From e3fef8e6b9ecf72dfe644b009353a0911b7f4f58 Mon Sep 17 00:00:00 2001 From: Manu Sporny Date: Sat, 26 Aug 2023 15:05:16 -0400 Subject: [PATCH 1/5] Add revoked and expires properties to JsonWebKey context. --- contexts/jwk/v1 | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/contexts/jwk/v1 b/contexts/jwk/v1 index fdc284ab..93d8d0c4 100644 --- a/contexts/jwk/v1 +++ b/contexts/jwk/v1 @@ -13,6 +13,14 @@ "@id": "https://w3id.org/security#controller", "@type": "@id" }, + "revoked": { + "@id": "https://w3id.org/security#revoked", + "@type": "http://www.w3.org/2001/XMLSchema#dateTime" + }, + "expires": { + "@id": "https://w3id.org/security#expiration", + "@type": "http://www.w3.org/2001/XMLSchema#dateTime" + }, "publicKeyJwk": { "@id": "https://w3id.org/security#publicKeyJwk", "@type": "@json" From aded2d69a9c89596f265bcec2aba7f2f47217f20 Mon Sep 17 00:00:00 2001 From: Manu Sporny Date: Sat, 26 Aug 2023 15:19:40 -0400 Subject: [PATCH 2/5] Add `expires` property to verification method properties list. --- index.html | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/index.html b/index.html index cb6d1923..9f7f0b3d 100644 --- a/index.html +++ b/index.html @@ -995,14 +995,29 @@

Verification Methods

The value of the `controller` property MUST be a string that conforms to the [[URL]] syntax. +
+
expires
+
+The `expires` property is OPTIONAL. It is set, in advance, by the +controller of a verification method to signal when that method +can no longer be used for verification purposes. If provided, it MUST be an +[[XMLSCHEMA11-2]] `dateTimeStamp` string specifying when the +verification method SHOULD cease to be used. Once the value is set, it is +not expected to be updated, and systems depending on the value are expected to +not verify any proofs associated with the verification method at or after +the time of expiration.
revoked
-The `revoked` property is OPTIONAL. If provided, it MUST be an [[XMLSCHEMA11-2]] +The `revoked` property is OPTIONAL. It is set by the controller of a +verification method to signal when that method is to no longer to be used +for verification purposes, such as after a security compromise of the +verification method. If provided, it MUST be an [[XMLSCHEMA11-2]] `dateTimeStamp` string specifying when the verification method -SHOULD cease to be used. Once the value is set, it is not expected to be updated, and -systems depending on the value are expected to not verify any proofs associated -with the verification method at or after the time of revocation. +SHOULD cease to be used. Once the value is set, it is not expected to be +updated, and systems depending on the value are expected to not verify any +proofs associated with the verification method at or after the time of +revocation.
From 2d1726e6b45e41ef321bfba7621abc641159b21e Mon Sep 17 00:00:00 2001 From: Manu Sporny Date: Sat, 26 Aug 2023 15:39:15 -0400 Subject: [PATCH 3/5] Re-anchor definition for expires (on proof and verification method). --- index.html | 16 +++++++++------- vocab/security/vocabulary.yml | 8 +++++--- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/index.html b/index.html index 9f7f0b3d..0e70bc55 100644 --- a/index.html +++ b/index.html @@ -614,10 +614,11 @@

Proofs

specified as an [[XMLSCHEMA11-2]] `dateTimeStamp` string. -
expires
+
expires
-An OPTIONAL property that conveys the date and time that a proof expires and that, if present, MUST be -specified as an [[XMLSCHEMA11-2]] `dateTimeStamp` string. +An OPTIONAL property that conveys the date and time that a proof expires and +that, if present, MUST be specified as an [[XMLSCHEMA11-2]] combined date and +time string.
domain
@@ -996,7 +997,7 @@

Verification Methods

The value of the `controller` property MUST be a string that conforms to the [[URL]] syntax. -
expires
+
expires
The `expires` property is OPTIONAL. It is set, in advance, by the controller of a verification method to signal when that method @@ -1925,8 +1926,8 @@

Relationship to Verifiable Credentials

Document authors and implementers are advised to understand the difference between the validity period of a proof, which is expressed using the `created` and `expires` properties, and the validity period of a -credential, +href="#defn-proof-expires">`expires` properties, and the validity period of +a credential, which is expressed using the `validFrom` and `validUntil` properties. @@ -1935,7 +1936,8 @@

Relationship to Verifiable Credentials

proof, it is important to ensure that the time of interest (which might be the current time or any other time) is within the validity period for the proof (that is, between -`created` and `expires` ). +`created` and +`expires` ). When validating a verifiable credential, it is important to ensure that the time of interest is within the validity period for the diff --git a/vocab/security/vocabulary.yml b/vocab/security/vocabulary.yml index dc490541..1f817c2d 100644 --- a/vocab/security/vocabulary.yml +++ b/vocab/security/vocabulary.yml @@ -207,9 +207,11 @@ property: range: xsd:dateTime - id: expires - label: Proof expiration time - defined_by: https://www.w3.org/TR/vc-data-integrity/#dfn-expires - domain: sec:Proof + label: Expiration time for a proof or verification method + defined_by: https://www.w3.org/TR/vc-data-integrity/#defn-proof-expires + domain: + - sec:Proof + - sec:VerificationMethod range: xsd:dateTime - id: nonce From b298c4953928fd59b0d01ff5e8f2b522a2d87523 Mon Sep 17 00:00:00 2001 From: Manu Sporny Date: Sat, 2 Sep 2023 10:24:00 -0400 Subject: [PATCH 4/5] Simplify grammar for `expires` property. Co-authored-by: Ted Thibodeau Jr --- index.html | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/index.html b/index.html index 0e70bc55..2fa7d5c3 100644 --- a/index.html +++ b/index.html @@ -616,9 +616,8 @@

Proofs

expires
-An OPTIONAL property that conveys the date and time that a proof expires and -that, if present, MUST be specified as an [[XMLSCHEMA11-2]] combined date and -time string. +The `expires` property is OPTIONAL. If present, it MUST be an [[XMLSCHEMA11-2]] +`dateTimeStamp` string specifying when the proof expires.
domain
From c4aede2d1851454a91856b1ee8f17d22d683d353 Mon Sep 17 00:00:00 2001 From: Manu Sporny Date: Sat, 2 Sep 2023 10:56:59 -0400 Subject: [PATCH 5/5] Clarify VM revocation/expiration vs. VC revocation. --- index.html | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/index.html b/index.html index 2fa7d5c3..6e94da91 100644 --- a/index.html +++ b/index.html @@ -1949,6 +1949,23 @@

Relationship to Verifiable Credentials

credential, might result in accepting data that ought to have been rejected.

+ +

+Finally, implementers are also urged to understand that there is a difference +between the revocation time and +expiration time for a verification method, +and the revocation information associated with a verifiable credential. +The revocation time and +expiration time for a verification method +are expressed using the `revocation` and `expires` properties, respectively, and +are related to events such as a private key being compromised or expiring and +can provide timing information which might reveal details about a controller +such as their security practices or when they might have been compromised. The +revocation information for a verifiable credential is expressed using +the `credentialStatus` property and is related to events such as an individual +losing the privilege that is granted by the verifiable credential and +does not provide timing information, which enhances privacy. +