W3C Verifiable Credentials Just Got MAJOR Security Updates - Here's What Changed!
Security refresh: All cryptographic signatures and timestamps updated across JWT, COSE, and SD-JWT formats for enhanced protection.
Published on: 9/29/2025, 9:21:46 AM
VerifiableCredentialsW3CDigitalIdentityCryptographyJWTCOSESDJWTPrivacySecurityUpdateSelectiveDisclosureVCVPBlockchainDecentralizedIdentity
Key differences:
- Updated cryptographic signatures across all JWT, COSE, and SD-JWT formats with fresh digital signatures for enhanced security
- Refreshed issuance and expiration timestamps (iat/exp values) to ensure current validity windows
- Generated new hash values for all selective disclosure claims to maintain privacy integrity
- Updated all disclosure identifiers and content hashes in SD-JWT implementations
- Maintained structural integrity while rotating cryptographic materials for forward security
news:
The W3C Verifiable Credentials standard enables secure digital credentials that can be verified cryptographically, similar to digital versions of physical credentials like driver's licenses or diplomas. This update maintains the core functionality while refreshing cryptographic materials to ensure ongoing security. The standard supports multiple formats including JSON, JWT, COSE (for IoT devices), and SD-JWT for privacy-preserving selective disclosure.
