Advantage of VPP

[sebplorenz]

Hi,
what is the advantage of having a Verifiable Presentation Protocol instead of using this approach (that seems to be closer to the OpenID4VP standard) https://hub.ebsi.eu/conformance/learn/verifiable-presentation-exchange#service-to-service-token-flow?
Regards, Sebastian

[arnoweiss]

There's a variety of considerations that led to the decision for a separate protocol. The user interaction that OID4VP demands is a no-go for scalable machine-to-machine scenarios. The DCP closes this gap and actually borrows a lot of concepts from OID4VP.

[sebplorenz]

But the approach mentioned above is meant to remove this user ineteraction and at the same time stays close to the OID4VP spec.

[jimmarino]

OpenID must involve end-user interaction; there is no way around that. Our design center is asynchronous, machine-to-machine interactions, which are very different from end-user interactions at a technical and requirements level. DCP is based on many of the same standards as OpenID. Given that, there is no benefit (and numerous impediments) in emulating the interaction flows specified by OpenID.

The referenced flow is only a sequence diagram with limited details, not something we could base our work on. However, we investigated similar flows and determined they were overly complicated for our use cases and did not bring value. For example, the flow requires an authentication server, which would necessitate a discovery protocol to associate it with a DSP provider. Such a flow would also mandate the correlation of a VP submitted to the auth server and the DSP endpoint that provides access to a data resource. This requires more specialized service infrastructure and interactions than the DCP design. It also opens a number of additional potential attack vectors.