You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/common/standards-lostnfound.rst
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -219,7 +219,7 @@ Digital Credential Issuance Proposals for Future Milestones
219
219
* - ISO/IEC 23220-3
220
220
- Cards and security devices for personal identification - Building blocks for identity management via mobile devices - Part 3: Protocols and services for installation and issuing phase
221
221
* - DTS/ESI-0019472-2
222
-
- Electronic Signatures and Trust Infrastructures (ESI); Profiles for Electronic Attestations of Attributes Part 2: Profiles for Relying party interface to EUDI Wallet
222
+
- Electronic Signatures and Trust Infrastructures (ESI); Profiles for Electronic Attestations of Attributes Part 2: Profiles for Relying Party interface to EUDI Wallet
223
223
* - DTS/ESI-0019472-1
224
224
- Electronic Signatures and Trust Infrastructures (ESI); Profiles for Electronic Attestations of Attributes; Part 1: General requirements Profiles for EAA - General requirements
Copy file name to clipboardExpand all lines: docs/en/backup-restore.rst
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ The **Backup and Restore** functionality becomes relevant when the User wants to
12
12
- The User performs a factory reset on the current phone and needs to set up the Wallet Solution again.
13
13
14
14
.. note::
15
-
For Wallet Solutions based on the IT Wallet technical specifications, the migration to a different Wallet Solution (known as data portability) can be supported following the backup and restore functionality described in this section.
15
+
For Wallet Solutions based on the IT Wallet Technical Specifications, the migration to a different Wallet Solution (known as data portability) can be supported following the backup and restore functionality described in this section.
16
16
17
17
18
18
Backup Flow
@@ -139,7 +139,7 @@ To check the authenticity of the file, the Wallet Instance MUST verify the backu
139
139
**Steps 7-8**: The Wallet Instance for each HW binding credentials entry in the payload of the backup JWT performs the following steps:
140
140
141
141
- It extracts the Credential Issuer identifier and the ``credential_configuration_id`` from the entry. The former is used to identify the Issuer and obtains its metadata, while the latter will be used to signal the Credential type to the Credential Issuer.
142
-
- Using the Issuer identifier the Wallet Instance obtains the metadata of the Credential Issuer and makes a re-issuance request to the Credential Issuer by providing the new cryptographic binding with the Credential.
142
+
- Using the Issuer identifier the Wallet Instance obtains the metadata of the Credential Issuer and makes a re-issuance request to the Credential Issuer by providing the new Cryptographic Binding with the Credential.
143
143
144
144
.. note::
145
145
The Wallet Instance MUST not check the expiration of the Wallet Attestation as its main purpose is to enable the Wallet Instance to verify the authenticity of the backup file by ensuring it has been created and signed by a Wallet Instance of a specific Wallet Provider.
Copy file name to clipboardExpand all lines: docs/en/brand-identity.rst
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -65,7 +65,7 @@ The following requirements apply to its use in both physical and digital context
65
65
66
66
- The Trust Mark MUST be used exclusively to certify the participation in the IT-Wallet System and MUST NOT be used for any other purpose;
67
67
68
-
- The Trust Mark MUST only be displayed by Technical Solutions that have successfully completed the certification process;
68
+
- The Trust Mark MUST only be displayed by Technical Solutions that have successfully completed the Certification Process;
69
69
70
70
- The Trust Mark MUST be used exactly as provided in the Official Resources and MUST comply with the usage specifications outlined in the Official Resources to ensure proper visibility throughout all the stages of the User Experience;
- [NSD]. REQUIRED. The identifier of the subject of the Digital Credential, the User, MUST be opaque and MUST NOT correspond to any anagraphic data or be derived from the User's anagraphic data via pseudonymization. Additionally, it is required that two different Credentials issued MUST NOT use the same ``sub`` value.
@@ -125,7 +125,7 @@ The JWT payload contains the following claims. Some of these claims can be discl
125
125
- [NSD]. REQUIRED. Name of the administrative authority that has issued the PID/(Q)EAA.
- [NSD]. REQUIRED only if the Digital Credential is long-lived. JSON object containing the information on how to read the status of the Verifiable Credential. It MUST contain either the JSON member *status_assertion* or *status_list*.
@@ -134,7 +134,7 @@ The JWT payload contains the following claims. Some of these claims can be discl
134
134
- [NSD]. REQUIRED. JSON object containing the proof-of-possession key materials. By including a **cnf** (confirmation) claim in a JWT, the Issuer of the JWT declares that the Holder is in control of the private key related to the public one defined in the **cnf** parameter. The recipient MUST cryptographically verify that the Holder is in control of that key.
135
135
- `[RFC7800, Section 3.1] <https://www.iana.org/go/rfc7800>`_ and Section 3.2.2.2 `SD-JWT-VC`_.
136
136
* - **vct**
137
-
- [NSD]. REQUIRED. Credential type value MUST be an HTTPS URL String and it MUST be set using one of the values obtained from the PID/(Q)EAA Issuer metadata. It is the identifier of the SD-JWT VC type and it MUST be set with a collision-resistant value as defined in Section 2 of :rfc:`7515`. It MUST contain also the number of version of the Credential type (for instance: ``https://trust-registry.eid-wallet.example.it/credentials/v1.0/personidentificationdata``).
137
+
- [NSD]. REQUIRED. Credential type value MUST be an HTTPS URL String and it MUST be set using one of the values obtained from the Credential Issuer metadata. It is the identifier of the SD-JWT VC type and it MUST be set with a collision-resistant value as defined in Section 2 of :rfc:`7515`. It MUST contain also the number of version of the Credential type (for instance: ``https://trust-registry.eid-wallet.example.it/credentials/v1.0/personidentificationdata``).
138
138
- Section 3.2.2.2 `SD-JWT-VC`_.
139
139
* - **vct#integrity**
140
140
- [NSD]. REQUIRED. The value MUST be an "integrity metadata" string as defined in Section 3 of [`W3C-SRI`_]. *SHA-256*, *SHA-384* and *SHA-512* MUST be supported as cryptographic hash functions. *MD5* and *SHA-1* MUST NOT be used. This claim MUST be verified according to Section 3.3.5 of [`W3C-SRI`_].
The following table provides a comparative mapping between the data structures of SD-JWT-VC and mdoc-CBOR Digital Credentials.
825
825
It outlines the key data elements and parameters used in each format, highlighting both commonalities and differences.
826
-
In particular, it shows how core concepts - such as Credential Issuer information, validity, cryptographic binding, and disclosures - are represented in these Credential formats.
826
+
In particular, it shows how core concepts - such as Credential Issuer information, validity, Cryptographic Binding, and disclosures - are represented in these Credential formats.
827
827
828
828
For SD-JWT-VC, parameters are marked with `(hdr)` if they are located in the JOSE header, and `(pld)` if they appear in the payload of the JWT. In mdoc-CBOR, these parameters are identified within the issuerAuth or nameSpaces structures.
829
829
@@ -888,10 +888,10 @@ For SD-JWT-VC, parameters are marked with `(hdr)` if they are located in the JOS
888
888
|x5c (hdr)
889
889
- | -
890
890
|issuerAuth.33 (x5chain)
891
-
* - Cryptographic binding
891
+
* - Cryptographic Binding
892
892
- cnf.jwk (pld)
893
893
- issuerAuth.deviceKeyInfo.deviceKey
894
-
* - Selective disclosure
894
+
* - Selective Disclosure
895
895
- | _sd_alg (pld)
896
896
|_sd (pld)
897
897
- | issuerAuth.digestAlgorithm
@@ -919,7 +919,7 @@ For SD-JWT-VC, parameters are marked with `(hdr)` if they are located in the JOS
919
919
920
920
.. note::
921
921
- In the mdoc-CBOR format, the version of the Digital Credential is not explicitly defined; it is only available for the IssuerAuth. In contrast, the SD-JWT format includes version information via the `vct` URL.
922
-
- `Disclosures`, `_sd`, and `_sd_alg` enable selective disclosure of SD-JWT claims. The `_sd` and `_sd_alg` parameters are part of the SD-JWT payload, while `Disclosures` are sent separately in a Combined Format along with the SD-JWT.
922
+
- `Disclosures`, `_sd`, and `_sd_alg` enable Selective Disclosure of SD-JWT claims. The `_sd` and `_sd_alg` parameters are part of the SD-JWT payload, while `Disclosures` are sent separately in a Combined Format along with the SD-JWT.
923
923
- The `vctm.claims` parameter in SD-JWT and the `nameSpaces` structure in mdoc-CBOR are functionally equivalent, as both define the claim names and their structure. SD-JWT `Disclosures` for disclosed attributes directly correspond to `nameSpaces`, including attribute names, values, and salt values.
924
924
- A domestic namespace accommodates attributes such as `verification` and `sub`, which are not defined in the standard ISO elementIdentifiers for mdoc-CBOR Digital Credentials.
0 commit comments