BREAKING: OpenID Foundation Just Leveled Up Digital Identity Security - Here's What Changed!
HAIP 1.0 gets smarter with flexible attestations, dedicated URI schemes, and enhanced certificate security while aligning with final OID4VCI/OID4VP standards.
Published on: 9/29/2025, 9:21:00 AM
OpenID4VCHAIPDigitalIdentityeIDAS2VerifiableCredentialsOID4VCIOID4VPSecurityStandardsInteroperabilityCryptographyPrivacyWalletSecurityIdentityManagementOpenIDFoundation
Key differences:
- Flexible Key Attestations: Wallets can now use alternative key attestation formats instead of being locked into just one standard, making implementation easier
- Dedicated URI Schemes: Introduced separate
haip-vci://for credential issuance andhaip-vp://for verification, replacing the generichaip://scheme - Enhanced Certificate Security: Now explicitly prohibits self-signed certificates and trust anchor inclusion in x5c headers across all signing operations
- Updated Reference Standards: Aligned with final versions of OID4VCI 1.0 and OID4VP 1.0 specifications
- Privacy-First Key Attestations: Added requirements that backend services for key attestations must be privacy-preserving and stateless
- Streamlined Requirements: Removed outdated requirements like batch endpoint support and SIOPv2, focusing on modern authentication methods
news:
The OpenID4VC High Assurance Interoperability Profile (HAIP) is a strict security overlay that ensures digital credentials from different vendors can work together seamlessly in high-stakes environments like eIDAS 2.0. It builds on existing standards for credential issuance (OID4VCI) and verification (OID4VP) while adding mandatory security requirements including specific cryptographic algorithms, wallet attestations, and privacy protections. The latest update refines implementation details while maintaining the profile's core mission of enabling secure, interoperable digital identity systems for government and enterprise use.
