Skip to content

Commit fed5f40

Browse files
authored
Fix [...]#integrity claim values in examples (Subresource Integrity uses regular base64 encoding and some were wrong length) (#318)
1 parent 0ec7c8e commit fed5f40

File tree

1 file changed

+12
-10
lines changed

1 file changed

+12
-10
lines changed

draft-ietf-oauth-sd-jwt-vc.md

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -527,7 +527,7 @@ with the value `https://betelgeuse.example.com/education_credential`:
527527
```json
528528
{
529529
"vct": "https://betelgeuse.example.com/education_credential",
530-
"vct#integrity": "sha256-WRL5ca_xGgX3c1VLmXfh-9cLlJNXN-TsMk-PmKjZ5t0",
530+
"vct#integrity": "sha256-WRL5ca/xGgX3c1VLmXfh+9cLlJNXN+TsMk+PmKjZ5t0=",
531531
...
532532
}
533533
```
@@ -544,17 +544,17 @@ retrieved from it:
544544
"name":"Betelgeuse Education Credential - Preliminary Version",
545545
"description":"This is our development version of the education credential. Don't panic.",
546546
"extends":"https://galaxy.example.com/galactic-education-credential-0.9",
547-
"extends#integrity":"sha256-9cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1VLmXfh-WRL5",
547+
"extends#integrity":"sha256-ilOUJsTultOwLfz7QUcFALaRa3BP/jelX1ds04kB9yU=",
548548
"schema_uri":"https://exampleuniversity.com/public/credential-schema-0.9",
549-
"schema_uri#integrity":"sha256-o984vn819a48ui1llkwPmKjZ5t0WRL5ca_xGgX3c1VLmXfh"
549+
"schema_uri#integrity":"sha256-He4fNeA4xvjLbh/e+rd9Hw3l60OS4tEliHE7NDYXRwA="
550550
}
551551
```
552552

553553
This example is shortened for presentation, a full Type Metadata example can be found in (#ExampleTypeMetadata).
554554

555555
Note: The hash of the Type Metadata document shown in the second example must be equal
556556
to the one in the `vct#integrity` claim in the SD-JWT VC payload,
557-
`WRL5ca_xGgX3c1VLmXfh-9cLlJNXN-TsMk-PmKjZ5t0`.
557+
`WRL5ca/xGgX3c1VLmXfh+9cLlJNXN+TsMk+PmKjZ5t0=`.
558558

559559
## Type Metadata Format {#type-metadata-format}
560560

@@ -1410,7 +1410,7 @@ After validation, the Verifier will have the following processed SD-JWT payload
14101410
"name": "Betelgeuse Education Credential - Preliminary Version",
14111411
"description": "This is our development version of the education credential. Don't panic.",
14121412
"extends": "https://galaxy.example.com/galactic-education-credential-0.9",
1413-
"extends#integrity": "sha256-9cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1VLmXfh-WRL5",
1413+
"extends#integrity": "sha256-ilOUJsTultOwLfz7QUcFALaRa3BP/jelX1ds04kB9yU=",
14141414
"display": [
14151415
{
14161416
"lang": "en-US",
@@ -1420,7 +1420,7 @@ After validation, the Verifier will have the following processed SD-JWT payload
14201420
"simple": {
14211421
"logo": {
14221422
"uri": "https://betelgeuse.example.com/public/education-logo.png",
1423-
"uri#integrity": "sha256-LmXfh-9cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1V",
1423+
"uri#integrity": "sha256-LmXfh+9cLlJNXN+TsMk+PmKjZ5t0WRL5ca/xGgX3c1U=",
14241424
"alt_text": "Betelgeuse Ministry of Education logo"
14251425
},
14261426
"background_color": "#12107c",
@@ -1429,7 +1429,7 @@ After validation, the Verifier will have the following processed SD-JWT payload
14291429
"svg_templates": [
14301430
{
14311431
"uri": "https://betelgeuse.example.com/public/credential-english.svg",
1432-
"uri#integrity": "sha256-8cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1VLmXfh-9c",
1432+
"uri#integrity": "sha256-I4JcBGO7UfrkOBrsV7ytNJAfGuKLQh+e+Z31mc7iAb4=",
14331433
"properties": {
14341434
"orientation": "landscape",
14351435
"color_scheme": "light",
@@ -1446,7 +1446,7 @@ After validation, the Verifier will have the following processed SD-JWT payload
14461446
"simple": {
14471447
"logo": {
14481448
"uri": "https://betelgeuse.example.com/public/education-logo-de.png",
1449-
"uri#integrity": "sha256-LmXfh-9cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1V",
1449+
"uri#integrity": "sha256-LmXfh+9cLlJNXN+TsMk+PmKjZ5t0WRL5ca/xGgX3c1U=",
14501450
"alt_text": "Logo des Betelgeusischen Bildungsministeriums"
14511451
},
14521452
"background_color": "#12107c",
@@ -1455,7 +1455,7 @@ After validation, the Verifier will have the following processed SD-JWT payload
14551455
"svg_templates": [
14561456
{
14571457
"uri": "https://betelgeuse.example.com/public/credential-german.svg",
1458-
"uri#integrity": "sha256-8cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1VLmXfh-9c",
1458+
"uri#integrity": "sha256-I4JcBGO7UfrkOBrsV7ytNJAfGuKLQh+e+Z31mc7iAb4=",
14591459
"properties": {
14601460
"orientation": "landscape",
14611461
"color_scheme": "light",
@@ -1532,7 +1532,7 @@ After validation, the Verifier will have the following processed SD-JWT payload
15321532
}
15331533
],
15341534
"schema_uri": "https://exampleuniversity.com/public/credential-schema-0.9",
1535-
"schema_uri#integrity": "sha256-o984vn819a48ui1llkwPmKjZ5t0WRL5ca_xGgX3c1VLmXfh"
1535+
"schema_uri#integrity": "sha256-He4fNeA4xvjLbh/e+rd9Hw3l60OS4tEliHE7NDYXRwA="
15361536
}
15371537
```
15381538

@@ -1551,6 +1551,7 @@ Michael B. Jones,
15511551
Mike Prorock,
15521552
Orie Steele,
15531553
Paul Bastian,
1554+
Pavel Zarecky,
15541555
Torsten Lodderstedt,
15551556
Tobias Looker, and
15561557
Kristina Yasuda
@@ -1561,6 +1562,7 @@ for their contributions (some of which substantial) to this draft and to the ini
15611562
-10
15621563

15631564
* Rename 'Issuer-signed JWT Verification Key Validation' to 'Issuer Signature Mechanisms' and rework some text accordingly. Provide a web-based metadata resolution mechanism and an inline x509 mechanism. A DID-based mechanism is not explicitly provided herein but still possible via profile/extension. Be explicit that the employed Issuer Signature Mechanism has to be one that is permitted for the Issuer according to policy. Be more clear that one permitted Issuer Signature Mechanism is sufficient.
1565+
* Fix `[...]#integrity` claim values in examples (Subresource Integrity uses regular base64 encoding and some were wrong length)
15641566

15651567
-09
15661568

0 commit comments

Comments
 (0)