYXZTMXJFWVJxa3B6aWY1bE1pcGFFaGlYIn19fQ.Q3k_HmrEhg5RgMK_DE5yXPK1vZmTStwF0pD7zmYb8t3CFMOs0_ieTZj7E1nmEtZx2xW8JZRfCFSl1xNW_xbuAWTM2ZszXypg0hXNgGTFJngPzF5RXYZQQSZ2rzjU2WuZ~WyJGb3VwNnBhc1RZLWxHMEF5a3FNQmFBIiwgImlkIiwgInVybjppZXRmOnBhcmFtczpvYXV0aDpqd2stdGh1bWJwcmludDpzaGEtMjU2Ok56YkxzWGg4dURDY2QtNk1Od1hGNFdfN25vV1hGWkFmSGt4WnNSR0M5WHMiXQ~WyJTdEVqazdwZnJGbjBBLTExYjE3QlhRIiwgInR5cGUiLCBbIlZlcmlmaWFibGVQcmVzZW50YXRpb24iXV0~eyJhbGciOiJFUzM4NCIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6Im9RNWlBaU5OdVgxcnV3VnZZcVd0UVEiLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTUyNjg2NTB9.pH20NLk7EP8iVaX4jAvm2zdu3pTryE2c4bRD10hCL9SxA-FUDdDkB0Xz6YjfG_49DKl3BFg1jggYlZphNx1vDcBrCRjZx54GVtARfs33K9vEGx0P5IvE4O0P8IADL3Sn

COSE [rfc9052] is a common approach to encoding and securing information using CBOR [rfc8949]. Verifiable credentials MAY be secured using COSE [rfc9052] and SHOULD be identified through use of content types as outlined in this section.

This section details how to secure data with the type application/vc+ld+json with COSE.

[rfc9052] MAY be used to secure this media type.

When using this approach, the typ SHOULD be vc+ld+json+cose. See I-D.ietf-cose-typ-header-parameter for the COSE "typ" (type) header parameter.

When using this approach, the content type (3) SHOULD be application/vc+ld+json.

See Common COSE Header Parameters for additional details.

See the IANA Concise Binary Object Representation (CBOR) Tags registry for additional details.

This section is non-normative.

Issuers, holders and verifiers might rely on clients, as defined in RFC4949. Such clients are often referred to as wallets or digital credential wallets, when they support storing and presenting digital credentials.

In order to meet verifier requirements, some issuers might need to assess the quality of a wallet used by a holder, prior to issuing and delivering credentials to a holder.

For example, some verifiers might require that cryptographic material associated with a holder, be protected at specific assurance levels. (See NIST 800-63-3: Authenticator Assurance Levels.)

Note

Also see OAuth 2.0 Attestation-Based Client Authentication .

Issue

The working group is still discussing how to close many related issues.

Issue 117: how is `kid` to be `useful to distinguish the specific key used`? has-pr before-CR

Originally posted by @TallTed in #111 (comment)

line 377 says (and another line says the same) --

If <code>kid</code> is also present, it is expected to be useful to distinguish the specific key used.

-- in response to which I ask --

how is kid to be useful to distinguish the specific key used? This cries out for an example, or a fair amount of additional prose.

Issue 106: Explain relationship between controller documents and JOSE headers has-pr before-CR

          Just read that section, and I have to say that it's not intuitive at all. I think it would be worth either: adding an example that refers to this controller document, pointing to the spec you mentioned, or explicitly stating the relationship between controller docs and  `iss` & `kid`.

Originally posted by @andresuribe87 in #104 (comment)

Issue 31: About the optionality of the "kid" field in JWT-formatted VCs/VPs has-pr before-CR

https://www.w3.org/TR/vc-data-model/#jwt-encoding shows:

kid MAY be used if there are multiple keys associated with the issuer of the JWT. The key discovery is out of the scope of this specification. For example, the kid can refer to a key in a DID document, or can be the identifier of a key inside a JWKS.

I'd like some clarification on the optionality of the "kid" field. My guess is that VCs/VPs are trying to be generic regarding issuers/holders, allowing for URIs, which precludes the possibility of giving any more details about how the "kid" field should be used. Is that right?

I'm coming from a DID-centric ecosystem, and in that scenario it seems that there's no reason not to set the "kid" field on a JWT-formatted VC/VP to the DID fragment URL of the specific key used to sign. From w3c/vc-data-model#914 I understand that it would still be necessary to tie the "kid" to the "iss" field, but that seems fine.

As far as I can tell, if the "kid" field is missing, and assuming we're working with DIDs here, the process to resolve the signing key has to be:

Identify the VC issuer / holder -- the "iss" field of the JWT. This should be a DID. (Question: Could this validly include query params such as versionTime?)
Resolve the DID document for that DID.
For each key with purpose "authentication", attempt to verify the VC/VP's signature using that key.
If one of the keys verifies the signature, accept the VP/VC's signature as valid. Otherwise reject it as invalid.

To me, this seems sloppy, involving unnecessary complexity and computation, and making detecting errors in implementations harder. It also wouldn't scale if for whatever reason a DID had very many keys (inefficient at best, possible DoS at worst). Maybe I'm missing something here. Can anyone comment on this? Thanks.

Issue 30: Accept or Dismiss the guidance provided by DIF on `kid` / `iss` discuss has-pr before-CR

See https://github.com/decentralized-identity/did-jose-extensions/blob/master/options.md

^ this guidance is ancient, I believe we can do better.

cc @tplooker @selfissued @Sakurann @dwaite

Issue 15: Describe why core data model members are translated to JWT claims pending-close

Can we add an explanation why do these members need to be translated to the equivalents of the JWT claims?
iss, nbf, all of them are optional in RFC 7519 itself. They only become required when the JWT is used for a specific purpose, and the only place I can think of right now is an ID Token.

See: #11 (comment)

In order to complete the verification process, a verifier needs to obtain the cryptographic keys used to secure the credential.

There are several different ways to discover the verification keys of the issuers and holders.

When present in the JOSE Header or the JWT Claims Set members registered in the IANA JSON Web Token Claims registry or the IANA JSON Web Signature and Encryption Header Parameters registry are to be interpreted as defined by the specifications referenced in the registries.

These parameters and claims can be used to help verifiers discover verification keys.

If kid is present in the JOSE Header, a verifier can use this parameter as a hint indicating which key was used to secure the verifiable credential, when performing a verification process as defined in RFC7515.

kid MUST be present when the key of the issuer or subject is expressed as a DID URL.

If iss is present in the JOSE Header or the JWT Claims , a verifier can use this parameter to obtain a JSON Web Key to use in the verification process.

The value of the issuer property can be either a string or an object. When issuer value is a string, iss value, if present, MUST match issuer value. When issuer value is an object with an id value, iss value, if present, MUST match issuer.id value.

If kid is also present in the JOSE Header, it is expected to be useful to distinguish the specific key used.

Issue 31: About the optionality of the "kid" field in JWT-formatted VCs/VPs has-pr before-CR

There are a few issues related to clarification of optionality and behavior of registered claims.

If cnf is present in the JOSE Header or the JWT Claims , a verifier MAY use this parameter to identify a proof-of-possesion key in the manner described in [rfc7800] for use in the verification process.

Issue

The working group is currently exploring how Defining Well-Known Uniform Resource Identifiers (URIs) could be leveraged to assist a verifier in discovering verification keys for issuers and holders.

When the issuer value is a URL using the HTTPS scheme, issuer metadata including the issuer's public keys can be retrieved using the mechanism defined in SD-JWT-based Verifiable Credentials (SD-JWT VC).

As well as sections marked as non-normative, all authoring guidelines, diagrams, examples, and notes in this specification are non-normative. Everything else in this specification is normative.

The key words MAY, MUST, MUST NOT, RECOMMENDED, and SHOULD in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

The Verifiable Credentials Data Model v1.1 describes the approach taken by JSON Web Tokens to secure JWT Claims Sets as applying an external proof.

The normative statements in Securing Verifiable Credentials apply to securing application/vc+ld+json and application/vp+ld+json as application/vc+ld+json+sd-jwt and application/vp+ld+json+sd-jwt.

For clarity, these requirements are repeated here:

At least one securing mechanism, and the details necessary to evaluate it, MUST be expressed for a credential or presentation to be a verifiable credential or verifiable presentation; that is, to be verifiable.
Methods of securing credentials or presentations that embed a proof in the data model MUST use the proof property.
Methods of securing credentials or presentations that use an external proof MAY use the proof property.
One or more cryptographic proofs that can be used to detect tampering and verify the authorship of a credential or presentation. The specific method used for an embedded proof MUST be included using the type property.

The type VerifiableCredential and VerifiablePresentation are RDF Classes.

The presence of the word "Verifiable" does not convey a cryptographic verification capability exists.

The presence of the JSON proof member does not convey a cryptographic verification capability exists.

The presence of the JSON proof member is optional in both VerifiableCredential and VerifiablePresentation.

The presence of the JSON proof member is optional in both application/vc+ld+json and application/vp+ld+json.

JSON Web Token implementers are advised to review Implementation Requirements.

Accordingly, Issuers, Holders, and Verifiers MUST understand the JSON Web Token header parameter "alg": "none" when securing the [VC-DATA-MODEL] with JSON Web Tokens.

When content types from the [VC-DATA-MODEL] are secured using JSON Web Tokens, the header parameter "alg": "none", MUST be used to communicate that a JWT Claims Set (a Verifiable Credential or a Verifiable Presentation) has no integrity protection.

When a JWT Claims Set (a Verifiable Credential or a Verifiable Presentation) contains proof, and the JSON Web Token header contains "alg": "none", the JWT Claims Set MUST be considered to have no integrity protection.

Verifiable Credentials and Verifiable Presenatations are not required to be secured or integrity protected or to contain a proof member.

Issuers, Holders, and Verifiers MUST ignore all JWT Claims Sets that have no integrity protection.

Claim Name:	"vc"
Claim Description:	Verifiable Credential
Change Controller:	W3C
Specification Document(s):	Section 6.3.1.2: JSON Web Token Extensions of Verifiable Credentials Data Model 1.0

Claim Name:	"vp"
Claim Description:	Verifiable Presentation
Change Controller:	W3C
Specification Document(s):	Section 6.3.1.2: JSON Web Token Extensions of Verifiable Credentials Data Model 1.0

Verifiable Credentials often contain sensitive information that needs to be protected to ensure the privacy and security of organizations and individuals. This section outlines some privacy considerations relevant to implementers and users.

Implementers are advised to note and abide by all privacy considerations called out in the [VC-DATA-MODEL].

Implementers are additionally advised to reference the Privacy Consideration section of the JWT specification for privacy guidance.

In addition to the privacy recommendations in the [VC-DATA-MODEL], the following considerations are given:

Minimization of data: It is considered best practice for Verifiable Credentials to only contain the minimum amount of data necessary to achieve their intended purpose. This helps to limit the amount of sensitive information that is shared or stored unnecessarily.
Informed consent: It is considered best practice that individuals be fully informed about how their data will be used and provide the ability to consent to or decline the use of their data. This helps to ensure that individuals maintain control over their own personal information.
Data protection: It is considered best practice to protect Verifiable Credentials using strong encryption and other security measures to prevent unauthorized access, modification, or disclosure.

These considerations are not exhaustive, and implementers and users are advised to consult additional privacy resources and best practices to ensure the privacy and security of Verifiable Credentials implemented using VC-JWT.

This section outlines security considerations for implementers and users of this specification. It is important to carefully consider these factors to ensure the security and integrity of Verifiable Credentials when implemented using JWTs.

When implementing VC-JWTs, it is essential to address all security issues relevant to broad cryptographic applications. This especially includes protecting the user's asymmetric private and symmetric secret keys, as well as employing countermeasures against various attacks. Failure to adequately address these issues could compromise the security and integrity of Verifiable Credentials, potentially leading to unauthorized access, modification, or disclosure of sensitive information.

Implementers are advised to follow best practices and established cryptographic standards to ensure the secure handling of keys and other sensitive data. Additionally, conduct regular security assessments and audits to identify and address any vulnerabilities or threats.

Follow all security considerations outlined in [rfc7515] and [rfc7519].

When utilizing JSON-LD, take special care around remote retrieval of contexts and follow the additional security considerations noted in [json-ld11].

As noted in [rfc7515] when utilizing JSON [rfc7159], strict validation is a security requirement. If malformed JSON is received, it may be impossible to reliably interpret the producer's intent, potentially leading to ambiguous or exploitable situations. To prevent these risks, it is essential to use a JSON parser that strictly validates the syntax of all input data. It is essential that any JSON inputs that do not conform to the JSON-text syntax defined in [rfc7159] be rejected in their entirety by JSON parsers. Failure to reject invalid input could compromise the security and integrity of Verifiable Credentials.

This section is non-normative.

When implementing this specification, it is crucial for technical implementers to consider various accessibility factors. Ignoring accessibility concerns renders the information unusable for a significant portion of the population. To ensure equal access for all individuals, regardless of their abilities, it is vital to adhere to accessibility guidelines and standards, such as the Web Content Accessibility Guidelines (WCAG 2.1) [WCAG21]. This becomes even more critical when establishing systems that involve cryptography, as they have historically posed challenges for assistive technologies.

Implementers are advised to note and abide by all accessibility considerations called out in the [VC-DATA-MODEL].

This section is non-normative.

Implementers should take into account several internationalization considerations when publishing data described in this specification. Disregarding internationalization hampers the production and consumption of data across diverse languages and societies, thereby restricting the applicability and significantly reducing the value of the specification as a standard.

Implementers are advised to note and abide by all internationalization considerations called out in the [VC-DATA-MODEL], see also i18n, URL Standard

This section is non-normative.

Example 6: A verifiable credential controller document

{
  "@context": ["https://www.w3.org/ns/did/v1", {
    "@vocab": "https://vendor.example#"
  }],
  "id": "did:web:vendor.example",
  "alsoKnownAs": ["https://vendor.example",
    "did:jwk:eyJraWQiOiJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6andrLXRodW1icHJpbnQ6c2hhLTI1NjpGZk1iek9qTW1RNGVmVDZrdndUSUpqZWxUcWpsMHhqRUlXUTJxb2JzUk1NIiwia3R5IjoiT0tQIiwiY3J2IjoiRWQyNTUxOSIsImFsZyI6IkVkRFNBIiwieCI6IkFOUmpIX3p4Y0tCeHNqUlBVdHpSYnA3RlNWTEtKWFE5QVBYOU1QMWo3azQifQ"
  ],
  "verificationMethod": [{
    "id": "#urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs",
    "type": "JsonWebKey",
    "controller": "did:web:vendor.example",
    "publicKeyJwk": {
      "kty": "EC",
      "crv": "P-521",
      "alg": "ES512",
      "x": "AFTyMw-fIYJNg6fBVJvOPOsLxmnNj8HgqMChyRL0swLaefVAc7wrWZ8okQJqMmvv03JRUp277meQZM3JcvXFkH1v",
      "y": "ALn96CrD88b4TClmkl1sk0xk2FgAIda97ZF8TUOjbeWSzbKnN2KB6pqlpbuJ2xIRXvsn5BWQVlAT2JGpGwDNMyV1"
    }
  }, {
    "id": "#z6MkhEdpG12jyQegrr62ACRmNY8gc531W2j9Xo39cHphuCEH",
    "type": "JsonWebKey2020",
    "controller": "https://vendor.example",
    "publicKeyJwk": {
      "kid": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:FfMbzOjMmQ4efT6kvwTIJjelTqjl0xjEIWQ2qobsRMM",
      "kty": "OKP",
      "crv": "Ed25519",
      "alg": "EdDSA",
      "x": "ANRjH_zxcKBxsjRPUtzRbp7FSVLKJXQ9APX9MP1j7k4"
    }
  }, {
    "id": "#subject-authenticaton",
    "type": "JsonWebKey",
    "controller": "did:web:vendor.example",
    "publicKeyJwk": {
      "kty": "EC",
      "crv": "P-384",
      "alg": "ES384",
      "x": "PxgAmVYOQvSNcMYL2tOzoLwSWn4Ta3tIMPEUKR8pxeb-gmR11-DyKHBoIiY-2LhM",
      "y": "BZEBTkImVdpwvxR9THIRw16eblnj5-tZa7m-ww5uVd4kyPJNRoWUn2aT9ZuarAe-"
    }
  }, {
    "id": "#credential-issuance",
    "type": "JsonWebKey",
    "controller": "did:web:vendor.example",
    "publicKeyJwk": {
      "kty": "EC",
      "crv": "P-256",
      "alg": "ES256",
      "x": "MYvnaI87pfrn3FpTqW-yNiFcF1K7fedJiqapm20_q7c",
      "y": "9YEbT6Tyuc7xp9yRvhOUVKK_NIHkn5HpK9ZMgvK5pVw"
    }
  }, {
    "id": "#key-agreement",
    "type": "JsonWebKey",
    "controller": "did:web:vendor.example",
    "publicKeyJwk": {
      "kty": "OKP",
      "crv": "X25519",
      "alg": "ECDH-ES+A128KW",
      "x": "qLZkSTbstvMWPTivmiQglEFWG2Ff7gNDVoVisdZTr1I"
    }
  }],
  "authentication": ["#subject-authenticaton"],
  "assertionMethod": ["#credential-issuance"],
  "keyAgreement": ["#key-agreement"]
}

Example 7: A revocable credential with multiple subjects

application/vc+ld+json
text/vnd.mermaid
application/vc+ld+json+sd-jwt

{
  "@context": ["https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "id": "https://contoso.example/credentials/23894672394",
  "type": ["VerifiableCredential", "K9UnitCredential"],
  "issuer": {
    "id": "https://contoso.example"
  },
  "validFrom": "2015-04-16T05:11:32.432Z",
  "credentialStatus": {
    "id": "https://contoso.example/credentials/status/4#273762",
    "type": "StatusList2021Entry",
    "statusPurpose": "revocation",
    "statusListIndex": "273762",
    "statusListCredential": "https://contoso.example/credentials/status/4"
  },
  "credentialSubject": [{
    "id": "did:example:1312387641",
    "type": "Person"
  }, {
    "id": "did:example:63888231",
    "type": "Dog"
  }]
}

graph LR

17("VerifiableCredential")
18{{"id"}}
19("https://contoso.example/credentials/23894672394")
20(("type"))
21("K9UnitCredential")
22("issuer")
23{{"id"}}
24("https://contoso.example")
25("validFrom")
26("2015-04-16T05:11:32.432Z")
27("credentialStatus")
28{{"id"}}
29("https://contoso.example/credentials/status/4#273762")
30(("type"))
31("StatusList2021Entry")
32("statusPurpose")
33("revocation")
34("statusListIndex")
35("273762")
36("statusListCredential")
37("https://contoso.example/credentials/status/4")
38("credentialSubject")
39{{"id"}}
40("did:example:1312387641")
41(("type"))
42("Person")
43("credentialSubject")
44{{"id"}}
45("did:example:63888231")
46(("type"))
47("Dog")

17 --- 18
18 --- 19
17 --- 20
20 --- 21
17 --- 22
22 --- 23
23 --- 24
17 --- 25
25 --- 26
17 --- 27
27 --- 28
28 --- 29
27 --- 30
30 --- 31
27 --- 32
32 --- 33
27 --- 34
34 --- 35
27 --- 36
36 --- 37
17 --- 38
38 --- 39
39 --- 40
38 --- 41
41 --- 42
17 --- 43
43 --- 44
44 --- 45
43 --- 46
46 --- 47

---------------- Issuer Claims ----------------
"@context":
  - https://www.w3.org/ns/credentials/v2
  - https://www.w3.org/ns/credentials/examples/v2
!sd id: https://contoso.example/credentials/23894672394
!sd type:
  - VerifiableCredential
  - K9UnitCredential
issuer:
  !sd id: https://contoso.example
validFrom: 2015-04-16T05:11:32.432Z
credentialStatus:
  !sd id: https://contoso.example/credentials/status/4#273762
  !sd type: StatusList2021Entry
  statusPurpose: revocation
  statusListIndex: "273762"
  statusListCredential: https://contoso.example/credentials/status/4
credentialSubject:
  - !sd id: did:example:1312387641
    !sd type: Person
  - !sd id: did:example:63888231
    !sd type: Dog
---------------- Holder Disclosure ----------------
id: False
type: True
issuer:
  id: True
credentialStatus:
  id: True
---------------- Decoded Protected Header ----------------
{
  "alg": "ES256",
  "typ": "vc+ld+json+sd-jwt",
  "cty": "vc+ld+json"
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "issuer": {
    "id": "https://contoso.example"
  },
  "validFrom": "2015-04-16T05:11:32.432Z",
  "credentialStatus": {
    "statusPurpose": "revocation",
    "statusListIndex": "273762",
    "statusListCredential": "https://contoso.example/credentials/status/4",
    "id": "https://contoso.example/credentials/status/4#273762"
  },
  "credentialSubject": [
    {},
    {}
  ],
  "iss": "did:web:issuer.example",
  "iat": 1695268650,
  "exp": 1726891050,
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-256",
      "alg": "ES256",
      "x": "yB1f5LN4cPgwhlS2v-E4AZQ36xVLLjXTKObhn5LHc4Y",
      "y": "r0eL2wjutAz5SXF8MC7AePAn6DEdCODuymfFxXkO-LM"
    }
  },
  "type": [
    "VerifiableCredential",
    "K9UnitCredential"
  ]
}
---------------- Compact Encoded Selective Disclosure JSON Web Token ----------------
eyJhbGciOiJFUzI1NiIsInR5cCI6InZjK2xkK2pzb24rc2Qtand0IiwiY3R5IjoidmMrbGQranNvbiJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiLCJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvZXhhbXBsZXMvdjIiXSwiaXNzdWVyIjp7Il9zZCI6WyJTNzJtdEFBRmRBdkFJSWNTVVd3MjFscUpMQTduVXFJUS1vOWx6bFljeWswIl19LCJ2YWxpZEZyb20iOiIyMDE1LTA0LTE2VDA1OjExOjMyLjQzMloiLCJjcmVkZW50aWFsU3RhdHVzIjp7InN0YXR1c1B1cnBvc2UiOiJyZXZvY2F0aW9uIiwic3RhdHVzTGlzdEluZGV4IjoiMjczNzYyIiwic3RhdHVzTGlzdENyZWRlbnRpYWwiOiJodHRwczovL2NvbnRvc28uZXhhbXBsZS9jcmVkZW50aWFscy9zdGF0dXMvNCIsIl9zZCI6WyJBdjJlbjFqbXV3RHBfc2NIOWFZWldwdmR1UjJlTUxpakpiY2dpQk9vY2RnIiwiUUgzN1ZXaEZwSkVtTlNIZTRJcGtZNXhXMVMxN3BrSlg5OWpBUi0tZUh6ayJdfSwiY3JlZGVudGlhbFN1YmplY3QiOlt7Il9zZCI6WyJFN1F5aVVGRkRNYmtNaUszeGVST3BIZGpPalJvbWVvVVdDZS1hdkVVZDlvIiwiWDV3UTV3WEZicE9SZVVhYndLNi1vVG1OSjdGQzNPaURJYUpkNTJFRWtxcyJdfSx7Il9zZCI6WyJhSzhGbW5VWkRUN0o2am9ZOWc4a1lRc2VTNkx5dDdKc1dqUVlsZ1Z1QnNvIiwia1AyRWpxM3dUUFVfNVRJWXdNMzlCZVRKbE1QWWJTQ3pHVVJGZmpZSjJiOCJdfV0sIl9zZCI6WyJFNU1icjh3czgxZm1xRjk2NVJJRS1GNVFhLUtTWXh4Z0h0SDdpOXBTQktJIiwiSlgwazJ4WERxS0xxOWVld1BTNDlnc0xOWHdKLWhTb1pUSlJKSjZScWI3USJdLCJfc2RfYWxnIjoic2hhLTI1NiIsImlzcyI6ImRpZDp3ZWI6aXNzdWVyLmV4YW1wbGUiLCJpYXQiOjE2OTUyNjg2NTAsImV4cCI6MTcyNjg5MTA1MCwiY25mIjp7Imp3ayI6eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2IiwiYWxnIjoiRVMyNTYiLCJ4IjoieUIxZjVMTjRjUGd3aGxTMnYtRTRBWlEzNnhWTExqWFRLT2JobjVMSGM0WSIsInkiOiJyMGVMMndqdXRBejVTWEY4TUM3QWVQQW42REVkQ09EdXltZkZ4WGtPLUxNIn19fQ.pb1qlIFXzNc6yboMvPyedMgldVVROnAwS9PoEp_7sh7_gKoZCme3JLqznued4MSzAACLVW-x_MFz8HwbuDwNsg~WyJhVUd2NXZEdHQtSHJiWGZpQkRtcHVRIiwgImlkIiwgImh0dHBzOi8vY29udG9zby5leGFtcGxlIl0~WyJOREV3TWZMQWRZRERjU2Q4S3dWWUx3IiwgImlkIiwgImh0dHBzOi8vY29udG9zby5leGFtcGxlL2NyZWRlbnRpYWxzL3N0YXR1cy80IzI3Mzc2MiJd~WyJoTjB6NkxxSWZESVdSWE94WEgtVUFnIiwgInR5cGUiLCBbIlZlcmlmaWFibGVDcmVkZW50aWFsIiwgIks5VW5pdENyZWRlbnRpYWwiXV0~eyJhbGciOiJFUzI1NiIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6IkZXWWdXN1NXRFpKU0FGSE1KblFoTEEiLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTUyNjg2NTB9.ooszp0hMVzo-Z1PJsOXfPyjens9DmjUY_vDp3myH9euHdS21ZIBmKe90VpF-WWs-_ONTonLWCDM9tT_eqIYhVQ

Example 8: A credential with a schema

application/vc+ld+json
text/vnd.mermaid
application/vc+ld+json+sd-jwt

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "id": "https://contoso.example/credentials/35327255",
  "type": ["VerifiableCredential", "KYCExample"],
  "issuer": "did:web:contoso.example",
  "validFrom": "2019-05-25T03:10:16.992Z",
  "validUntil": "2027-05-25T03:10:16.992Z",
  "credentialSchema": {
    "id": "https://contoso.example/bafybeigdyr...lqabf3oclgtqy55fbzdi",
    "type": "JsonSchema"
  },
  "credentialSubject": {
    "id": "did:example:1231588",
    "type": "Person"
  }
}

graph LR

48("VerifiableCredential")
49{{"id"}}
50("https://contoso.example/credentials/35327255")
51(("type"))
52("KYCExample")
53("issuer")
54("did:web:contoso.example")
55("validFrom")
56("2019-05-25T03:10:16.992Z")
57("validUntil")
58("2027-05-25T03:10:16.992Z")
59("credentialSchema")
60{{"id"}}
61("https://contoso.example/bafybeigdyr...lqabf3oclgtqy55fbzdi")
62(("type"))
63("JsonSchema")
64("credentialSubject")
65{{"id"}}
66("did:example:1231588")
67(("type"))
68("Person")

48 --- 49
49 --- 50
48 --- 51
51 --- 52
48 --- 53
53 --- 54
48 --- 55
55 --- 56
48 --- 57
57 --- 58
48 --- 59
59 --- 60
60 --- 61
59 --- 62
62 --- 63
48 --- 64
64 --- 65
65 --- 66
64 --- 67
67 --- 68

---------------- Issuer Claims ----------------
"@context":
  - https://www.w3.org/ns/credentials/v2
  - https://www.w3.org/ns/credentials/examples/v2
!sd id: https://contoso.example/credentials/35327255
!sd type:
  - VerifiableCredential
  - KYCExample
issuer: did:web:contoso.example
validFrom: 2019-05-25T03:10:16.992Z
validUntil: 2027-05-25T03:10:16.992Z
credentialSchema:
  !sd id: https://contoso.example/bafybeigdyr...lqabf3oclgtqy55fbzdi
  !sd type: JsonSchema
credentialSubject:
  !sd id: did:example:1231588
  !sd type: Person
---------------- Holder Disclosure ----------------
issuer:
  id: True
credentialStatus:
  id: True
credentialSubject:
  id: True
  type: False
---------------- Decoded Protected Header ----------------
{
  "alg": "ES384"
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "issuer": "did:web:contoso.example",
  "validFrom": "2019-05-25T03:10:16.992Z",
  "validUntil": "2027-05-25T03:10:16.992Z",
  "credentialSchema": {},
  "credentialSubject": {
    "id": "did:example:1231588"
  },
  "iss": "did:web:issuer.example",
  "iat": 1695268650,
  "exp": 1726891050,
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-384",
      "alg": "ES384",
      "x": "mWImB66apeDQ4zJ_2QhCTKizZv4QU5INIXBhoH7XdGi0UxLdMGukU_5u2-bORi1k",
      "y": "Ba8RhH5YhLkMhIm3iy-77DDJKgg77qkJWinmmnh4C7eXmjIiQn5vHLGByIuoQPBB"
    }
  }
}
---------------- Compact Encoded Selective Disclosure JSON Web Token ----------------
eyJhbGciOiJFUzM4NCJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiLCJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvZXhhbXBsZXMvdjIiXSwiaXNzdWVyIjoiZGlkOndlYjpjb250b3NvLmV4YW1wbGUiLCJ2YWxpZEZyb20iOiIyMDE5LTA1LTI1VDAzOjEwOjE2Ljk5MloiLCJ2YWxpZFVudGlsIjoiMjAyNy0wNS0yNVQwMzoxMDoxNi45OTJaIiwiY3JlZGVudGlhbFNjaGVtYSI6eyJfc2QiOlsiQTNrQ3NXWU9PbEpkRTE0dU9yNGs5Q3dMMWY1RWhWbE1PWVAtMU53QXFDQSIsIm5ldUVZbmNWUmYxQmR6ZHh1bms5eVVYZGZ2QzBlcTZqU1hEeHhwNngzVTgiXX0sImNyZWRlbnRpYWxTdWJqZWN0Ijp7Il9zZCI6WyJ2SWo2SmRKS1k1NjlwZDN1ZGdCZGVaMTItWjQyLVBUWDhyVjF4SUdUOVFzIiwidmpVMDJpMk5DaThDZ1dJSXJtVnpGV0FoTTY1V3JvTGJ0TlFIR25UUjE0dyJdfSwiX3NkIjpbIk0yYjczRWw2cGJFZzNCMzFPcWt6YXJ2OWdWNGxpWTNucVROekM5ZHRCRVUiLCJnYkpPeGo0OXE2cWZkOFkwY3lnNDh0LVNZNUtpclltZUtLS25HMXE5ZGV3Il0sIl9zZF9hbGciOiJzaGEtMjU2IiwiaXNzIjoiZGlkOndlYjppc3N1ZXIuZXhhbXBsZSIsImlhdCI6MTY5NTI2ODY1MCwiZXhwIjoxNzI2ODkxMDUwLCJjbmYiOnsiandrIjp7Imt0eSI6IkVDIiwiY3J2IjoiUC0zODQiLCJhbGciOiJFUzM4NCIsIngiOiJtV0ltQjY2YXBlRFE0ekpfMlFoQ1RLaXpadjRRVTVJTklYQmhvSDdYZEdpMFV4TGRNR3VrVV81dTItYk9SaTFrIiwieSI6IkJhOFJoSDVZaExrTWhJbTNpeS03N0RESktnZzc3cWtKV2lubW1uaDRDN2VYbWpJaVFuNXZITEdCeUl1b1FQQkIifX19.byTfn-mlUmbDC-Jv9eYbyURokpgJ07f8BRSW0PhjHJaTocoPgXvCbivWi89gt3JIurTvUTPd-YQAQILZA8we1KQswq0Vs5sYrtq90uw8atBckJHx41cZ6YKXDN9fVpxo~WyJsQWVyX3F5QkhBU0F3ekhLU1BjSDlBIiwgImlkIiwgImRpZDpleGFtcGxlOjEyMzE1ODgiXQ~eyJhbGciOiJFUzM4NCIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6IjN1WFhLT3JvRllrMHNhZ2JaZjBxWkEiLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTUyNjg2NTB9.VB4gOmtiiAdN-oK2zZUlh5jr6Bk-0-elw80ffkrTICrPhgy4l24Gp_QT3M8S4BoReJuXiYtpu2TO4o_8HHb-UHP_YOoDwkr_r87EWQIvFyIiEx2WWUPV6yJTYEs1kh-A

Example 9: Presentation

application/vp+ld+json
text/vnd.mermaid
application/vp+ld+json+sd-jwt

{
  "@context": ["https://www.w3.org/ns/credentials/v2"],
  "type": ["VerifiablePresentation"],
  "holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI",
  "verifiableCredential": [{
      "@context": [
        "https://www.w3.org/ns/credentials/v2"
      ],
      "type": [
        "VerifiableCredential"
      ],
      "issuer": "https://issuer.example/issuers/68",
      "validFrom": "2023-06-07T21:14:14.148Z",
      "credentialSubject": {
        "id": "https://subject.vendor.example"
      }
    },
    "https://vendor.example/credentials/42", 
    "did:example:123",
    "urn:uuid:01ec9426-c175-4e39-a006-d30050e28214",
    "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI",
    "data:application/vc+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0="
  ]
}

graph LR

82("VerifiablePresentation")
83("holder")
84("urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI")
85("verifiableCredential")
86("issuer")
87("https://issuer.example/issuers/68")
88("validFrom")
89("2023-06-07T21:14:14.148Z")
90("credentialSubject")
91{{"id"}}
92("https://subject.vendor.example")
93("verifiableCredential")
94("https://vendor.example/credentials/42")
95("verifiableCredential")
96("did:example:123")
97("verifiableCredential")
98("urn:uuid:01ec9426-c175-4e39-a006-d30050e28214")
99("verifiableCredential")
100("urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI")
101("verifiableCredential")
102("data:application/vc+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0=")

82 --- 83
83 --- 84
82 --- 85
85 --- 86
86 --- 87
85 --- 88
88 --- 89
85 --- 90
90 --- 91
91 --- 92
82 --- 93
93 --- 94
82 --- 95
95 --- 96
82 --- 97
97 --- 98
82 --- 99
99 --- 100
82 --- 101
101 --- 102

---------------- Issuer Claims ----------------
"@context":
  - https://www.w3.org/ns/credentials/v2
!sd type:
  - VerifiablePresentation
holder: urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI
verifiableCredential:
  - "@context":
      - https://www.w3.org/ns/credentials/v2
    !sd type:
      - VerifiableCredential
    issuer: https://issuer.example/issuers/68
    validFrom: 2023-06-07T21:14:14.148Z
    credentialSubject:
      !sd id: https://subject.vendor.example
  - https://vendor.example/credentials/42
  - did:example:123
  - urn:uuid:01ec9426-c175-4e39-a006-d30050e28214
  - urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI
  - data:application/vc+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0=
---------------- Holder Disclosure ----------------
id: True
type: True
holder:
  id: True
---------------- Decoded Protected Header ----------------
{
  "alg": "ES256",
  "typ": "vp+ld+json+sd-jwt",
  "cty": "vp+ld+json"
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2"
  ],
  "holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI",
  "verifiableCredential": [
    {
      "@context": [
        "https://www.w3.org/ns/credentials/v2"
      ],
      "issuer": "https://issuer.example/issuers/68",
      "validFrom": "2023-06-07T21:14:14.148Z",
      "credentialSubject": {}
    },
    "https://vendor.example/credentials/42",
    "did:example:123",
    "urn:uuid:01ec9426-c175-4e39-a006-d30050e28214",
    "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI",
    "data:application/vc+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0="
  ],
  "iss": "did:web:issuer.example",
  "iat": 1695268650,
  "exp": 1726891050,
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-256",
      "alg": "ES256",
      "x": "wmRmof0HTKmurm6qHnSP0TjxVNTw_Nz2tiZfPefE48k",
      "y": "zdpTWWN5gLpQo1Kliuq6ystYxBF13e5-jfxeBvq7ksk"
    }
  },
  "type": [
    "VerifiablePresentation"
  ]
}
---------------- Compact Encoded Selective Disclosure JSON Web Token ----------------
eyJhbGciOiJFUzI1NiIsInR5cCI6InZwK2xkK2pzb24rc2Qtand0IiwiY3R5IjoidnArbGQranNvbiJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwiaG9sZGVyIjoidXJuOmlldGY6cGFyYW1zOm9hdXRoOmp3ay10aHVtYnByaW50OnNoYS0yNTY6X0ZwZmUyN0F1R21FbGpaRTlzMmx3MlVILXFyWkxSRk5yV2JKcldJZTRTSSIsInZlcmlmaWFibGVDcmVkZW50aWFsIjpbeyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwiaXNzdWVyIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9pc3N1ZXJzLzY4IiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiX3NkIjpbIlVzaFowMGVadVhCajFrM2l5T0FacTcteklNdGpjbWNzQ1dOb0l3RUNLa2siXX0sIl9zZCI6WyJWcjJkLXQ2MWJVZWc4VGd6ZEU1ckNnOU1sQ2ludGQ0dGRMb3l2QjZGNFlnIl19LCJodHRwczovL3ZlbmRvci5leGFtcGxlL2NyZWRlbnRpYWxzLzQyIiwiZGlkOmV4YW1wbGU6MTIzIiwidXJuOnV1aWQ6MDFlYzk0MjYtYzE3NS00ZTM5LWEwMDYtZDMwMDUwZTI4MjE0IiwidXJuOmlldGY6cGFyYW1zOm9hdXRoOmp3ay10aHVtYnByaW50OnNoYS0yNTY6X0ZwZmUyN0F1R21FbGpaRTlzMmx3MlVILXFyWkxSRk5yV2JKcldJZTRTSSIsImRhdGE6YXBwbGljYXRpb24vdmMrbGQranNvbjtiYXNlNjQsZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSmthV1E2YW5kck9tVjVTbkpoVjFGcFQybEtNV050TkRaaFYxWXdXbXB3ZDFsWVNtaGlXRTAyWWpKR01XUkhaelpoYm1SeVRGaFNiMlJYTVdsalNFcHdZbTVSTm1NeWFHaE1WRWt4VG1wd2RsRnRVbTFrYlZwRVQxaG9OazFHT1VKVldGcFNUak5aTVUxWWJFUlhiRGw2WlVkd05VNTZWa05VU0VwSlpXc3hUMUpxYTNsUFYxVTBTV2wzYVdFelVqVkphbTlwVkRCMFVVbHBkMmxaTTBveVNXcHZhVkpYVVhsT1ZGVjRUMU5KYzBsdFJuTmFlVWsyU1d0V2ExSkdUa0pKYVhkcFpVTkpOa2xxVG1samJVNXpZakJKTkdGRVVrNVhiRlpKWW1zNVVWVkhiR3RUYlhkMFUycGtkVlZzUmtwWFNGSlVZVVp3TTFveU5XMWpiSEF4VkRJNGFXWlJJaXdpZG1Gc2FXUkdjbTl0SWpvaU1qQXlNeTB3Tmkwd04xUXlNVG94TkRveE5DNHhORGhhSWl3aVkzSmxaR1Z1ZEdsaGJGTjFZbXBsWTNRaU9uc2lhV1FpT2lKb2RIUndjem92TDNOMVltcGxZM1F1ZG1WdVpHOXlMbVY0WVcxd2JHVWlmWDA9Il0sIl9zZCI6WyJlRGVvWktMM0NYcDhiOEdRZVV0T0tRdGtNY1Z4QU5odWduTTFkQjkyZEo4Il0sIl9zZF9hbGciOiJzaGEtMjU2IiwiaXNzIjoiZGlkOndlYjppc3N1ZXIuZXhhbXBsZSIsImlhdCI6MTY5NTI2ODY1MCwiZXhwIjoxNzI2ODkxMDUwLCJjbmYiOnsiandrIjp7Imt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJhbGciOiJFUzI1NiIsIngiOiJ3bVJtb2YwSFRLbXVybTZxSG5TUDBUanhWTlR3X056MnRpWmZQZWZFNDhrIiwieSI6InpkcFRXV041Z0xwUW8xS2xpdXE2eXN0WXhCRjEzZTUtamZ4ZUJ2cTdrc2sifX19.905Oi_a8Y71A0yNj2tyFm5jY38MShSsIGlJJPW4wYsicwUVgHuLcdsky2M4z6xD-7_La2rah6CgglDkY85HWEg~WyJhOXQ1LU92MWpUM053S253SjE0bXhnIiwgInR5cGUiLCBbIlZlcmlmaWFibGVQcmVzZW50YXRpb24iXV0~eyJhbGciOiJFUzI1NiIsInR5cCI6ImtiK2p3dCJ9.eyJub25jZSI6IkVhcVAyTk9DQzA5S0p2VWduNzNXcWciLCJhdWQiOiJkaWQ6d2ViOnZlcmlmaWVyLmV4YW1wbGUiLCJpYXQiOjE2OTUyNjg2NTB9.mPB4h7dzCqodaYvfpDAie_O752yYYOAPU7lDKdHmkIRb8nAx4bJvQ05sY7n-s1TCFVeoSYAWTfGrHZXsYm9Gag

Example 10: JSON-LD Verifiable Credential

data:application/vc+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0=

Example 11: JSON-LD Verifiable Presentation

data:application/vp+ld+json+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0=

Issue

TODO add COSE Sign1 detached payload examples

Type name:	application
Subtype name:	vc+ld+json+sd-jwt
Required parameters:	None
Encoding considerations:	binary; application/sd-jwt values are a series of base64url-encoded values (some of which may be the empty string) separated by period ('.') or tilde ('~') characters.
Security considerations:	As defined in this specification. See also the security considerations in Selective Disclosure for JWTs (SD-JWT).
Contact:	W3C Verifiable Credentials Working Group public-vc-wg@w3.org

Type name:	application
Subtype name:	vp+ld+json+sd-jwt
Required parameters:	None
Encoding considerations:	binary; application/sd-jwt values are a series of base64url-encoded values (some of which may be the empty string) separated by period ('.') or tilde ('~') characters.
Security considerations:	As defined in this specification. See also the security considerations in Selective Disclosure for JWTs (SD-JWT).
Contact:	W3C Verifiable Credentials Working Group public-vc-wg@w3.org

Securing Verifiable Credentials using JOSE and COSE

Abstract

Status of This Document

1. Introduction

2. Securing the VC Data Model

2.1 With JOSE

2.1.1 Securing JSON-LD Verifiable Credentials with JOSE

2.1.2 Securing JSON-LD Verifiable Presentations with JOSE

2.2 With COSE

2.2.1 Securing JSON-LD VCs with COSE

3. Wallets

4. Key Discovery

4.1 Registered Header Parameter and Claim Names

4.1.1 kid

4.1.2 iss

4.1.3 cnf

4.2 Well Known URIs

4.2.1 JWT Issuer

5. JOSE Header Parameters

6. Conformance

6.1 Securing Verifiable Credentials

7. IANA Considerations

7.1 Media Types

7.1.1 application/vc+ld+json+sd-jwt

7.1.2 application/vp+ld+json+sd-jwt

7.2 Registered Claims

7.2.1 vc

7.2.2 vp

8. Other Considerations

8.1 Privacy Considerations

8.2 Security Considerations

8.3 Accessibility

8.4 Internationalization

9. Appendix

9.1 Controllers

9.2 Credentials

9.3 Presentations

9.4 Data URIs

9.5 Detached Payload

A. References

A.1 Normative references

A.2 Informative references

7.1.1 `application/vc+ld+json+sd-jwt`

7.1.2 `application/vp+ld+json+sd-jwt`

7.2.1 `vc`

7.2.2 `vp`