BREAKING: OpenID4VCI June 2025 Draft Unveils Major Security Upgrades & New Features!

• Updated Security Best Practices: The draft now aligns with the latest OAuth 2.0 security guidelines (BCP240) and recommends the FAPI 2.0 Security Profile for implementers.
• Proof Type Renaming: The ldp_vp proof type has been renamed to di_vp (Data Integrity Verifiable Presentation) for clarity and consistency.
• Enhanced Algorithm Matching: The proof_signing_alg_values_supported metadata parameter must now match the algorithms used in key proofs, ensuring stronger cryptographic integrity.
• New Section on OAuth 2.0 Security: A dedicated section (12.1) has been added to emphasize best practices for OAuth 2.0 security, including recommendations for wallet attestations and DPoP.
• Replay Prevention Improvements: The Pre-Authorized Code Flow now includes stricter replay prevention measures (Section 12.4.1) and phishing mitigations (Section 12.4.2).
• Credential Lifecycle Management: A new section (12.5) addresses credential lifecycle management, including revocation and renewal processes.
• TLS Requirements: Updated TLS requirements (Section 12.7) ensure secure communication between all parties.
• Access Token Protection: Enhanced guidelines for protecting access tokens (Section 12.8) now include recommendations for secure storage and encryption.

The OpenID for Verifiable Credential Issuance (OpenID4VCI) specification, developed by the OpenID Foundation, standardizes the issuance of Verifiable Credentials (VCs) using OAuth 2.0 and OpenID Connect. It enables interoperable, privacy-preserving credential issuance across industries like government, healthcare, and finance. The June 2025 draft introduces significant updates to security, proof types, and lifecycle management, further solidifying its role as a cornerstone of modern digital identity infrastructure.