5.3.1 Semantic Interoperability

[nadalin]

No need to process the @context unless dealing with JSON-LD, should be made optional

[nadalin]

JWT/CWT are deployed widely in the web, most every RP uses these, so I don't think this should be at risk, what makes this at risk is that these are not first class objects that is they are always within a JSON-LD container, so if that restriction is removed then I think you would see JWT/CWT be widely used instead of JSON-LD. Microsoft is using JWT/CWT

The use of an IANA registry for the various JWT claims would serve the purpose that the @context does unless I'm missing something here

[brentzundel]

It is my understanding that processing the @context is optional, even though the property is required to be present.

[nadalin]

It says "It is RECOMMENDED that dereferencing the URIs results in a document containing machine-readable information about the context. " it also says that the @context value pair MUST be there, no reason for this other than to force JSON-LD IMHO

[brentzundel]

There are comment in #483 that I believe are pertinent to this issue as well.

[David-Chadwick]

@nadalin "The use of an IANA registry for the various JWT claims would serve the purpose that the @context does unless I'm missing something here". What you are missing is that VCs are built on an open model, meaning that anyone is free to extend VCs in any way that they want to – “permissionless innovation”, without the need for a centrally managed registry.

[nadalin]

@David-Chadwick There is no requirement in the spec to be decentralized that I can find, there are already dependencies on DNS with JSON-LD and dependencies on registries in this specification so IANA is just fine since the algorithm identifiers are defined in IANA

[dmitrizagidulin]

@nadalin Nobody is forcing JSON-LD processing on anyone. Yes, @context is required, for wider interop.

JWT/CWT are deployed widely in the web

The use of @context on the web is at least one order of magnitude (if not more) greater than the use of JWT. It is literally used by billions of web pages, by every major search engine, including by Microsoft's Bing.

The 'RECOMMENDED that dereferencing the URIs results in a document containing machine-readable information' is just developer courtesy and common sense, but it is still not forcing anything. Your implementation is still free to break interop and not have a derefernceable URI.

[jandrieu]

@context is mandatory, as per the discussion and consensus at the Barcelona face-to-face meeting.

@nadalin, including the @context means interoperability for JWT and JSON-LD. It doesn't mean you must use JSON-LD, just that you are conformant to a spec that supports interoperability.

[chaals]

It is RECOMMENDED that dereferencing the URIs results in a document containing machine-readable information about the context

doesn't imply you need to process anything. It merely means that best practice (in order to support the tools that do use JSON-LD) is to have the URL in the @context property actually dereferenceable, and provide a context file as describe by JSON-LD.

As noted above, you're not actually forced to implement best practice, let alone Process the @context section.

On the other hand I would note that there are internationalisation issues that are almost impossible to solve without either using JSON-LD or copying the features directly into the VC spec and requiring all processors that don't have JSON-LD to adopt the functionality. (This is a common problem with JSON-based specs, by the way).

[David-Chadwick]

@nadalin "The use of an IANA registry for the various JWT claims would serve the purpose that the @context does unless I'm missing something here". What you are missing is that VCs are built on an open model, meaning that anyone is free to extend VCs in any way that they want to – “permissionless innovation”, without the need for a centrally managed registry.

[David-Chadwick]

This might be slightly off topic, but I note that Microsoft are now using @context in their Identity Hubs, see
https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Identity-Hubs-as-personal-datastores/bc-p/390930#M984

[nadalin]

@David-Chadwick JWT are open, nothing is mandatory like VC (making @context Mandatory) so a JWT is fully open to extend, VC seems also to have a dependency on https://w3c-ccg.github.io/vc-status-registry/ so not sure how you say that there is no central registry dependency

[David-Chadwick]

@nadalin There is no dependency on the status registry, and indeed, no requirement to publish the status, or even revoke VCs. Short lived non-revocable VCs are perfectly acceptable.
As to DNS dependency, the entire Internet is dependent on this, so this is a feature of all Internet applications rather than a particular dependency of VCs