Skip to content

Add additional text clarifying how to match vct and doctype#744

Open
GarethCOliver wants to merge 5 commits into
openid:mainfrom
GarethCOliver:type-matching
Open

Add additional text clarifying how to match vct and doctype#744
GarethCOliver wants to merge 5 commits into
openid:mainfrom
GarethCOliver:type-matching

Conversation

@GarethCOliver

@GarethCOliver GarethCOliver commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

Resolves #741 by adding more explicit instructions on what allows a Credential to satisfy vct_values, and applies similar explicit text to doctype_value

Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
GarethCOliver and others added 2 commits June 18, 2026 08:30
Co-authored-by: Frederik Krogsdal Jacobsen <fkj@users.noreply.github.com>
Co-authored-by: Frederik Krogsdal Jacobsen <fkj@users.noreply.github.com>
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
Co-authored-by: Frederik Krogsdal Jacobsen <fkj@users.noreply.github.com>
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
A Credential's type can be determined as satifying the Credential Query as follows:

1. Check if the `vct` in the Credential is contained in the `vct_values` array. If it is, the Credential satisfies the Credential Query.
1. If `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. If a circular dependency is detected while following the `extends` claims, the Credential does not satisfy the Credential Query.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit:

Suggested change
1. If `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. If a circular dependency is detected while following the `extends` claims, the Credential does not satisfy the Credential Query.
1. If the `vct` in the Credential is not contained in the `vct_values` array, check if the Credential has an `extends` claim. If it does, repeat this process for the Type metadata specified by the `extends` value, until either a match is found or the `extends` claim is not present. If a circular dependency is detected while following the `extends` claims, the Credential does not satisfy the Credential Query.

the inheritance logic defined in [@!I-D.ietf-oauth-sd-jwt-vc].
: REQUIRED. A non-empty array of strings that specifies allowed values for the type of the requested Verifiable Credential. All elements in the array MUST be valid type identifiers as defined in [@!I-D.ietf-oauth-sd-jwt-vc]. To satisfy the Credential Query, a Credential MUST either have or inherit from a type that is included in the `vct_values` array as defined in [@!I-D.ietf-oauth-sd-jwt-vc].

A Credential's type can be determined as satifying the Credential Query as follows:

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry to be annoying and do yet another round of suggestions, but I think this should be phrased as a normative requirement. Something like:

Suggested change
A Credential's type can be determined as satifying the Credential Query as follows:
The Wallet MUST determine whether a Credential's type satisfies a Credential Query by following these steps:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Clarification on checking inheritance of received vct (VP token validation)

2 participants