Securing Verifiable Credentials using JOSE and COSE

This specification describes how to secure media types expressing Verifiable Credentials and Verifiable Presentations as described in the [VC-DATA-MODEL], using approaches described by the COSE and JOSE working groups at IETF. This includes JWTs [RFC7519], JWS [RFC7515], and COSE [RFC8152] and provides an approach using well defined content types [RFC6838] to identify that the type of data being secured conforms with the [VC-DATA-MODEL].

JSON Web Signatures (JWS) [RFC7515] provide a standardized mechanism for digitally signing JSON data. It provides a means to ensure the integrity, authenticity, and non-repudiation of the information contained in a JSON object. JWS enables secure communication and trust between parties by adding a cryptographic signature to a payload. This signature is generated using a private key and can be verified using the corresponding public key. JWS enables content integrity, authentication and non repudiation, protecting data from unauthorized modifications. The versatility and wide adoption of JWS make it an essential component for verifying the authenticity and integrity of data in various applications, including authentication, authorization, and secure data exchange. These properties make JWS especially well suited to securing the JSON-LD [VC-DATA-MODEL] and through this to provide a means of supporting the three party model (issuer, verifier, holder) for exchange of credentials enabled in verifiable credenials.

JSON Web Token (JWT) [RFC7519] is a widely-used means of expressing claims, represented in JSON, to be transferred between two parties. Providing a representation of the Verifiable Credentials Data Model for JWT allows existing systems and libraries to participate in the ecosystem described in Section ecosystem overview. A JWT encodes a set of claims as a JSON object that is contained in a JSON Web Signature (JWS) [RFC7515] and/or JSON Web Encryption (JWE) [RFC7516]. For this specification, the use of JWE is out of scope.

Issue

The working group is discussing how we might comment on recent work, that does make use of encryption in OpenID for Verifiable Presentations.

CBOR Object Signing and Encryption (COSE) [RFC8152] is a specification that defines a framework for representing signed and encrypted data using (Concise Binary Object Representation) [RFC8949] data structures. COSE provides a standardized way to secure the integrity, authenticity, and confidentiality of CBOR-encoded information. It offers a flexible and extensible set of cryptographic options, allowing for a wide range of algorithms to be used for signing and encryption. COSE supports two main operations: signing and encryption. For signing, COSE allows the creation of digital signatures over CBOR data using various algorithms such as HMAC, RSA, ECDSA, or EdDSA. These signatures provide assurance of data integrity and authenticity. COSE also supports encryption, enabling the confidentiality of CBOR data by encrypting it with symmetric or asymmetric encryption algorithms.

The use of Verifiable Credentials often involves the representation and exchange of structured data in the form of JSON-LD as this is the structured suffix of the base media types defined in [VC-DATA-MODEL]. While JSON-LD provides a flexible and extensible format for describing linked data, see JSON-LD Relationship to RDF, it is important to note that it also provides a linkage between the data structure and semantic meaning of data.

This section outlines how JSON-LD claimsets can be secured using either JOSE or COSE.

A benefit to this approach is that payloads can be made to conform directly to the [VC-DATA-MODEL] without any mapping or transformation.

This section details how to secure data payloads with the type application/vc+ld+json with JOSE.

[rfc7515] MAY be used to secure this media type.

The typ parameter MUST be vc+ld+jwt

When present, the cty MUST be vc+ld+json

See Common JOSE Header Parameters for additional details regarding usage of typ and cty.

Example 1: Example Credential

Claimset
Verifiable Credential
Graph

{
  "@context": ["https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "id": "http://example.edu/credentials/3732",
  "type": ["VerifiableCredential",
    "UniversityDegreeCredential"
  ],
  "issuer": "https://example.edu/issuers/14",
  "issuanceDate": "2010-01-01T19:23:24Z",
  "credentialSubject": {
    "id": "did:example:123",
    "degree": {
      "type": "BachelorDegree",
      "name": "Bachelor of Science and Arts"
    }
  }
}

---------------- Decoded Protected Header ----------------
{
  "alg": "ES384",
  "typ": "vc+ld+jwt",
  "iss": "https://example.edu/issuers/14",
  "iat": 1688155486
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "id": "http://example.edu/credentials/3732",
  "type": [
    "VerifiableCredential",
    "UniversityDegreeCredential"
  ],
  "issuer": "https://example.edu/issuers/14",
  "issuanceDate": "2010-01-01T19:23:24Z",
  "credentialSubject": {
    "id": "did:example:123",
    "degree": {
      "type": "BachelorDegree",
      "name": "Bachelor of Science and Arts"
    }
  }
}
---------------- Compact Encoded JSON Web Token ----------------
eyJhbGciOiJFUzM4NCIsInR5cCI6InZjK2xkK2p3dCIsImlzcyI6Imh0dHBzOi8vZXhhbXBsZS5
lZHUvaXNzdWVycy8xNCIsImlhdCI6MTY4ODE1NTQ4Nn0.eyJAY29udGV4dCI6WyJodHRwczovL3
d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiLCJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZ
GVudGlhbHMvZXhhbXBsZXMvdjIiXSwiaWQiOiJodHRwOi8vZXhhbXBsZS5lZHUvY3JlZGVudGlh
bHMvMzczMiIsInR5cGUiOlsiVmVyaWZpYWJsZUNyZWRlbnRpYWwiLCJVbml2ZXJzaXR5RGVncmV
lQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJodHRwczovL2V4YW1wbGUuZWR1L2lzc3VlcnMvMTQiLC
Jpc3N1YW5jZURhdGUiOiIyMDEwLTAxLTAxVDE5OjIzOjI0WiIsImNyZWRlbnRpYWxTdWJqZWN0I
jp7ImlkIjoiZGlkOmV4YW1wbGU6MTIzIiwiZGVncmVlIjp7InR5cGUiOiJCYWNoZWxvckRlZ3Jl
ZSIsIm5hbWUiOiJCYWNoZWxvciBvZiBTY2llbmNlIGFuZCBBcnRzIn19fQ.DAuZ8w-hFEfN965O
IeR2B_nXevt42IXJDvb6FsP2T389JdPAK_QyziCykT2X5LataFc2UA9Zw5ZJfGzLKg1v4yxanpA
PJJ4dPtXbCYrJCpp-fD_NTKXLqKLav6-FTaI1


graph LR

0("VerifiableCredential")
1{{"id"}}
2("http://example.edu/credentials/3732")
3(("type"))
4("UniversityDegreeCredential")
5("issuer")
6("https://example.edu/issuers/14")
7("issuanceDate")
8("2010-01-01T19:23:24Z")
9("credentialSubject")
10{{"id"}}
11("did:example:123")
12("degree")
13(("type"))
14("BachelorDegree")
15("name")
16("Bachelor of Science and Arts")

0 --- 1
1 --- 2
0 --- 3
3 --- 4
0 --- 5
5 --- 6
0 --- 7
7 --- 8
0 --- 9
9 --- 10
10 --- 11
9 --- 12
12 --- 13
13 --- 14
12 --- 15
15 --- 16

This section details how to secure verifiable presentations with the type application/vp+ld+json with JOSE.

[rfc7515] MAY be used to secure this media type.

The typ parameter MUST be vp+ld+jwt

When present, the cty parameter MUST be vp+ld+json

See Common JOSE Header Parameters for additional details regarding usage of typ and cty.

Example 2: The minimal unsecured verifiable presentation

Claimset
Verifiable Credential
Graph

{
  "@context": ["https://www.w3.org/ns/credentials/v2"],
  "type": ["VerifiablePresentation"]
}

---------------- Decoded Unprotected Header ----------------
{
  "alg": "none",
  "typ": "vp+ld+jwt"
}
---------------- Decoded Unprotected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2"
  ],
  "type": [
    "VerifiablePresentation"
  ]
}
---------------- Compact Encoded JSON Web Token ----------------
eyJhbGciOiJub25lIiwidHlwIjoidnArbGQrand0In0.eyJAY29udGV4dCI6WyJodHRwczovL3d
3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlUHJlc2VudG
F0aW9uIl19.


graph LR

17("VerifiablePresentation")

Example 3: The minimal secured verifiable presentation

Claimset
Verifiable Credential
Graph

{
  "@context": ["https://www.w3.org/ns/credentials/v2"],
  "type": ["VerifiablePresentation"]
}

---------------- Decoded Protected Header ----------------
{
  "alg": "ES384"
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2"
  ],
  "type": [
    "VerifiablePresentation"
  ]
}
---------------- Compact Encoded JSON Web Token ----------------
eyJhbGciOiJFUzM4NCJ9.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZG
VudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlUHJlc2VudGF0aW9uIl19.OpSAFzaNa_b1
UsGslz5x3QmZf_-MsP1-PULAIvWW7JiVQ7uz5q9sCzy5_6mytEG3ByX5QjwryBM0XJhP75eqBu-
sAhA-0of6zCIGVZIrmWkvoYk7uLBX1Bz1xcQNcyaB


graph LR

18("VerifiablePresentation")

Example 4: A secured verifiable presentation with a holder identifier

Claimset
Verifiable Credential
Graph

{
  "@context": ["https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "type": ["VerifiablePresentation"],
  "holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
}

---------------- Decoded Protected Header ----------------
{
  "alg": "ES384",
  "typ": "vp+ld+jwt",
  "iss": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF
4W_7noWXFZAfHkxZsRGC9Xs",
  "iat": 1688155486,
  "nonce": "n-0S6_WzA2Mj",
  "aud": "https://contoso.example"
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "type": [
    "VerifiablePresentation"
  ],
  "holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MN
wXF4W_7noWXFZAfHkxZsRGC9Xs"
}
---------------- Compact Encoded JSON Web Token ----------------
eyJhbGciOiJFUzM4NCIsInR5cCI6InZwK2xkK2p3dCIsImlzcyI6InVybjppZXRmOnBhcmFtczp
vYXV0aDpqd2stdGh1bWJwcmludDpzaGEtMjU2Ok56YkxzWGg4dURDY2QtNk1Od1hGNFdfN25vV1
hGWkFmSGt4WnNSR0M5WHMiLCJpYXQiOjE2ODgxNTU0ODYsIm5vbmNlIjoibi0wUzZfV3pBMk1qI
iwiYXVkIjoiaHR0cHM6Ly9jb250b3NvLmV4YW1wbGUifQ.eyJAY29udGV4dCI6WyJodHRwczovL
3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiLCJodHRwczovL3d3dy53My5vcmcvbnMvY3Jl
ZGVudGlhbHMvZXhhbXBsZXMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlUHJlc2VudGF0aW9uIl0
sImhvbGRlciI6InVybjppZXRmOnBhcmFtczpvYXV0aDpqd2stdGh1bWJwcmludDpzaGEtMjU2Ok
56YkxzWGg4dURDY2QtNk1Od1hGNFdfN25vV1hGWkFmSGt4WnNSR0M5WHMifQ.0sGLyF4UCpE-M-
AgMAn8d6IPIwoVj-UggxWkpGptWB7pJ_112UTHMsJzFf6B1Lsq0EjSwU71WBo5CeXlJYA68U_jf
Y55poa9IrQaX5tFxQV-DqkNz5VKsa9XGmM34Gnd


graph LR

19("VerifiablePresentation")
20("holder")
21("urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs")

19 --- 20
20 --- 21

Example 5: A secured verifiable presentation with a holder graph node

Claimset
Verifiable Credential
Graph

{
  "@context": ["https://www.w3.org/ns/credentials/v2"],
  "type": ["VerifiablePresentation"],
  "holder": {
    "id": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs",
    "type": "Organization",
    "name": "Contoso"
  }
}

---------------- Decoded Protected Header ----------------
{
  "alg": "ES384",
  "typ": "vp+ld+jwt",
  "iss": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF
4W_7noWXFZAfHkxZsRGC9Xs",
  "iat": 1688155486,
  "nonce": "n-0S6_WzA2Mj",
  "aud": "https://contoso.example"
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2"
  ],
  "type": [
    "VerifiablePresentation"
  ],
  "holder": {
    "id": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwX
F4W_7noWXFZAfHkxZsRGC9Xs",
    "type": "Organization",
    "name": "Contoso"
  }
}
---------------- Compact Encoded JSON Web Token ----------------
eyJhbGciOiJFUzM4NCIsInR5cCI6InZwK2xkK2p3dCIsImlzcyI6InVybjppZXRmOnBhcmFtczp
vYXV0aDpqd2stdGh1bWJwcmludDpzaGEtMjU2Ok56YkxzWGg4dURDY2QtNk1Od1hGNFdfN25vV1
hGWkFmSGt4WnNSR0M5WHMiLCJpYXQiOjE2ODgxNTU0ODYsIm5vbmNlIjoibi0wUzZfV3pBMk1qI
iwiYXVkIjoiaHR0cHM6Ly9jb250b3NvLmV4YW1wbGUifQ.eyJAY29udGV4dCI6WyJodHRwczovL
3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlUHJlc2Vu
dGF0aW9uIl0sImhvbGRlciI6eyJpZCI6InVybjppZXRmOnBhcmFtczpvYXV0aDpqd2stdGh1bWJ
wcmludDpzaGEtMjU2Ok56YkxzWGg4dURDY2QtNk1Od1hGNFdfN25vV1hGWkFmSGt4WnNSR0M5WH
MiLCJ0eXBlIjoiT3JnYW5pemF0aW9uIiwibmFtZSI6IkNvbnRvc28ifX0.p3Y_R3pXW3Ljd9k8M
cKj5s-XZDD13DG0EZ081a2cAUUjrJ6i3mY42LkbTPgiKqvHClBmDbpUrHmRJKBfH8iYQkjsTlOy
9mjEmeuK_J3gneELiqprvJKvckGkx4HB04Ay


graph LR

22("VerifiablePresentation")
23("holder")
24{{"id"}}
25("urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs")
26(("type"))
27("Organization")
28("name")
29("Contoso")

22 --- 23
23 --- 24
24 --- 25
23 --- 26
26 --- 27
23 --- 28
28 --- 29

COSE [rfc8152] is a common approach to encoding and securing information using CBOR [rfc8949]. Verifiable credentials MAY be secured using COSE [rfc8152] and MUST be identified through use of content types as outlined in this section.

This section details how to secure data with the type application/vc+ld+json with COSE.

[rfc8152] MAY be used to secure this media type.

When using this approach, the type (TBD) MUST be vc+ld+cwt

When using this approach, the content type (3) MUST be application/vc+ld+json

See Common COSE Header Parameters for additional details.

See Concise Binary Object Representation (CBOR) Tags for additional details.

Issue 67: typ for COSE

There is no registered tag for typ in COSE.

This prevents following the guidance from the JWT BCP

This section provides guidance on how to use JSON [RFC7159] claimsets with JWT registered claims to construct a JWT that can be mapped to a verifiable credential. This section also describes how to use content types and token types to distinguish different representations of verifiable credentials.

Note

This representation relies on claims registered in the IANA JSON Web Token Claims Registry whenever possible.

Note

Production of this representation does not use vc+ld+json as an input.

typ MUST use the media type vc+jwt.

Example 6: credential metadata (decoded JWT header)

{
  "kid": "https://example.edu/issuers/14#key-0",
  "alg": "ES256",
  "typ": "vc+jwt"
}

Example 7: A credential decoded from a JWT payload

{
  "iss": "https://example.edu/issuers/14",
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "urn:example:claim": true
}

Note

The vc and vp claims MUST NOT be present when the content type header parameter is set to credential-claims-set+json.

Example 8: An encoded verifiable credential that uses an external proof

eyJraWQiOiJodHRwczovL2V4YW1wbGUuZWR1L2lzc3VlcnMvMTQja2V5LTAiLCJhbGciOiJFUzI1NiIsInR5cCI6InZjK2p3dCJ9.eyJpc3MiOiJodHRwczovL2V4YW1wbGUuZWR1L2lzc3VlcnMvMTQiLCJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJ1cm46ZXhhbXBsZTpjbGFpbSI6dHJ1ZX0.WLD4Qxh629TFkJHzmbkWEefYX-QPkdCmxbBMKNHErxND2QpjVBbatxHkxS9Y_SzBmwffuM2E9i5VvVgpZ6v4Tg

As well as sections marked as non-normative, all authoring guidelines, diagrams, examples, and notes in this specification are non-normative. Everything else in this specification is normative.

The key words MAY, MUST, MUST NOT, and RECOMMENDED in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

The normative statements in Registered Header Parameter Names apply to securing credentials and presentations.

The normative statements in JOSE Header apply to securing credentials and presentations.

The data model for the protected header is JSON (application/json), not JSON-LD (application/ld+json).

The normative statements in Replicating Claims as Header Parameters apply to securing claims about a credential subject.

When replicating claims from the claimset to the header, it is RECOMMENDED to use [RFC7519], IANA Assignments for Header Parameters, and IANA Assignments for JSON Web Token (JWT) to identify any reserved claims that might be confused with members of the [[VC-DATA-MODEL]. This includes but is not limited to: iss, kid, alg, iat, exp and cnf.

The registered claim names vc and vp MUST NOT be present as header parameters.

When present, members of the header are to be interpreted and processed according to IANA Assignments for JSON Web Token (JWT) and IANA Assignments for JSON Object Signing and Encryption (JOSE).

Additional members may be present, if they are not understood, they MUST be ignored.

The [VC-DATA-MODEL] describes the approach taken by JSON Web Tokens to securing claimsets as applying an external proof.

The normative statements in Securing Verifiable Credentials apply to securing application/vc+ld+json and application/vp+ld+json as application/vc+ld+jwt and application/vp+ld+jwt.

For clarity, these requirements are repeated here:

At least one securing mechanism, and the details necessary to evaluate it, MUST be expressed for a credential or presentation to be a verifiable credential or verifiable presentation; that is, to be verifiable.
Methods of securing credentials or presentations that embed a proof in the data model MUST use the proof property.
Methods of securing credentials or presentations that use an external proof MAY use the proof property.
One or more cryptographic proofs that can be used to detect tampering and verify the authorship of a credential or presentation. The specific method used for an embedded proof MUST be included using the type property.

The type VerifiableCredential and VerifiablePresentation are RDF Classes.

The presence of the word "Verifiable" does not convey a cryptographic verification capability exists.

The presence of the JSON proof member does not convey a cryptographic verification capability exists.

The presence of the JSON proof member is optional in both VerifiableCredential and VerifiablePresentation.

The presence of the JSON proof member is optional in both application/vc+ld+json and application/vp+ld+json.

JSON Web Token implementers are advised to review Implementation Requirements.

Accordingly, Issuers, Holders and Verifiers MUST understand the JSON Web Token header parameter "alg": "none" when securing the [VC-DATA-MODEL] with JSON Web Tokens.

When content types from the [VC-DATA-MODEL] are secured using JSON Web Tokens, the header parameter "alg": "none", MUST be used to communicate that a claimset (a Verifiable Credential or a Verifiable Presentation) has no integrity protection.

When a JSON Web Token claimset (a Verifiable Credential or a Verifiable Presentation) contains proof, and the JSON Web Token header contains "alg": "none", the claimset MUST be considered to have no integrity protection.

Verifiable Credentials and Verifiable Presenatations are not required to be secured or integrity protected or to contain a proof member.

Issuers, Holders and Verifiers MUST ignore all claimsets that have no integrity protection.

This specification registers the application/vc+jwt Media Type specifically for identifying a JWT conforming to the Verifiable Credentials JWT format in the typ header.

Type name:	application
Subtype name:	application/vc+jwt
Required parameters:	None
Encoding considerations:	`application/vc+jwt` values are encoded as a series of base64url encoded values (some of which may be the empty string) each separated from the next by a single period ('.') character.
Security considerations:	As defined in this specification. See also the security considerations in [RFC7519].
Contact:	W3C Verifiable Credentials Working Group public-vc-wg@w3.org

This specification registers the application/vc+ld+jwt Media Type specifically for identifying a JWT conforming to the Verifiable Credentials JWT format in the typ header.

Type name:	application
Subtype name:	vc+ld+jwt
Required parameters:	None
Encoding considerations:	`application/vc+ld+jwt` values are encoded as a series of base64url encoded values (some of which may be the empty string) each separated from the next by a single period ('.') character.
Security considerations:	As defined in this specification. See also the security considerations in [RFC7519].
Contact:	W3C Verifiable Credentials Working Group public-vc-wg@w3.org

This specification registers the application/vp+ld+jwt Media Type specifically for identifying a JWT conforming to the Verifiable Credentials JWT format in the typ header.

Type name:	application
Subtype name:	vp+ld+jwt
Required parameters:	None
Encoding considerations:	`application/vp+ld+jwt` values are encoded as a series of base64url encoded values (some of which may be the empty string) each separated from the next by a single period ('.') character.
Security considerations:	As defined in this specification. See also the security considerations in [RFC7519].	Be advised, per the [VC-DATA-MODEL], verifiable presentations are not required to be secured. This "typ" value might be paired with "alg: none", in headers.
Contact:	W3C Verifiable Credentials Working Group public-vc-wg@w3.org

Verifiable Credentials often contain sensitive information that needs to be protected to ensure the privacy and security of organizations and individuals. This section outlines some privacy considerations relevant to implementers and users.

Implementers are advised to note and abide by all privacy considerations called out in the [VC-DATA-MODEL].

Implementers are additionally advised to reference the Privacy Consideration section of the JWT specification for privacy guidance.

In addition to the privacy recommendations in the [VC-DATA-MODEL], the following considerations are given:

Minimization of data: It is considered best practice for Verifiable Credentials to only contain the minimum amount of data necessary to achieve their intended purpose. This helps to limit the amount of sensitive information that is shared or stored unnecessarily.
Informed consent: It is considered best practice that individuals be fully informed about how their data will be used and provide the ability to consent to or decline the use of their data. This helps to ensure that individuals maintain control over their own personal information.
Data protection: It is considered best practice to protect Verifiable Credentials using strong encryption and other security measures to prevent unauthorized access, modification, or disclosure.

These considerations are not exhaustive, and implementers and users are advised to consult additional privacy resources and best practices to ensure the privacy and security of Verifiable Credentials implemented using VC-JWT.

This section outlines security considerations for implementers and users of this specification. It is important to carefully consider these factors to ensure the security and integrity of Verifiable Credentials when implemented using JWTs.

When implementing VC-JWTs, it is essential to address all security issues relevant to broad cryptographic applications. This especially includes protecting the user's asymmetric private and symmetric secret keys, as well as employing countermeasures against various attacks. Failure to adequately address these issues could compromise the security and integrity of Verifiable Credentials, potentially leading to unauthorized access, modification, or disclosure of sensitive information.

Implementers are advised to follow best practices and established cryptographic standards to ensure the secure handling of keys and other sensitive data. Additionally, conduct regular security assessments and audits to identify and address any vulnerabilities or threats.

Follow all security considerations outlined in [rfc7515] and [rfc7519].

When utilizing JSON-LD, take special care around remote retrieval of contexts and follow the additional security considerations noted in [json-ld11].

As noted in [rfc7515] when utilizing JSON [rfc7159], strict validation is a security requirement. If malformed JSON is received, it may be impossible to reliably interpret the producer's intent, potentially leading to ambiguous or exploitable situations. To prevent these risks, it is essential to use a JSON parser that strictly validates the syntax of all input data. It is essential that any JSON inputs that do not conform to the JSON-text syntax defined in [rfc7159] be rejected in their entirety by JSON parsers. Failure to reject invalid input could compromise the security and integrity of Verifiable Credentials.

This section is non-normative.

When implementing the VC-JWT specification, it is crucial for technical implementers to consider various accessibility factors. Ignoring accessibility concerns renders the information unusable for a significant portion of the population. To ensure equal access for all individuals, regardless of their abilities, it is vital to adhere to accessibility guidelines and standards, such as the Web Content Accessibility Guidelines (WCAG 2.1) [WCAG21]. This becomes even more critical when establishing systems that involve cryptography, as they have historically posed challenges for assistive technologies.

Implementers are advised to note and abide by all accessibility considerations called out in the [VC-DATA-MODEL].

This section is non-normative.

Implementers should take into account several internationalization considerations when publishing data described in this specification. Disregarding internationalization hampers the production and consumption of data across diverse languages and societies, thereby restricting the applicability and significantly reducing the value of the specification as a standard.

Implementers are advised to note and abide by all internationalization considerations called out in the [VC-DATA-MODEL], see also i18n, URL Standard

Example 9: A verifiable credential controller document

{
  "@context": ["https://www.w3.org/ns/did/v1", {
    "@vocab": "https://vendor.example#"
  }],
  "id": "did:web:vendor.example",
  "alsoKnownAs": ["https://vendor.example",
    "did:jwk:eyJraWQiOiJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6andrLXRodW1icHJpbnQ6c2hhLTI1NjpGZk1iek9qTW1RNGVmVDZrdndUSUpqZWxUcWpsMHhqRUlXUTJxb2JzUk1NIiwia3R5IjoiT0tQIiwiY3J2IjoiRWQyNTUxOSIsImFsZyI6IkVkRFNBIiwieCI6IkFOUmpIX3p4Y0tCeHNqUlBVdHpSYnA3RlNWTEtKWFE5QVBYOU1QMWo3azQifQ"
  ],
  "verificationMethod": [{
    "id": "#urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs",
    "type": "JsonWebKey",
    "controller": "did:web:vendor.example",
    "publicKeyJwk": {
      "kty": "EC",
      "crv": "P-521",
      "alg": "ES512",
      "x": "AFTyMw-fIYJNg6fBVJvOPOsLxmnNj8HgqMChyRL0swLaefVAc7wrWZ8okQJqMmvv03JRUp277meQZM3JcvXFkH1v",
      "y": "ALn96CrD88b4TClmkl1sk0xk2FgAIda97ZF8TUOjbeWSzbKnN2KB6pqlpbuJ2xIRXvsn5BWQVlAT2JGpGwDNMyV1"
    }
  }, {
    "id": "#z6MkhEdpG12jyQegrr62ACRmNY8gc531W2j9Xo39cHphuCEH",
    "type": "JsonWebKey2020",
    "controller": "https://vendor.example",
    "publicKeyJwk": {
      "kid": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:FfMbzOjMmQ4efT6kvwTIJjelTqjl0xjEIWQ2qobsRMM",
      "kty": "OKP",
      "crv": "Ed25519",
      "alg": "EdDSA",
      "x": "ANRjH_zxcKBxsjRPUtzRbp7FSVLKJXQ9APX9MP1j7k4"
    }
  }, {
    "id": "#subject-authenticaton",
    "type": "JsonWebKey",
    "controller": "did:web:vendor.example",
    "publicKeyJwk": {
      "kty": "EC",
      "crv": "P-384",
      "alg": "ES384",
      "x": "PxgAmVYOQvSNcMYL2tOzoLwSWn4Ta3tIMPEUKR8pxeb-gmR11-DyKHBoIiY-2LhM",
      "y": "BZEBTkImVdpwvxR9THIRw16eblnj5-tZa7m-ww5uVd4kyPJNRoWUn2aT9ZuarAe-"
    }
  }, {
    "id": "#credential-issuance",
    "type": "JsonWebKey",
    "controller": "did:web:vendor.example",
    "publicKeyJwk": {
      "kty": "EC",
      "crv": "P-256",
      "alg": "ES256",
      "x": "MYvnaI87pfrn3FpTqW-yNiFcF1K7fedJiqapm20_q7c",
      "y": "9YEbT6Tyuc7xp9yRvhOUVKK_NIHkn5HpK9ZMgvK5pVw"
    }
  }, {
    "id": "#key-agreement",
    "type": "JsonWebKey",
    "controller": "did:web:vendor.example",
    "publicKeyJwk": {
      "kty": "OKP",
      "crv": "X25519",
      "alg": "ECDH-ES+A128KW",
      "x": "qLZkSTbstvMWPTivmiQglEFWG2Ff7gNDVoVisdZTr1I"
    }
  }],
  "authentication": ["#subject-authenticaton"],
  "assertionMethod": ["#credential-issuance"],
  "keyAgreement": ["#key-agreement"]
}

Example 10: A revocable credential withmultiple subjects

Claimset
Verifiable Credential
Graph

{
  "@context": ["https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "id": "https://contoso.example/credentials/23894672394",
  "type": ["VerifiableCredential", "K9UnitCredential"],
  "issuer": {
    "id": "https://contoso.example"
  },
  "validFrom": "2015-04-16T05:11:32.432Z",
  "credentialStatus": {
    "id": "https://contoso.example/credentials/status/4#273762",
    "type": "StatusList2021Entry",
    "statusPurpose": "revocation",
    "statusListIndex": "273762",
    "statusListCredential": "https://contoso.example/credentials/status/4"
  },
  "credentialSubject": [{
    "id": "did:example:1312387641",
    "type": "Person"
  }, {
    "id": "did:example:63888231",
    "type": "Dog"
  }]
}

---------------- Decoded Protected Header ----------------
{
  "alg": "ES384",
  "typ": "vc+ld+jwt",
  "iss": "https://contoso.example",
  "iat": 1688155486
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "id": "https://contoso.example/credentials/23894672394",
  "type": [
    "VerifiableCredential",
    "K9UnitCredential"
  ],
  "issuer": {
    "id": "https://contoso.example"
  },
  "validFrom": "2015-04-16T05:11:32.432Z",
  "credentialStatus": {
    "id": "https://contoso.example/credentials/status/4#273762",
    "type": "StatusList2021Entry",
    "statusPurpose": "revocation",
    "statusListIndex": "273762",
    "statusListCredential": "https://contoso.example/credentials/status/4"
  },
  "credentialSubject": [
    {
      "id": "did:example:1312387641",
      "type": "Person"
    },
    {
      "id": "did:example:63888231",
      "type": "Dog"
    }
  ]
}
---------------- Compact Encoded JSON Web Token ----------------
eyJhbGciOiJFUzM4NCIsInR5cCI6InZjK2xkK2p3dCIsImlzcyI6Imh0dHBzOi8vY29udG9zby5
leGFtcGxlIiwiaWF0IjoxNjg4MTU1NDg2fQ.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5
vcmcvbnMvY3JlZGVudGlhbHMvdjIiLCJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbH
MvZXhhbXBsZXMvdjIiXSwiaWQiOiJodHRwczovL2NvbnRvc28uZXhhbXBsZS9jcmVkZW50aWFsc
y8yMzg5NDY3MjM5NCIsInR5cGUiOlsiVmVyaWZpYWJsZUNyZWRlbnRpYWwiLCJLOVVuaXRDcmVk
ZW50aWFsIl0sImlzc3VlciI6eyJpZCI6Imh0dHBzOi8vY29udG9zby5leGFtcGxlIn0sInZhbGl
kRnJvbSI6IjIwMTUtMDQtMTZUMDU6MTE6MzIuNDMyWiIsImNyZWRlbnRpYWxTdGF0dXMiOnsiaW
QiOiJodHRwczovL2NvbnRvc28uZXhhbXBsZS9jcmVkZW50aWFscy9zdGF0dXMvNCMyNzM3NjIiL
CJ0eXBlIjoiU3RhdHVzTGlzdDIwMjFFbnRyeSIsInN0YXR1c1B1cnBvc2UiOiJyZXZvY2F0aW9u
Iiwic3RhdHVzTGlzdEluZGV4IjoiMjczNzYyIiwic3RhdHVzTGlzdENyZWRlbnRpYWwiOiJodHR
wczovL2NvbnRvc28uZXhhbXBsZS9jcmVkZW50aWFscy9zdGF0dXMvNCJ9LCJjcmVkZW50aWFsU3
ViamVjdCI6W3siaWQiOiJkaWQ6ZXhhbXBsZToxMzEyMzg3NjQxIiwidHlwZSI6IlBlcnNvbiJ9L
HsiaWQiOiJkaWQ6ZXhhbXBsZTo2Mzg4ODIzMSIsInR5cGUiOiJEb2cifV19.PNWGlHEOERUhurj
X3CHW2Snw9SQY-ug87x8a0SVR8FUHBaukVWyoonaIIX2N-w5sMTWkKn5HR4mjS4ufQj4zxHj7fN
u7t5gDj__fDM6lZOpR8HykEbS_ITjd_p7yG8KA


graph LR

30("VerifiableCredential")
31{{"id"}}
32("https://contoso.example/credentials/23894672394")
33(("type"))
34("K9UnitCredential")
35("issuer")
36{{"id"}}
37("https://contoso.example")
38("validFrom")
39("2015-04-16T05:11:32.432Z")
40("credentialStatus")
41{{"id"}}
42("https://contoso.example/credentials/status/4#273762")
43(("type"))
44("StatusList2021Entry")
45("statusPurpose")
46("revocation")
47("statusListIndex")
48("273762")
49("statusListCredential")
50("https://contoso.example/credentials/status/4")
51("credentialSubject")
52{{"id"}}
53("did:example:1312387641")
54(("type"))
55("Person")
56("credentialSubject")
57{{"id"}}
58("did:example:63888231")
59(("type"))
60("Dog")

30 --- 31
31 --- 32
30 --- 33
33 --- 34
30 --- 35
35 --- 36
36 --- 37
30 --- 38
38 --- 39
30 --- 40
40 --- 41
41 --- 42
40 --- 43
43 --- 44
40 --- 45
45 --- 46
40 --- 47
47 --- 48
40 --- 49
49 --- 50
30 --- 51
51 --- 52
52 --- 53
51 --- 54
54 --- 55
30 --- 56
56 --- 57
57 --- 58
56 --- 59
59 --- 60

Example 11: A credential with a schema

Claimset
Verifiable Credential
Graph

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "id": "https://contoso.example/credentials/35327255",
  "type": ["VerifiableCredential", "KYCExample"],
  "issuer": "did:web:contoso.example",
  "validFrom": "2019-05-25T03:10:16.992Z",
  "validUntil": "2027-05-25T03:10:16.992Z",
  "credentialSchema": {
    "id": "https://contoso.example/bafybeigdyr...lqabf3oclgtqy55fbzdi",
    "type": "JsonSchema"
  },
  "credentialSubject": {
    "id": "did:example:1231588",
    "type": "Person"
  }
}

---------------- Decoded Protected Header ----------------
{
  "alg": "ES384",
  "typ": "vc+ld+jwt",
  "iss": "did:web:contoso.example",
  "iat": 1688155486
}
---------------- Decoded Protected Claimset ----------------
{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "id": "https://contoso.example/credentials/35327255",
  "type": [
    "VerifiableCredential",
    "KYCExample"
  ],
  "issuer": "did:web:contoso.example",
  "validFrom": "2019-05-25T03:10:16.992Z",
  "validUntil": "2027-05-25T03:10:16.992Z",
  "credentialSchema": {
    "id": "https://contoso.example/bafybeigdyr...lqabf3oclgtqy55fbzdi",
    "type": "JsonSchema"
  },
  "credentialSubject": {
    "id": "did:example:1231588",
    "type": "Person"
  }
}
---------------- Compact Encoded JSON Web Token ----------------
eyJhbGciOiJFUzM4NCIsInR5cCI6InZjK2xkK2p3dCIsImlzcyI6ImRpZDp3ZWI6Y29udG9zby5
leGFtcGxlIiwiaWF0IjoxNjg4MTU1NDg2fQ.eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5
vcmcvbnMvY3JlZGVudGlhbHMvdjIiLCJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbH
MvZXhhbXBsZXMvdjIiXSwiaWQiOiJodHRwczovL2NvbnRvc28uZXhhbXBsZS9jcmVkZW50aWFsc
y8zNTMyNzI1NSIsInR5cGUiOlsiVmVyaWZpYWJsZUNyZWRlbnRpYWwiLCJLWUNFeGFtcGxlIl0s
Imlzc3VlciI6ImRpZDp3ZWI6Y29udG9zby5leGFtcGxlIiwidmFsaWRGcm9tIjoiMjAxOS0wNS0
yNVQwMzoxMDoxNi45OTJaIiwidmFsaWRVbnRpbCI6IjIwMjctMDUtMjVUMDM6MTA6MTYuOTkyWi
IsImNyZWRlbnRpYWxTY2hlbWEiOnsiaWQiOiJodHRwczovL2NvbnRvc28uZXhhbXBsZS9iYWZ5Y
mVpZ2R5ci4uLmxxYWJmM29jbGd0cXk1NWZiemRpIiwidHlwZSI6Ikpzb25TY2hlbWEifSwiY3Jl
ZGVudGlhbFN1YmplY3QiOnsiaWQiOiJkaWQ6ZXhhbXBsZToxMjMxNTg4IiwidHlwZSI6IlBlcnN
vbiJ9fQ.Mc6KqMurMIl2XfqY9_4abKvBJszOHEz4wQhHckwbVnkcb2cI1OH7JCu-YL9PK9-5_CA
4egZZoM6yOr7FyOtOCHQFFaK-GNmtCAz-ydJGd6827u28B4pAbyk6ceJjmVWL


graph LR

61("VerifiableCredential")
62{{"id"}}
63("https://contoso.example/credentials/35327255")
64(("type"))
65("KYCExample")
66("issuer")
67("did:web:contoso.example")
68("validFrom")
69("2019-05-25T03:10:16.992Z")
70("validUntil")
71("2027-05-25T03:10:16.992Z")
72("credentialSchema")
73{{"id"}}
74("https://contoso.example/bafybeigdyr...lqabf3oclgtqy55fbzdi")
75(("type"))
76("JsonSchema")
77("credentialSubject")
78{{"id"}}
79("did:example:1231588")
80(("type"))
81("Person")

61 --- 62
62 --- 63
61 --- 64
64 --- 65
61 --- 66
66 --- 67
61 --- 68
68 --- 69
61 --- 70
70 --- 71
61 --- 72
72 --- 73
73 --- 74
72 --- 75
75 --- 76
61 --- 77
77 --- 78
78 --- 79
77 --- 80
80 --- 81

Example 12: Credential

{
  "@context": ["https://www.w3.org/ns/credentials/v2"],
  "type": ["VerifiablePresentation"],
  "holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI",
  "verifiableCredential": [{
      "@context": [
        "https://www.w3.org/ns/credentials/v2"
      ],
      "type": [
        "VerifiableCredential"
      ],
      "issuer": "https://issuer.example/issuers/68",
      "validFrom": "2023-06-07T21:14:14.148Z",
      "credentialSubject": {
        "id": "https://subject.vendor.example"
      }
    },
    "https://vendor.example/credentials/42", "did:example:123",
    "urn:uuid:01ec9426-c175-4e39-a006-d30050e28214",
    "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI",
    "data:application/vc+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0=",
    "data:application/vc+ld+jwt;base64,ZXlKaGJHY2lPaUpGWkVSVFFTSXNJbWx6Y3lJNkltUnBaRHBxZDJzNlpYbEtjbUZYVVdsUGFVb3hZMjAwTm1GWFZqQmFhbkIzV1ZoS2FHSllUVFppTWtZeFpFZG5ObUZ1WkhKTVdGSnZaRmN4YVdOSVNuQmlibEUyWXpKb2FFeFVTVEZPYW5CMlVXMVNiV1J0V2tSUFdHZzJUVVk1UWxWWVdsSk9NMWt4VFZoc1JGZHNPWHBsUjNBMVRucFdRMVJJU2tsbGF6RlBVbXByZVU5WFZUUkphWGRwWVROU05VbHFiMmxVTUhSUlNXbDNhVmt6U2pKSmFtOXBVbGRSZVU1VVZYaFBVMGx6U1cxR2MxcDVTVFpKYTFaclVrWk9Ra2xwZDJsbFEwazJTV3BPYVdOdFRuTmlNRWswWVVSU1RsZHNWa2xpYXpsUlZVZHNhMU50ZDNSVGFtUjFWV3hHU2xkSVVsUmhSbkF6V2pJMWJXTnNjREZVTWpocFpsRWlMQ0pyYVdRaU9pSWpNQ0lzSW5SNWNDSTZJblpqSzJ4a0sycDNkQ0lzSW1saGRDSTZNVFk0TmpJMU1UVTNOSDAuZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSmthV1E2YW5kck9tVjVTbkpoVjFGcFQybEtNV050TkRaaFYxWXdXbXB3ZDFsWVNtaGlXRTAyWWpKR01XUkhaelpoYm1SeVRGaFNiMlJYTVdsalNFcHdZbTVSTm1NeWFHaE1WRWt4VG1wd2RsRnRVbTFrYlZwRVQxaG9OazFHT1VKVldGcFNUak5aTVUxWWJFUlhiRGw2WlVkd05VNTZWa05VU0VwSlpXc3hUMUpxYTNsUFYxVTBTV2wzYVdFelVqVkphbTlwVkRCMFVVbHBkMmxaTTBveVNXcHZhVkpYVVhsT1ZGVjRUMU5KYzBsdFJuTmFlVWsyU1d0V2ExSkdUa0pKYVhkcFpVTkpOa2xxVG1samJVNXpZakJKTkdGRVVrNVhiRlpKWW1zNVVWVkhiR3RUYlhkMFUycGtkVlZzUmtwWFNGSlVZVVp3TTFveU5XMWpiSEF4VkRJNGFXWlJJaXdpZG1Gc2FXUkdjbTl0SWpvaU1qQXlNeTB3Tmkwd04xUXlNVG94TkRveE5DNHhORGhhSWl3aVkzSmxaR1Z1ZEdsaGJGTjFZbXBsWTNRaU9uc2lhV1FpT2lKb2RIUndjem92TDNOMVltcGxZM1F1ZG1WdVpHOXlMbVY0WVcxd2JHVWlmWDAubmczZlpDQXJyNUYwb1hOS1J1UlFNUXYtdnh4YlozUWJKVkJpcU1QUlVnSEFiSDVkMXptYjhLeUNkNnlVS3IxbmlsZmZiZ2pGUmRpRjFsWUdNRGNhQ0E="
  ]
}

Example 13: JSON-LD Credential

data:application/vc+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0=

Example 14: JWT Credential

data:application/vc+ld+jwt;base64,ZXlKaGJHY2lPaUpGWkVSVFFTSXNJbWx6Y3lJNkltUnBaRHBxZDJzNlpYbEtjbUZYVVdsUGFVb3hZMjAwTm1GWFZqQmFhbkIzV1ZoS2FHSllUVFppTWtZeFpFZG5ObUZ1WkhKTVdGSnZaRmN4YVdOSVNuQmlibEUyWXpKb2FFeFVTVEZPYW5CMlVXMVNiV1J0V2tSUFdHZzJUVVk1UWxWWVdsSk9NMWt4VFZoc1JGZHNPWHBsUjNBMVRucFdRMVJJU2tsbGF6RlBVbXByZVU5WFZUUkphWGRwWVROU05VbHFiMmxVTUhSUlNXbDNhVmt6U2pKSmFtOXBVbGRSZVU1VVZYaFBVMGx6U1cxR2MxcDVTVFpKYTFaclVrWk9Ra2xwZDJsbFEwazJTV3BPYVdOdFRuTmlNRWswWVVSU1RsZHNWa2xpYXpsUlZVZHNhMU50ZDNSVGFtUjFWV3hHU2xkSVVsUmhSbkF6V2pJMWJXTnNjREZVTWpocFpsRWlMQ0pyYVdRaU9pSWpNQ0lzSW5SNWNDSTZJblpqSzJ4a0sycDNkQ0lzSW1saGRDSTZNVFk0TmpJMU1UVTNOSDAuZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSmthV1E2YW5kck9tVjVTbkpoVjFGcFQybEtNV050TkRaaFYxWXdXbXB3ZDFsWVNtaGlXRTAyWWpKR01XUkhaelpoYm1SeVRGaFNiMlJYTVdsalNFcHdZbTVSTm1NeWFHaE1WRWt4VG1wd2RsRnRVbTFrYlZwRVQxaG9OazFHT1VKVldGcFNUak5aTVUxWWJFUlhiRGw2WlVkd05VNTZWa05VU0VwSlpXc3hUMUpxYTNsUFYxVTBTV2wzYVdFelVqVkphbTlwVkRCMFVVbHBkMmxaTTBveVNXcHZhVkpYVVhsT1ZGVjRUMU5KYzBsdFJuTmFlVWsyU1d0V2ExSkdUa0pKYVhkcFpVTkpOa2xxVG1samJVNXpZakJKTkdGRVVrNVhiRlpKWW1zNVVWVkhiR3RUYlhkMFUycGtkVlZzUmtwWFNGSlVZVVp3TTFveU5XMWpiSEF4VkRJNGFXWlJJaXdpZG1Gc2FXUkdjbTl0SWpvaU1qQXlNeTB3Tmkwd04xUXlNVG94TkRveE5DNHhORGhhSWl3aVkzSmxaR1Z1ZEdsaGJGTjFZbXBsWTNRaU9uc2lhV1FpT2lKb2RIUndjem92TDNOMVltcGxZM1F1ZG1WdVpHOXlMbVY0WVcxd2JHVWlmWDAubmczZlpDQXJyNUYwb1hOS1J1UlFNUXYtdnh4YlozUWJKVkJpcU1QUlVnSEFiSDVkMXptYjhLeUNkNnlVS3IxbmlsZmZiZ2pGUmRpRjFsWUdNRGNhQ0E=

Example 15: JSON-LD Verifiable Presentation

data:application/vp+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOiJkaWQ6andrOmV5SnJhV1FpT2lKMWNtNDZhV1YwWmpwd1lYSmhiWE02YjJGMWRHZzZhbmRyTFhSb2RXMWljSEpwYm5RNmMyaGhMVEkxTmpwdlFtUm1kbVpET1hoNk1GOUJVWFpSTjNZMU1YbERXbDl6ZUdwNU56VkNUSEpJZWsxT1Jqa3lPV1U0SWl3aWEzUjVJam9pVDB0UUlpd2lZM0oySWpvaVJXUXlOVFV4T1NJc0ltRnNaeUk2SWtWa1JGTkJJaXdpZUNJNklqTmljbU5zYjBJNGFEUk5XbFZJYms5UVVHbGtTbXd0U2pkdVVsRkpXSFJUYUZwM1oyNW1jbHAxVDI4aWZRIiwidmFsaWRGcm9tIjoiMjAyMy0wNi0wN1QyMToxNDoxNC4xNDhaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJodHRwczovL3N1YmplY3QudmVuZG9yLmV4YW1wbGUifX0=

Example 16: JWT Presentation

data:application/vp+ld+jwt;base64,ZXlKaGJHY2lPaUpGWkVSVFFTSXNJbWx6Y3lJNkltUnBaRHBxZDJzNlpYbEtjbUZYVVdsUGFVb3hZMjAwTm1GWFZqQmFhbkIzV1ZoS2FHSllUVFppTWtZeFpFZG5ObUZ1WkhKTVdGSnZaRmN4YVdOSVNuQmlibEUyWXpKb2FFeFVTVEZPYW5CMlVXMVNiV1J0V2tSUFdHZzJUVVk1UWxWWVdsSk9NMWt4VFZoc1JGZHNPWHBsUjNBMVRucFdRMVJJU2tsbGF6RlBVbXByZVU5WFZUUkphWGRwWVROU05VbHFiMmxVTUhSUlNXbDNhVmt6U2pKSmFtOXBVbGRSZVU1VVZYaFBVMGx6U1cxR2MxcDVTVFpKYTFaclVrWk9Ra2xwZDJsbFEwazJTV3BPYVdOdFRuTmlNRWswWVVSU1RsZHNWa2xpYXpsUlZVZHNhMU50ZDNSVGFtUjFWV3hHU2xkSVVsUmhSbkF6V2pJMWJXTnNjREZVTWpocFpsRWlMQ0pyYVdRaU9pSWpNQ0lzSW5SNWNDSTZJblpqSzJ4a0sycDNkQ0lzSW1saGRDSTZNVFk0TmpJMU1UVTNOSDAuZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSmthV1E2YW5kck9tVjVTbkpoVjFGcFQybEtNV050TkRaaFYxWXdXbXB3ZDFsWVNtaGlXRTAyWWpKR01XUkhaelpoYm1SeVRGaFNiMlJYTVdsalNFcHdZbTVSTm1NeWFHaE1WRWt4VG1wd2RsRnRVbTFrYlZwRVQxaG9OazFHT1VKVldGcFNUak5aTVUxWWJFUlhiRGw2WlVkd05VNTZWa05VU0VwSlpXc3hUMUpxYTNsUFYxVTBTV2wzYVdFelVqVkphbTlwVkRCMFVVbHBkMmxaTTBveVNXcHZhVkpYVVhsT1ZGVjRUMU5KYzBsdFJuTmFlVWsyU1d0V2ExSkdUa0pKYVhkcFpVTkpOa2xxVG1samJVNXpZakJKTkdGRVVrNVhiRlpKWW1zNVVWVkhiR3RUYlhkMFUycGtkVlZzUmtwWFNGSlVZVVp3TTFveU5XMWpiSEF4VkRJNGFXWlJJaXdpZG1Gc2FXUkdjbTl0SWpvaU1qQXlNeTB3Tmkwd04xUXlNVG94TkRveE5DNHhORGhhSWl3aVkzSmxaR1Z1ZEdsaGJGTjFZbXBsWTNRaU9uc2lhV1FpT2lKb2RIUndjem92TDNOMVltcGxZM1F1ZG1WdVpHOXlMbVY0WVcxd2JHVWlmWDAubmczZlpDQXJyNUYwb1hOS1J1UlFNUXYtdnh4YlozUWJKVkJpcU1QUlVnSEFiSDVkMXptYjhLeUNkNnlVS3IxbmlsZmZiZ2pGUmRpRjFsWUdNRGNhQ0E=

Example 17: Nested Unsecured JSON-LD Verifiable Presentation

data:application/vp+ld+json;base64,eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvbnMvY3JlZGVudGlhbHMvdjIiXSwidHlwZSI6WyJWZXJpZmlhYmxlUHJlc2VudGF0aW9uIl0sInZlcmlmaWFibGVDcmVkZW50aWFsIjpbImRhdGE6YXBwbGljYXRpb24vdmMrbGQranNvbjtiYXNlNjQsZXlKQVkyOXVkR1Y0ZENJNld5Sm9kSFJ3Y3pvdkwzZDNkeTUzTXk1dmNtY3Zibk12WTNKbFpHVnVkR2xoYkhNdmRqSWlYU3dpZEhsd1pTSTZXeUpXWlhKcFptbGhZbXhsUTNKbFpHVnVkR2xoYkNKZExDSnBjM04xWlhJaU9pSm9kSFJ3Y3pvdkwybHpjM1ZsY2k1MlpXNWtiM0l1WlhoaGJYQnNaU0lzSW5aaGJHbGtSbkp2YlNJNklqSXdNak10TURZdE1EZFVNakU2TVRRNk1UUXVNVFE0V2lJc0ltTnlaV1JsYm5ScFlXeFRkV0pxWldOMElqcDdJbWxrSWpvaWFIUjBjSE02THk5emRXSnFaV04wTG5abGJtUnZjaTVsZUdGdGNHeGxJbjE5Il19

Example 18: Nested Unsecured JWT

data:application/vp+ld+jwt;base64,ZXlKaGJHY2lPaUp1YjI1bElpd2lkSGx3SWpvaWRuQXJiR1FyYW5kMEluMC5leUpBWTI5dWRHVjRkQ0k2V3lKb2RIUndjem92TDNkM2R5NTNNeTV2Y21jdmJuTXZZM0psWkdWdWRHbGhiSE12ZGpJaVhTd2lkSGx3WlNJNld5SldaWEpwWm1saFlteGxVSEpsYzJWdWRHRjBhVzl1SWwwc0luWmxjbWxtYVdGaWJHVkRjbVZrWlc1MGFXRnNJanBiSW1SaGRHRTZZWEJ3YkdsallYUnBiMjR2ZG1NcmJHUXJhbmQwTzJKaGMyVTJOQ3hhV0d4TFlVZEtTRmt5YkZCaFZYQXhXV3BKTVdKRmJIQmtNbXhyVTBkNE0xTlhjSFpoVjFKMFZGaEthVkl4Um5sWlZ6VnJUVVZzZFUxRE5XeGxWWEJDVjFSSk5XUlhVa2hXYWxKclVUQnJNbFl6YkV0aU1sSkpWVzVrYW1WdE9USlVSRTVyVFRKU05VNVVUazVsVkZZeVdUSXhhbVJ0U25WVVdGcGFUVEJ3YzFkclpGZGtWMUpJWWtkb2FWTkZNVEphUjNCS1lWWm9WR1F5Ykd0VFIzZ3pWMnhPU2s1c1pEVlRiR1JoVjBWd2QxZHRNWE5oUm14MFpVZDRVazB3Y0hOWGEyUlhaRmRTU0dKSGFHbFJNSEJyVkVWT1MyTkhUWHBVYWtaaFYwVnNjRlF5YkV0aU1sSkpWVzVrYW1WdE9USlVSRXB6WlcxTmVsWnRlR3BoVkZWNVYyeGpNV0V5U1hwVFdGWmhWMGRvYjFsc2FFTmpNWEJVVTFoT1NtSnNjRzlaYTJSellURktkVk51V21sVk1Hc3lVMWR3U21Rd01YRlVXRkpPVWtac01GUlZVbXRXVlRGeFVsUmFUbFpHUlRKVVZsSlNaRlV4VlZWVVVsaGhWV3g2VTFjeFQyVldjRmhWYlhocFlteEtkMWRXWkRSV1IxSllVMjVHWVZZd05IZFRWM0IzVGpCc2RHSkhkRXBoYlRsd1dWVm9VMDFIVGtsVVZGcE5aVlJzTmxwR1pFdGpWbkJZVkdwQ1RXSnNjSE5aYlRGVFpHMU9jRTVYZUd4U01Gb3dXVEJrTkdKRmJIVk5WR3QxSWwxOS4=

Example 19: Verifiable Credential

{
  "@context": ["https://www.w3.org/ns/credentials/v2"],
  "type": [
    "VerifiableCredential"
  ],
  "issuer": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI",
  "validFrom": "2023-06-07T21:14:14.148Z",
  "credentialSubject": {
    "id": "https://subject.vendor.example"
  }
}

Example 20: Detached Verifiable Credential Proof

eyJhbGciOiJFUzM4NCIsInR5cCI6InZjK2xkK2p3dCIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19..Z-s5JgWQK91e1bzk-87ofJcRqGrw7wGehepSYH3U18u9-BNi9QOcgHWMFAN72HGNNhmn9xyT7UF59om7Wbb_IQTPAlzjMdPbzfq3bRffutP-Swg_Sz2R1VwpufVJ5Ult

Example 21: Verifiable Presentation

{
  "@context": ["https://www.w3.org/ns/credentials/v2"],
  "type": [
    "VerifiablePresentation"
  ],
  "holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:_Fpfe27AuGmEljZE9s2lw2UH-qrZLRFNrWbJrWIe4SI"
}

Example 22: Detached Presentation Proof

eyJhbGciOiJFUzM4NCIsInR5cCI6InZwK2xkK2p3dCIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19..TsKRjY56LWTPPXWKLYfDs-NKmZZHIcrZ2pndwEDtO5DaGiDW3OtABr-esL9y6CdZTxwshoqZCs_RnPRx17-uO8k_SBugAQwnzN8bnulkSN4gXaST0kxk23X4bVmw6sBD

Issue

TODO add COSE Sign1 detached payload examples

The following describes a mapping from application/vc+jwt to application/vc+ld+json. This is one possible unidirectional mapping between 2.0 VC-JWTs and the VC Data Model; other such mappings are possible.

Extract iss, sub, iat, nbf, exp, jti, and aud as registered claims.
Set aside all other claims as subject claims.
To construct the VCDM-compliant JSON:
- Set the value of @context to "https://www.w3.org/ns/credentials/v2".
- Set the value of type to ["VerifiableCredential"].
- Set the value of the issuer property to one of the following:
  - If the value of iss is a URL, use the value of iss.
  - If the value of iss is not a URL, use the concatenation of "urn:vc:" and the value of iss.
- If jti is present, set the value of id to the concatenation of "urn:vc:" and the value of jti.
- If nbf is present, set the value of validFrom to the dateTime obtained by converting the value of nbf from the NumericDate described in [RFC7519] to a dateTime as described in [XMLSCHEMA11-2].
- If exp is present, set the value of validUntil to the dateTime obtained by converting the value of exp from the NumericDate described in [RFC7519] to a dateTime as described in [XMLSCHEMA11-2].
- Set the value of credentialSubject to an object that contains the following properties:
  - If sub is present, set the value of the id property to the concatenation of "urn:vc:" and the value of sub.
  - Add all of the subject claims.

Example 23: application/vc+jwt mapped to application/vc+ld+json

A Verifiable Credential of type application/vc+jwt:

Example

{
  "iss": "https://example.edu/issuers/14",
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "urn:example:claim": true
}

The application/vc+ld+json after applying the mapping:

Example

{
  "@context": "https://www.w3.org/ns/credentials/v2",
  "type": ["VerifiableCredential"],
  "issuer": "https://example.edu/issuers/14",
  "credentialSubject": {
    "id": "urn:vc:1234567890",
    "name": "John Doe",
    "urn:example:claim": true
  }
}

[json-ld11]: JSON-LD 1.1. Gregg Kellogg; Pierre-Antoine Champin; Dave Longley. W3C. 16 July 2020. W3C Recommendation. URL: https://www.w3.org/TR/json-ld11/
[RFC2119]: Key words for use in RFCs to Indicate Requirement Levels. S. Bradner. IETF. March 1997. Best Current Practice. URL: https://www.rfc-editor.org/rfc/rfc2119
[RFC6838]: Media Type Specifications and Registration Procedures. N. Freed; J. Klensin; T. Hansen. IETF. January 2013. Best Current Practice. URL: https://www.rfc-editor.org/rfc/rfc6838
[RFC7159]: The JavaScript Object Notation (JSON) Data Interchange Format. T. Bray, Ed.. IETF. March 2014. Proposed Standard. URL: https://www.rfc-editor.org/rfc/rfc7159
[RFC7515]: JSON Web Signature (JWS). M. Jones; J. Bradley; N. Sakimura. IETF. May 2015. Proposed Standard. URL: https://www.rfc-editor.org/rfc/rfc7515
[RFC7519]: JSON Web Token (JWT). M. Jones; J. Bradley; N. Sakimura. IETF. May 2015. Proposed Standard. URL: https://www.rfc-editor.org/rfc/rfc7519
[RFC8152]: CBOR Object Signing and Encryption (COSE). J. Schaad. IETF. July 2017. Proposed Standard. URL: https://www.rfc-editor.org/rfc/rfc8152
[RFC8174]: Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words. B. Leiba. IETF. May 2017. Best Current Practice. URL: https://www.rfc-editor.org/rfc/rfc8174
[rfc8949]: Concise Binary Object Representation (CBOR). C. Bormann; P. Hoffman. IETF. December 2020. Internet Standard. URL: https://www.rfc-editor.org/rfc/rfc8949
[rfc9052]: CBOR Object Signing and Encryption (COSE): Structures and Process. J. Schaad. IETF. August 2022. Internet Standard. URL: https://www.rfc-editor.org/rfc/rfc9052
[VC-DATA-MODEL]: Verifiable Credentials Data Model v1.1. Manu Sporny; Grant Noble; Dave Longley; Daniel Burnett; Brent Zundel; Kyle Den Hartog. W3C. 3 March 2022. W3C Recommendation. URL: https://www.w3.org/TR/vc-data-model/
[XMLSCHEMA11-2]: W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes. David Peterson; Sandy Gao; Ashok Malhotra; Michael Sperberg-McQueen; Henry Thompson; Paul V. Biron et al. W3C. 5 April 2012. W3C Recommendation. URL: https://www.w3.org/TR/xmlschema11-2/

[RFC7516]: JSON Web Encryption (JWE). M. Jones; J. Hildebrand. IETF. May 2015. Proposed Standard. URL: https://www.rfc-editor.org/rfc/rfc7516
[WCAG21]: Web Content Accessibility Guidelines (WCAG) 2.1. Andrew Kirkpatrick; Joshue O'Connor; Alastair Campbell; Michael Cooper. W3C. 5 June 2018. W3C Recommendation. URL: https://www.w3.org/TR/WCAG21/

Securing Verifiable Credentials using JOSE and COSE

Abstract

Status of This Document

1. Introduction

2. Securing the VC Data Model

2.1 With JOSE

2.1.1 Securing JSON-LD Verifiable Credentials with JOSE

2.1.2 Securing JSON-LD Verifiable Presentations with JOSE

2.2 With COSE

2.2.1 Securing JSON-LD VCs with COSE

3. Securing JSON

3.1 Credential Header

3.2 Credential

3.3 Verifiable Credential

4. Conformance

4.1 JSON Web Token Header Parameters

4.2 Securing Verifiable Credentials

5. IANA Considerations

5.1 `application/vc+jwt`

5.2 `application/vc+ld+jwt`

5.3 `application/vp+ld+jwt`

6. Other Considerations

6.1 Privacy Considerations

6.2 Security Considerations

6.3 Accessibility

6.4 Internationalization

7. Appendix

7.1 Controllers

7.2 Credentials

7.3 Presentations

7.4 Data URIs

7.5 Detached Proofs

7.6 Example Mapping

A. References

A.1 Normative references

A.2 Informative references

Securing Verifiable Credentials using JOSE and COSE

Abstract

Status of This Document

1. Introduction

2. Securing the VC Data Model

2.1 With JOSE

2.1.1 Securing JSON-LD Verifiable Credentials with JOSE

2.1.2 Securing JSON-LD Verifiable Presentations with JOSE

2.2 With COSE

2.2.1 Securing JSON-LD VCs with COSE

3. Securing JSON

3.1 Credential Header

3.2 Credential

3.3 Verifiable Credential

4. Conformance

4.1 JSON Web Token Header Parameters

4.2 Securing Verifiable Credentials

5. IANA Considerations

5.1 application/vc+jwt

5.2 application/vc+ld+jwt

5.3 application/vp+ld+jwt

6. Other Considerations

6.1 Privacy Considerations

6.2 Security Considerations

6.3 Accessibility

6.4 Internationalization

7. Appendix

7.1 Controllers

7.2 Credentials

7.3 Presentations

7.4 Data URIs

7.5 Detached Proofs

7.6 Example Mapping

A. References

A.1 Normative references

A.2 Informative references

5.1 `application/vc+jwt`

5.2 `application/vc+ld+jwt`

5.3 `application/vp+ld+jwt`