Re: [OAUTH-WG] Request to add a profile parameter to +jwt and +sd-jwt

[Orie Steele <[e-mail]>]

If you are interested in how this `profile` parameter might be related to
other credential formats at W3C, for example anonymous credentials built on
top of data integrity proofs, see this issue:

https://github.com/w3c/vc-data-model/issues/1363

Regards,

OS

On Mon, Nov 27, 2023 at 9:00 AM Orie Steele <[e-mail]>
wrote:

> An afterthought... we could also punt on the impact of multiple suffixes
> by following the convention activity pub used:
>
> https://www.w3.org/TR/activitystreams-core/#media-type
>
> application/ld+json; profile="https://www.w3.org/ns/activitystreams"
>
> For W3C Verifiable Credentials that could be:
>
> application/ld+json; profile="https://www.w3.org/ns/credentials"
>
> Noting that W3C already supports https://www.w3.org/ns/credentials/v2
>
> Regards,
>
> OS
>
> On Mon, Nov 27, 2023 at 8:55 AM Orie Steele <[e-mail]>
> wrote:
>
>> Hello,
>>
>> There was a request to add media type parameters to application/sd-jwt
>> and +sd-jwt made here:
>>
>> https://github.com/w3c/vc-jose-cose/issues/184#issuecomment-1827973403
>>
>> TLDR; TallTed believes that the convention in the JWT BCP is not correct:
>>
>> https://datatracker.ietf.org/doc/html/rfc8725#name-use-explicit-typing
>>
>> So instead of seeing:
>>
>> application/secevent+jwt
>>
>> We should be seeing:
>>
>> application/jwt; profile=secevent
>>
>> This is a general form of the challenges associated with using multiple
>> structured suffixes with JWTs.
>>
>> See these related drafts:
>>
>> -
>> https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-06#name-structured-syntax-suffix-re
>> -
>> https://datatracker.ietf.org/doc/html/draft-ietf-mediaman-suffixes-06#section-2.3
>>
>> Note that the change controller for `application/vc+...` would be the W3C
>> per the latest draft language in draft-ietf-mediaman-suffixes-06.
>>
>> The W3C could then reject any attempts to register
>> `application/vc+ld+json+sd-jwt` or `application/vc+sd-jwt` or
>> `application/vc+jwp` in the future.
>>
>> If instead we used a meda type parameter to signal profiles... instead of
>> suffixes, the change controller rules from multiple suffixes would not
>> apply.
>>
>> Regards,
>>
>> OS
>>
>>
>> --
>>
>>
>> ORIE STEELE
>> Chief Technology Officer
>> www.transmute.industries
>>
>> <https://transmute.industries>
>>
>
>
> --
>
>
> ORIE STEELE
> Chief Technology Officer
> www.transmute.industries
>
> <https://transmute.industries>
>


-- 


ORIE STEELE
Chief Technology Officer
www.transmute.industries

<https://transmute.industries>