Skip to main content

OP VC Securing Mechanism

This document specifies the values of each claim and property of OP VC in accordance with Securing Verifiable Credentials using JOSE and COSE.

note

Currently, OP VC's securing mechanism is limited to Securing Verifiable Credentials using JOSE and COSE. Other methods may be adopted in the future.

Securing VC with JOSE​

  • typ The header parameter MUST be vc+jwt.
  • kid The header parameter MUST be a JWK Thumbprint.
  • cty The header parameter MUST be vc.

Payload​

Based on the following table, there is a one-to-one correspondence between data model properties and JWT claims, and specification developers MUST define the data model so that this is the case.

A JWT payload MAY contain both data model properties and JWT claims, but if it does, the values ​​of the data model properties and the JWT claims MUST NOT conflict.

note

In applications developed by the Originator Profile Collaborative Innovation Partnership (OP-CIP), both data model properties and JWT claims are included in the JWT payload and signed.

Data ModelJWT
issuer (String)iss
issuer.idiss
credentialSubject.idsub
（Date and time of signing）iat
（Signature expiration date）exp

Additional JWT claims​

iat, exp​

REQUIRED. Complies the JWT (RFC 7519) specification.

Examples​

Core Profile​

Header:

{
  "typ": "vc+jwt",
  "cty": "vc",
  "kid": "...",
  "alg": "ES256"
}

Payload:

{
  "iss": "dns:example.org",
  "sub": "dns:example.jp",
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://originator-profile.org/ns/credentials/v1"
  ],
  "type": ["VerifiableCredential", "CoreProfile"],
  "issuer": "dns:example.org",
  "credentialSubject": {
    "id": "dns:example.jp",
    "type": "Core",
    "jwks": {
      "keys": [
        {
          "x": "ypAlUjo5O5soUNHk3mlRyfw6ujxqjfD_HMQt7XH-rSg",
          "y": "1cmv9lmZvL0XAERNxvrT2kZkC4Uwu5i1Or1O-4ixJuE",
          "crv": "P-256",
          "kid": "jJYs5_ILgUc8180L-pBPxBpgA3QC7eZu9wKOkh9mYPU",
          "kty": "EC"
        }
      ]
    }
  },
  "iat": 1688623395,
  "exp": 1720245795
}
Content Attestation​

Header:

{
  "typ": "vc+jwt",
  "cty": "vc",
  "kid": "...",
  "alg": "ES256"
}

Payload

{
  "iss": "dns:example.com",
  "sub": "urn:uuid:78550fa7-f846-4e0f-ad5c-8d34461cb95b",
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://originator-profile.org/ns/credentials/v1",
    "https://originator-profile.org/ns/cip/v1",
    { "@language": "en" }
  ],
  "type": ["VerifiableCredential", "ContentAttestation"],
  "issuer": "dns:example.com",
  "credentialSubject": {
    "id": "urn:uuid:78550fa7-f846-4e0f-ad5c-8d34461cb95b",
    "type": "Article",
    "headline": "<Title of Web page>",
    "image": {
      "id": "https://media.example.com/image.png",
      "digestSRI": "sha256-2ntYAX8nslHxMv5h7Wdv5QDaWxHq6dIOVAdwB9VztrY="
    },
    "description": "<An explanation of Web page>",
    "author": ["Jane Smith"],
    "editor": ["John Smith"],
    "datePublished": "2023-07-04T19:14:00Z",
    "dateModified": "2023-07-04T19:14:00Z",
    "genre": "Arts & Entertainment"
  },
  "allowedUrl": ["https://media.example.com/articles/2024-06-30"],
  "target": [
    {
      "type": "VisibleTextTargetIntegrity",
      "cssSelector": "<CSS selector>",
      "integrity": "sha256-GYC9PqfIw0qWahU6OlReQfuurCI5VLJplslVdF7M95U="
    },
    {
      "type": "ExternalResourceTargetIntegrity",
      "integrity": "sha256-+M3dMZXeSIwAP8BsIAwxn5ofFWUtaoSoDfB+/J8uXMo="
    }
  ],
  "iat": 1688623395,
  "exp": 1720245795
}
Profile Annotation​

Header:

{
  "typ": "vc+jwt",
  "cty": "vc",
  "kid": "...",
  "alg": "ES256"
}

Payload:

{
  "iss": "dns:profile-annotation-issuer.example.org",
  "sub": "dns:pa-holder.example.jp",
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://originator-profile.org/ns/credentials/v1",
    "https://originator-profile.org/ns/cip/v1",
    { "@language": "en" }
  ],
  "type": ["VerifiableCredential", "ProfileAnnotation"],
  "issuer": "dns:profile-annotation-issuer.example.org",
  "credentialSubject": {
    "id": "dns:pa-holder.example.jp",
    "type": "JP-OrganizationExistenceCertificate",
    "addressCountry": "JP",
    "corporateName": "ABCD Newspaper (※Development Sample)",
    "corporateNumber": "0000000000000",
    "postalCode": "000-0000",
    "addressRegion": "Tokyo",
    "addressLocality": "Chiyoda",
    "streetAddress": "00-0",
    "annotation": {
      "id": "urn:uuid:def09cbd-6e8e-4c73-856d-5e00dffde643",
      "type": "ProfileAnnotationPolicy",
      "name": "Fictitious Organization Verification Authority Existence Certification",
      "description": "This organization has been verified to exist through corporate registration inquiry and other means.",
      "ref": "https://ovac.exp.originator-profile.org/"
    }
  },
  "iat": 1688623395,
  "exp": 1720245795
}

Cryptographic algorithms​

The cryptographic algorithm conforms to "cryptographic algorithm".

Validation Process​

VC validators can perform validation using a VC DM 2.0 compliant validation implementation.

note

In the future, we may define a ProblemDetails object that corresponds to each validation failure.

The validation process implemented in @originator-profile/securing-mechanism follows this process:

Please refer to the following reference for the structure of the data handled in the verification process.

  • Undecrypted VC
  • VcVerifyFailed
  • VcValidateFailed
  • OP VC DM verifier
  • Verified VC

Security​

This section is non-normative.

Please also refer to the security considerations outlined in Section 9 of the Verifiable Credentials Data Model 2.0.

Revocation​

Originator Profile does not employ a mechanism equivalent to a Certificate Revocation List (CRL). When verifying the VC's proof, the verifier checks only the signing key's validity in real time.

Consequently, OP VCs do not support a mechanism for extending the validity period. To maintain validity, re-issuance and re-installation must be performed repeatedly within the validity period.

Signing Key Protection​

For requirements regarding the protection of signing keys, please refer to Cryptographic Key Protection and Assurance Requirements.