3 ms·
As someone else pointed out, there is work in OpenID Connect to support this model. The difference is that traditional Connect is typically a two party model -
by dwaite 4y ago
As someone else pointed out, there is work in OpenID Connect to support this model.
The difference is that traditional Connect is typically a two party model - an OpenID Provider which gives claims which can be used for registration/authentication, and a Relying Party willing to accept them. This is an active dance back and forth, with the OpenID Provider deciding how to implement privacy, what records to keep on usage, prompting for user consent, etc.
Verifiable Credentials have Issuers and Verifiers which map reasonably well into these roles, but also an end user agent in the middle which acquires credentials, holds onto them and presents them with user consent.
While the verifier needs to still know who the issuer is to know if it should trust the data, the issuer no longer needs any relationship whatsoever with the verifier. The issuer does not see where credentials are being used, or (for credentials with selective disclosure) which information is being disclosed.
- jfroma 4y agoJust to add to your excellent description, one can draw an analogy between the id_token and a VC. But an id_token usually has an audience which is the RP, and a short expiration. A VC is issued for the user (aka holder), with long or no expiration to store in wallet. A VC is bound to the user’s did (think pk thumbprint) and is useless without a proper presentation. A verifier does not expect just the VC but a V. Presentation signed by the user. This is where using id_tokens as vcs will fall short. Once you give it to one verifier, you could assume is public. The good thing about VCs is that is standard and easy to grasp. There are too many flavors though