BREAKING: OpenID for Verifiable Credential Issuance Gets Major Security & Privacy Upgrades!
OID4VCI's latest update boosts security with mandatory encryption for responses, compression support, and new encrypted message handling—making digital credentials safer and more efficient.
Published on: 6/25/2025, 7:16:26 AM
OID4VCIVerifiableCredentialsOpenIDSecurityPrivacyOAuth2DigitalIdentityEncryptionW3CISOmdoc
Key differences:
- Added Encrypted Messages (Section 9.4): Introduces a new section for encrypting requests and responses beyond TLS, enhancing security.
- Compression Support (
zipparameter): Now supports optional compression of credential responses before encryption to optimize data transfer. - Mandatory Encryption for Response Encryption: If response encryption is used, request encryption is now required to prevent substitution attacks.
- Enhanced Metadata for Encryption: Credential Issuer Metadata now includes details like supported encryption algorithms (
enc_values_supported) and compression methods (zip_values_supported). - Deferred Credential Flow Updates: Adds support for encrypted deferred requests and responses, improving security for delayed issuance scenarios.
news:
The **OpenID for Verifiable Credential Issuance (OID4VCI)** framework extends OAuth 2.0 and OpenID Connect to standardize the issuance of **Verifiable Credentials (VCs)**. It enables secure, interoperable digital credential exchange across industries like healthcare, finance, and government. The framework supports multiple VC formats (W3C VCDM, ISO mdoc, SD-JWT VC) and emphasizes privacy features like selective disclosure and zero-knowledge proofs. The latest draft introduces enhanced encryption and compression capabilities, further strengthening security and usability.
