You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: index.html
+49-26Lines changed: 49 additions & 26 deletions
Original file line number
Diff line number
Diff line change
@@ -305,7 +305,12 @@ <h3>What is a Verifiable Credential?</h3>
305
305
refers to the characteristic of a <a>credential</a> or <a>presentation</a>
306
306
as being able to be <a>verified</a> by a <a>verifier</a>,
307
307
as defined in this document. Verifiability of a credential does not imply
308
-
that truth of <a>claims</a> encoded therein. Rather, once the authenticity and currency of a <a>verifiable credential</a> or <a>verifiable presentation</a> are established, a <a>verifier</a> validates the included claims using their own business rules before relying on them. Such reliance only occurs after evaluating the issuer, the proof, the subject, and the claims, against one or more verifier policies.
308
+
that truth of <a>claims</a> encoded therein. Rather, once the authenticity and
309
+
currency of a <a>verifiable credential</a> or <a>verifiable presentation</a> are
310
+
established, a <a>verifier</a> validates the included claims using their own
311
+
business rules before relying on them. Such reliance only occurs after
312
+
evaluating the issuer, the proof, the subject, and the claims, against one or
<a>verifiable credential</a>, which is then composed into a
964
969
<a>verifiable presentation</a>. The <a>verifiable presentation</a> is sent to
965
970
the <a>verifier</a> and <a>verified</a>.
966
-
</p>
967
-
<p>Once verified as authentic and current, the seller of the season ticket
968
-
then validates that the issuer of the <a>verifiable credential</a> is
969
-
recognized for the claim of alumni status—it is, as it is issued
970
-
by Example University—and that today's date lies within the
971
-
validity period defined by the values of the validFrom and validUntil
972
-
properties. Since the holder is expected to be the subject of the
973
-
<a>verifiable credential</a>, the <a>verifier</a> also confirms that
974
-
the id for the alumni claim matches the id of the creator of the
975
-
<a>verifiable presentation.</a>
976
-
</p>
977
-
<p>Having verified the credential and the presentation, and validated the relevant claims, the ticket seller safely enables the alumni discount for Pat, confident that Pat is legitimately entitled to it.</p>
971
+
</p>
972
+
<p>
973
+
Once verified as authentic and current, the seller of the season ticket then
974
+
validates that the issuer of the <a>verifiable credential</a> is recognized for
975
+
the claim of alumni status—it is, as it is issued by Example
976
+
University—and that today's date lies within the validity period defined
977
+
by the values of the validFrom and validUntil properties. Since the holder is
978
+
expected to be the subject of the <a>verifiable credential</a>, the
979
+
<a>verifier</a> also confirms that the id for the alumni claim matches the id of
980
+
the creator of the <a>verifiable presentation.</a>
981
+
</p>
982
+
<p>
983
+
Having verified the credential and the presentation, and validated the
984
+
relevant claims, the ticket seller safely enables the alumni discount for Pat,
985
+
confident that Pat is legitimately entitled to it.
986
+
</p>
978
987
<preclass="example nohighlight" title="A simple example of a verifiable presentation">
979
988
{
980
989
"@context": [
@@ -2585,7 +2594,11 @@ <h3>Lifecycle Details</h3>
2585
2594
of the <a>verifiable credentials</a>.
2586
2595
</li>
2587
2596
<li>
2588
-
After <a>verification</a>, a <a>verifier</a> validates the relevant claims in presented <a>verifiable credentials</a>, using their own business logic to evaluate which issuers are appropriate for which claims and which subjects are appropriate for the requested use.</li>
2597
+
After <a>verification</a>, a <a>verifier</a> validates the relevant claims in
2598
+
presented <a>verifiable credentials</a>, using their own business logic to
2599
+
evaluate which issuers are appropriate for which claims and which subjects are
2600
+
appropriate for the requested use.
2601
+
</li>
2589
2602
<li>
2590
2603
An <a>issuer</a> might <dfnclass="lint-ignore" data-lt="revoke">revoke</dfn> a
2591
2604
<a>verifiable credential</a>.
@@ -4717,7 +4730,9 @@ <h3>Validation</h3>
4717
4730
evaluate any relevant <a>claims</a> before relying upon them. This
4718
4731
evaluation might be done in any manner desired, as long as it satisfies
4719
4732
the requirements of the <a>verifier</a> doing the validation.
4720
-
Many verifiers will perform the checks listed in Appendix <ahref="#validation-0"></a> as well as a variety of specific business process checks such as:
4733
+
Many verifiers will perform the checks listed in Appendix <a
4734
+
href="#validation-0"></a> as well as a variety of specific business process
While valid cryptographic signatures and successful status checks
5435
5450
signify the reliability of credentials, they do not signify that all credentials
5436
5451
are interchangeable for all contexts. It is crucial for verifiers to
5437
-
also validate any claims which might be relevant, considering the source and nature of the claim as well as privilege or service for which the credential is presented.
5438
-
</p><p>
5439
-
For
5440
-
instance, in scenarios where a certified medical diagnosis is required, a self-asserted
5441
-
<a>credential</a> carrying the necessary data might not suffice because it lacks validity from an
5442
-
authoritative medical source. To ensure the propriety of <a>credential</a> use,
5443
-
stakeholders are urged to assess the <a>credential</a>s' relevance and authority within
5444
-
the specific context of their intended application.
5452
+
also validate any claims which might be relevant, considering the source and
5453
+
nature of the claim as well as privilege or service for which the credential is
5454
+
presented.
5455
+
</p>
5456
+
<p>
5457
+
For instance, in scenarios where a certified medical diagnosis is required, a
5458
+
self-asserted <a>credential</a> carrying the necessary data might not suffice
5459
+
because it lacks validity from an authoritative medical source. To ensure the
5460
+
propriety of <a>credential</a> use, stakeholders are urged to assess the
5461
+
<a>credential</a>s' relevance and authority within the specific context of their
The digital signature provides a number of protections, other than tamper
5831
5849
resistance, which are not immediately obvious. For example, a Linked Data
5832
5850
Signature <code>created</code><a>property</a> establishes a date and time
5833
-
before which the <a>credential</a> should not be considered <a>verified</a>, separate from the validity period of the credential. This property describes the validity of the proof, not of the credential.<br/>
5834
-
The
5851
+
before which the <a>credential</a> should not be considered <a>verified</a>,
5852
+
separate from the validity period of the credential. This property describes the
5853
+
validity of the proof, not of the credential.<br/> The
5835
5854
<code>verificationMethod</code><a>property</a> specifies, for example, the
5836
5855
public key that can be used to verify the digital signature. Dereferencing a
5837
5856
public key URL reveals information about the controller of the key, which can
@@ -5850,7 +5869,11 @@ <h3>Validity Periods</h3>
5850
5869
The <code>validFrom</code> and <code>validUntil</code> properties are expected
5851
5870
to be within an expected range for the <a>verifier</a>. For example, a
5852
5871
<a>verifier</a> can check that the end of the validity period of a <a>verifiable
5853
-
credential</a> is not in the past. Because some credentials can be useful for secondary purposes even if their original validity period has expired, validity period, as expressed using the <code>validFrom</code> and <code>validUntil</code> properties, is always considered a component of validation, which is performed <em>after</em> verification.
5872
+
credential</a> is not in the past. Because some credentials can be useful for
5873
+
secondary purposes even if their original validity period has expired, validity
5874
+
period, as expressed using the <code>validFrom</code> and
5875
+
<code>validUntil</code> properties, is always considered a component of
5876
+
validation, which is performed <em>after</em> verification.
0 commit comments