Re: [SPICE] Call for consensus on SPICE charter

[Kristina Yasuda <[e-mail]>]

Hi Orie,
Thank you. Guess my question was why can’t mdocs be used for the use-cases that SD-CWT is being designed for? And the answer seems to be “because one needs to purchase an ISO standard where mdoc is being defined”?

mdocs are not exactly CWTs, rather CBOR structure signed using COSE, but they already have a salt-hash based selective disclosure mechanism. mdocs also define issuer PKI to be x509 and holder key binding to be raw COSE key, which helps with interop but could be turned into an extensibility point.

Best,
Kristina


________________________________
From: Orie Steele <[e-mail]>
Sent: Friday, February 9, 2024 12:31:38 PM
To: Kristina Yasuda <[e-mail]>
Cc: [e-mail] <[e-mail]>
Subject: Re: [SPICE] Call for consensus on SPICE charter

Hey Kristina,

I'm not an mDoc expert so I expect you will be able to answer that question better than I can.

To save you the trouble of reading the "SD-CWT/SD-CWT-VC" draft (and there is an experimental implementation I developed based on OAuth's SD-JWT reference implementation".

"SD-CWT/SD-CWT-VC" basically just takes the OAuth SD-JWT approach and makes it work with CWT claimsets instead of JWT claimsets.

So where OAuth registers:

- https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-07#name-json-web-token-claims-regis

Spice would register similar properties in:

- https://www.iana.org/assignments/cwt/cwt.xhtml

You said: "Personally, I would like to see SD-CWT/SD-CWT-VC to be backwards compatible with mdocs, but that can be discussed once in the draft.

I don't know the content type of the ISO mDoc cose-sign1 payload, is it a CBOR map? Could it be a CWT claimset? If the answer to both of those is yes, I see a possibility to align, but there could be lots of other challenges.

Having not read the ISO spec in question, I can't answer more than that.

Thanks for your comment about the W3C VC Data Model v2, I filed an issue to track it here:

https://github.com/transmute-industries/ietf-spice-charter/issues/29

Feel free to pile on any additional changes you would like to see there.

OS



On Fri, Feb 9, 2024 at 2:22 PM Kristina Yasuda <Kristina.Yasuda=[e-mail]<mailto:[e-mail]>> wrote:
Hi,

What is the relationship between SD-CWT/SD-CWT-VC and mdocs defined in ISO/IEC 18013-5?
At least, mdocs should be mentioned in the charter.
Personally, I would like to see SD-CWT/SD-CWT-VC to be backwards compatible with mdocs, but that can be discussed once in the draft.

small nits in the charter text:
VCDM 2.0 has not yet been published, so the last paragraph in the Introduction should be rephrased.
Best,
Kristina
--
SPICE mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/spice


--


ORIE STEELE
Chief Technology Officer
www.transmute.industries

[https://ci3.googleusercontent.com/mail-sig/AIorK4xqtkj5psM1dDeDes_mjSsF3ylbEa5EMEQmnz3602cucAIhjLaHod-eVJq0E28BwrivrNSBMBc]<https://transmute.industries/>