New workflow's standard for OpenId4VCI
The OpenID Credential Issuance Standard (June 2025) defines an OAuth 2.0-based framework for issuing Verifiable Credentials (VCs) across multiple formats, ensuring security, interoperability, and privacy through standardized workflows, endpoints, and flexible issuance methods.
Key differences:
news:
Summary of OpenID Credential Issuance Standard (June 2025)
Introduction
The OpenID standard (June 2025) leverages OAuth 2.0 to issue Verifiable Credentials (VCs) in formats like W3C VCDM, ISO mdoc, and SD-JWT VC. It provides a scalable, secure framework for credential issuance, emphasizing interoperability, security, and user privacy. Key features include standardized workflows, multiple credential formats, and flexible issuance methods.
Main Sections
Section 1: Core Framework and Workflow
- Purpose: Combines OAuth 2.0 and OpenID Connect for secure VC issuance.
- Workflow: Standardizes endpoints (Credential Offer, Authorization, Token) and flows (Authorization Code, Pre-Authorized Code).
- Interoperability: Defines metadata for clients, issuers, and OAuth servers.
- Security/Privacy: Ensures trust, replay prevention, TLS, user consent, and anti-correlation measures.
- Flexibility: Supports multiple VC formats and cross-device issuance.
Section 2: Credential Issuance Flows
- Authorization Code Flow: Involves offer → metadata → consent → issuance, with wallet- or issuer-initiated options.
- Pre-Authorized Code Flow: Skips user consent for pre-authenticated users; requires stronger security (e.g., Transaction Codes).
- Deferred Issuance: Allows delayed credential delivery via polling or notifications.
Section 3: Endpoints and Technical Integration
- Credential Offer Endpoint: Supports direct JSON or URI-based offers with required fields like
credential_issuerandcredential_configuration_ids. - Token Endpoint: Extends OAuth 2.0 with new grant types (e.g.,
pre-authorized_code) and optionalauthorization_detailsfor multi-credential requests. - Credential Endpoint: Issues VCs with mandatory
proofs(e.g., JWT, LDP_VP) and optional encryption. - Nonce Endpoint: Generates fresh
c_noncevalues to prevent replay attacks.
Section 4: Security and Compliance
- Authentication: Uses OAuth standards and Wallet Attestation for legitimacy checks.
- Risk Mitigation: Validates untrusted offers, enforces replay protection (
c_nonce), and supports revocation. - Best Practices: Mandates TLS, sender-constrained tokens, and secure key management (e.g., key attestations).
- Privacy: Minimizes data retention, avoids unique identifiers, and supports batch issuance for anti-correlation.
Section 5: Credential Formats and Metadata
- Supported Formats: Includes JWT (
jwt_vc_json), JSON-LD (ldp_vc), ISO mdoc (mso_mdoc), and SD-JWT VC (dc+sd-jwt). - Metadata: Defines issuer and wallet metadata (e.g.,
credential_configurations_supported, localized display properties). - Claims Processing: Uses path-based navigation (e.g.,
["degrees", null, "type"]) for structured data access.
Section 6: Use Cases and Extensions
- Use Cases: Same-device issuance, cross-device QR verification, deferred issuance (e.g., background checks), and wallet-initiated requests.
- Registrations: Adds OAuth URIs, media types (e.g.,
key-attestation+jwt), and well-known endpoints (/.well-known/openid-credential-issuer). - Wallet Attestation: Authenticates native app wallets via OS checks (iOS/Android).
Conclusion
The OpenID Credential Issuance Standard provides a robust, interoperable framework for issuing VCs using OAuth 2.0. It balances security (e.g., TLS, replay protection) with flexibility (multiple formats, deferred issuance) while prioritizing user privacy. Future updates may expand support for emerging standards like Data Integrity VCs. Authors: Lodderstedt, Yasuda, Looker; Published June 6, 2025.
```