This specification defines a new PGP based proof format for use with Verifiable Credentials

In addition to meeting the requirements defined in [[RFC4880]], We introduce some additional constraints to eliminate optionality and improve interoperability and development experience with similar proof formats:

• vc-jws
• vc-cose

Introduction

This specification introduces a simple solution for securing Verifiable Credentials that utilize PGP Authentication via Digital Signature to provide signing and verification in a Verifiable Credential.

Producing

For additional details, please see the full breakdown of the process in Producing and Consuming PGP Signatures.

Specifically related to use of PGP with Verifiable Credentials the following normative requirements MUST be considered in production of a JWS.

A proof property MUST be present in the credential JSON.

• proof.type MUST be present and MUST be an PGPSignature.

  proof.created MUST be present and MUST be an XMLDateTime.

  proof.proofPurpose MUST be present and MUST be one of authentication, or assertionMethod.

  The value of proof.verificationMethod MUST be MUST be present, and structured as follows:

  • An absolute DID URL that dereferences to a verification method with public key material in publicKeyPgp.

  • The publicKeyPgp is expected to verify the PGP Signature.

Consuming

For additional details, please see the full breakdown of the process in Producing and Consuming PGP Signatures.

As a part of ensuring interoperability with Verifiable Credentials secured in the manner described in this specification, resolution of public key material MUST succeed, as a verifier might not have access to the public key.

In order to verify a Verifiable Credential using a PGP proof, the public key associated with the signature needs to be obtained. If the verifier does not already have the public key, it can be obtained through the following process:

• Parse the Signature Content to obtain the verificationMethod property which MUST be an absolute DID URL.
• Dereference the absolute DID URL to obtain a verification method which contains a publicKeyPgp.
• Follow the process for Computing Signatures and Verifying Signatures.

Example

IANA Considerations

profile-param = "profile=" profile-value
profile-value = <"> profile-URI 0*( 1*SP profile-URI ) <">
profile-URI   = URI

This is required for specifications that contain normative material.