3 ms·
It is a JWT, but a JWT is just a data format, not a schema. This VC thing seems to take ID Tokens from OIDC providers a little further and also standardizes wh
by Alupis 4y ago
It is a JWT, but a JWT is just a data format, not a schema.
This VC thing seems to take ID Tokens from OIDC providers a little further and also standardizes what claims you can expect.
- woodruffw 4y agoHmm, I don't know if it's consider JWT to be "just a data format". It's an envelope format (dotted base64'd JSON), combined with a schema for each component in the envelope. That scheme isn't particularly strict when it comes to the payload component, but that doesn't mean it isn't a schema. OIDC's well-known discovery[1] also does this kind of claim standardization/expectation setting already. But maybe it goes beyond that, and actually normalizes between different IdPs? I'm not sure what that would entail. [1]: https://swagger.io/docs/specification/authentication/openid-connect-discovery/ https://swagger.io/docs/specification/authentication/openid-...
- dwaite 4y agoJWT is a way to express claims. JWS is the underlying data format. JWTs are still profiled for their usage - the JWT you use under ACMEv2 is going to be different than the ID Tokens you get from OpenID Connect, or some bespoke cookie format by a product/site. A VC-JWT is a profile JWTs for use with Verifiable Credentials. Part of this is adding new claims to hold JSON-LD formatted credential / presentation data.