W3C Candidate Recommendation (28 April 2025) on Verifiable Credentials (VCs) & Presentations (VPs)

```html

Summary of W3C Candidate Recommendation (28 April 2025) on Verifiable Credentials (VCs) & Presentations (VPs)

Introduction

The W3C Candidate Recommendation defines security methods for Verifiable Credentials (VCs) and Verifiable Presentations (VPs) using **JOSE (JWS/JWE)**, **SD-JWT (Selective Disclosure JWT)**, and **COSE (CBOR Object Signing and Encryption)**. The standard ensures integrity, authenticity, and selective disclosure while promoting interoperability and compliance with RFC 2119 normative rules.

Main Sections

Section 1: Security & Implementation

Security Goals: Integrity, authenticity, and selective disclosure.
Implementation Requirements: ≥2 independent implementations per feature by 19 January 2025.
Methods:
- JWS (JSON Web Signature) for JSON integrity.
- SD-JWT for partial disclosure.
- COSE for efficient CBOR-based security.
Key Binding: Uses headers (e.g., `kid`, `iss`) and Controlled Identifier Documents.
Privacy & Security: Ensures confidentiality, accessibility, and compliance with NIST SP 800-122.

Section 2: Supported Formats & Compliance

Formats: Compliant with **VC Data Model 2.0**, supporting:
- JWT (JSON Web Token).
- SD-JWT (with selective disclosure and optional KB-JWT binding).
- COSE (CBOR-based).
Key Guidelines:
- JWT: Excludes unsigned JWTs and reserved claims.
- SD-JWT: Uses `~` delimiter for KB-JWT binding.
Media Types: Defined for interoperability (e.g., `application/vc+jwt`, `application/vp+sd-jwt`).

Section 3: Verification & Structure

JWS Verification: Follows RFC7515 for document integrity.
Enveloped Formats:
- Enveloped Verifiable Credential (for credentials within presentations).
- Enveloped Verifiable Presentation (secured via JWS or COSE).
Optional Encryption: JWE (RFC7516) for insecure channels.
Examples: Demonstrates JWT/SD-JWT/COSE structures with headers, payloads, and signatures.

Section 4: Selective Disclosure (SD-JWT)

Process: Transforms VCs into SD-JWT payloads with hashed claims (`_sd`) and disclosures.
Headers: Mandates `typ: vc+sd-jwt`; optional `cty: vc`.
Privacy: Core properties (e.g., `@context`) are non-disclosable; selective claims revealed via disclosures.
Security: SHA-256 hashing ensures tamper-proof validation.

Section 5: COSE Integration

Requirements:
- Mandatory `COSE_Sign1` for credential security (RFC9052).
- Headers specify media types (e.g., `application/vc+cose`).
Verification: Validators must use `COSE_Sign1`.
Encoding: Base64 (RFC2397) required; optional encryption for insecure channels.

Section 6: Media Type Registrations

JWT Formats:
- `application/vc+jwt` (Verifiable Credentials).
- `application/vp+jwt` (Verifiable Presentations).
SD-JWT Formats:
- `application/vc+sd-jwt` (Selective Disclosure for VCs).
- `application/vp+sd-jwt` (Selective Disclosure for VPs).
COSE Formats:
- `application/vc+cose` (CBOR-encoded VCs).
- `application/vp+cose` (CBOR-encoded VPs).

Section 7: Privacy, Security & Accessibility

Privacy: Mandates minimal data collection, user consent, and encryption.
Security: Requires secure key handling, input validation, and regular audits.
Accessibility: Adheres to WCAG 2.1 for inclusive design.

Section 8: Examples & Use Cases

Multi-Subject VCs: Demonstrates revocable credentials with `StatusList2021Entry`.
Structured Disclosures: Shows SHA-256 hashed claims and selective verification.
COSE Examples: Illustrates headers, payloads, and signatures in CBOR format.

Conclusion

The W3C Candidate Recommendation standardizes secure, interoperable methods for issuing and verifying VCs/VPs using JOSE, SD-JWT, and COSE. It balances privacy (via selective disclosure), security (via cryptographic integrity), and flexibility (supporting multiple formats). The document provides clear implementation guidelines, media type registrations, and examples to ensure broad adoption across decentralized identity systems.

```