diff --git a/1.0/openid4vc-high-assurance-interoperability-profile-1_0.md b/1.0/openid4vc-high-assurance-interoperability-profile-1_0.md index c8b0c1e..a0f2101 100644 --- a/1.0/openid4vc-high-assurance-interoperability-profile-1_0.md +++ b/1.0/openid4vc-high-assurance-interoperability-profile-1_0.md @@ -258,7 +258,7 @@ The following requirements apply to OpenID for Verifiable Presentations, irrespe * The Wallet and Verifier MUST support at least one of the following Credential Format Profiles defined in (#vc-profiles): IETF SD-JWT VC or ISO mdoc. Ecosystems SHOULD clearly indicate which of these formats, IETF SD-JWT VC, ISO mdoc, or both, are required to be supported. * The Response type MUST be `vp_token`. * For signed requests, the Verifier MUST use, and the Wallet MUST accept the Client Identifier Prefix `x509_hash` as defined in Section 5.9.3 of [@!OIDF.OID4VP]. The X.509 certificate of the trust anchor MUST NOT be included in the `x5c` JOSE header of the signed request. The X.509 certificate signing the request MUST NOT be self-signed. X.509 certificate profiles to be used with `x509_hash` are out of scope of this specification. -* The DCQL query and response MUST be used as defined in Section 6 of [@!OIDF.OID4VP]. +* The `dcql_query` parameter MUST be used as defined in Section 5.1 of [@!OIDF.OID4VP]. * Response encryption MUST be performed as specified in [@!OIDF.OID4VP, section 8.3]. The JWE `alg` (algorithm) header parameter (see [@!RFC7516, section 4.1.1]) value `ECDH-ES` (as defined in [@!RFC7518, section 4.6]), with key agreement utilizing keys on the `P-256` curve (see [@!RFC7518, section 6.2.1.1]) MUST be supported. The JWE `enc` (encryption algorithm) header parameter (see [@!RFC7516, section 4.1.2]) values `A128GCM` and `A256GCM` (as defined in [@!RFC7518, section 5.3]) MUST be supported by Verifiers. Wallets MUST support `A128GCM` or `A256GCM`, or both. If both are supported, the Wallet SHOULD use `A256GCM` for the JWE `enc`. Verifiers MUST list both `A128GCM` and `A256GCM` in `encrypted_response_enc_values_supported` in their client metadata. @@ -733,7 +733,7 @@ The technology described in this specification was made available from contribut -09 - * TBD + * Clarify DCQL query is `dcql_query` parameter -final diff --git a/1.1/openid4vc-high-assurance-interoperability-profile-1_1.md b/1.1/openid4vc-high-assurance-interoperability-profile-1_1.md index 62f8fdc..29ff00b 100644 --- a/1.1/openid4vc-high-assurance-interoperability-profile-1_1.md +++ b/1.1/openid4vc-high-assurance-interoperability-profile-1_1.md @@ -254,7 +254,7 @@ The following requirements apply to OpenID for Verifiable Presentations, irrespe * The Wallet and Verifier MUST support at least one of the following Credential Format Profiles defined in (#vc-profiles): IETF SD-JWT VC or ISO mdoc. Ecosystems SHOULD clearly indicate which of these formats, IETF SD-JWT VC, ISO mdoc, or both, are required to be supported. * The Response type MUST be `vp_token`. * For signed requests, the Verifier MUST use, and the Wallet MUST accept the Client Identifier Prefix `x509_hash` as defined in Section 5.9.3 of [@!OIDF.OID4VP]. The X.509 certificate of the trust anchor MUST NOT be included in the `x5c` JOSE header of the signed request. The X.509 certificate signing the request MUST NOT be self-signed. X.509 certificate profiles to be used with `x509_hash` are out of scope of this specification. -* The DCQL query and response MUST be used as defined in Section 6 of [@!OIDF.OID4VP]. +* The `dcql_query` parameter MUST be used as defined in Section 5.1 of [@!OIDF.OID4VP]. * Response encryption MUST be performed as specified in [@!OIDF.OID4VP, section 8.3]. The JWE `alg` (algorithm) header parameter (see [@!RFC7516, section 4.1.1]) value `ECDH-ES` (as defined in [@!RFC7518, section 4.6]), with key agreement utilizing keys on the `P-256` curve (see [@!RFC7518, section 6.2.1.1]) MUST be supported. The JWE `enc` (encryption algorithm) header parameter (see [@!RFC7516, section 4.1.2]) values `A128GCM` and `A256GCM` (as defined in [@!RFC7518, section 5.3]) MUST be supported by Verifiers. Wallets MUST support `A128GCM` or `A256GCM`, or both. If both are supported, the Wallet SHOULD use `A256GCM` for the JWE `enc`. Verifiers MUST list both `A128GCM` and `A256GCM` in `encrypted_response_enc_values_supported` in their client metadata. @@ -729,4 +729,4 @@ The technology described in this specification was made available from contribut -01 - * TBD \ No newline at end of file + * Clarify DCQL query is `dcql_query` parameter \ No newline at end of file