From 6a3a927526b2b07948d41577c1a92c58d78d8ca1 Mon Sep 17 00:00:00 2001
From: "David I. Lehn" Getting Started
the `credentialSubject` object expresses a particular attribute of the
credential subject. Once a developer has added a number of these property-value
combinations, the modified object can be sent to verifiable credential
-issuer sofware and a verifiable credential will be created for the
+issuer software and a verifiable credential will be created for the
developer. From a prototyping standpoint, that is all a developer needs to do.
@@ -2354,7 +2354,7 @@
There MUST NOT be more than one object in the relatedResource
per
id
.
-Yes. Verifiable Claims contain a random though potentially persistent identifier of the subject. This is passed between the issuer and the inspector. Consequently collusion between them could identify the subject to the inspector, even though the Verifiable Claim itself does not. This is because in many cases the issuer will know the complete identity of the subject, even if the Verifiable Claim only contains a small proportion of it (such as age). +Yes. Verifiable Claims contain a random though potentially persistent identifier (PId) of the subject. This is passed between the issuer and the inspector. Consequently collusion between them could identify the subject to the inspector, even though the Verifiable Claim itself does not. This is because in many cases the issuer will know the complete identity of the subject, even if the Verifiable Claim only contains a small proportion of it (such as age).
Recommendation: The subject should limit the distribution of Verifiable Claims containing the same PId to a minimal number of origins. The subject should obtain Verifiable Claims with different PId to send to different origins wherever possible. @@ -260,7 +260,7 @@
-The overall life cycle of Verifiable Claims envisages that they are stored persistently on the user’s local device or on a remote device under the user’s control. However, Verifiable Claims on their own, if captured by a hostile entity, should not be of any value to it, except in so far as the Verifiable Claim may potentially reveal a small amount of Personally Identifiable Information (PII). about the subject. +The overall life cycle of Verifiable Claims envisages that they are stored persistently on the user’s local device or on a remote device under the user’s control. However, Verifiable Claims on their own, if captured by a hostile entity, should not be of any value to it, except in so far as the Verifiable Claim may potentially reveal a small amount of Personally Identifiable Information (PII) about the subject.
Recommendation: Verifiable Claims should be encrypted during storage to prevent them being stolen by an attacker