4 ms·

They used "JWTs" as a convience, Smart Health Cards have none of the issues here. Their issuance doesnt require a database either, thats just your healthcare pr

• adolph 4y ago
  JWT and SMART Health Cards are similar under the hood. The T part of JWT refers to a Token, which in JWT is a standardized set of claims. Instead of T, SMART Health Cards use S, or Serialization. Instead of a token, the JWS serializes FHIR demographic and necessary medical information about the card bearer. SHC has all the same invalidation and key issue/revoke challenges as JWT. When the issuer is ready to generate a Health Card, the issuer creates a FHIR payload and packs it into a corresponding Health Card VC (or Health Card Set). The VC structure (scaffold) is shown in the following example. The Health Cards framework serializes VCs using the compact JWS serialization, where the payload is a compressed set of JWT claims (see Appendix 3 of RFC7515 for an example using ECDSA P-256 SHA-256, as required by this specification). Specific encoding choices ensure compatibility with standard JWT claims, as described at https://www.w3.org/TR/vc-data-model/#jwt-encoding https://www.w3.org/TR/vc-data-model/#jwt-encoding. https://spec.smarthealth.cards/ https://spec.smarthealth.cards/