VCI - Using unsupported cryptographic binding method `x5c` about java-oauth-server

[TakahikoKawasaki]

@babisRoutis Thank you for bringing this issue.

I guess that you are talking about the value of the cryptographic_binding_methods_supported issuer metadata in the JSON returned from https://trial.authlete.net/.well-known/openid-credential-issuer.

Technically speaking, this is not an issue of java-oauth-server. It's an issue in the configuration of the credential issuer that is running on trial.authlete.net.

If the value of the cryptographic_binding_methods_supported issuer metadata is used to list the supported formats of keys in key proofs (not in verifiable credentials) (NOTE: As OpenID4VCI Issue 283 points out, this is not so clearly stated in the specification), another issue is raised. Although the "jwt Proof Type" section of the OID4VCI spec defines a method that utilizes the x5c header parameter, the "Credential Issuer Metadata Parameters" section does not include a string constant that corresponds to x5c.

[babisRoutis]

Dear @TakahikoKawasaki

I guess that you are talking about the value of the cryptographic_binding_methods_supported issuer metadata in the JSON returned from https://trial.authlete.net/.well-known/openid-credential-issuer.

Indeed.

Technically speaking, this is not an issue of java-oauth-server. It's an issue in the configuration of the credential issuer that is running on trial.authlete.net.

That's clear

If the value of the cryptographic_binding_methods_supported issuer metadata is used to list the supported formats of keys in key proofs (not in verifiable credentials) (NOTE: As OpenID4VCI Issue 283 points out, this is not so clearly stated in the specification), another issue is raised. Although the "jwt Proof Type" section of the OID4VCI spec defines a method that utilizes the x5c header parameter, the "Credential Issuer Metadata Parameters" section does not include a string constant that corresponds to x5c.

I was about to comment on issue 283, that I find the definition of cryptographic_binding_methods_supported confusing. 😄

Initially, I had the impression that, as you describe, it expresses the ways a key can be found inside the proof.
My current understanding though, exactly because x5c was missing, is that it expresses the format of keys in the issued VC.

I guess it should be clarified in VCI spec.