Verifiable Credential Data Integrity (and vc-di-eddsa and vc-di-ecdsa) 2023-05-27 -> 2023-07-31

[msporny]

• Name of specs to be reviewed:

  • Verifiable Credential Data Integrity
  • EdDSA Cryptosuite v2022
  • ECDSA Cryptosuite v2019

• URL of specs:

  • Verifiable Credential Data Integrity
  • EdDSA Cryptosuite v2022
  • ECDSA Cryptosuite v2019

• What and when is your next expected transition?

  • Transition to Candidate Recommendation in September 2023 (at W3C TPAC)

• What has changed since any previous review?

  • There has bee no previous review of these specifications

• Please point to the results of your own self-review (see https://w3c.github.io/apa/fast/checklist.html)

  • Security and Privacy Self-Review Questionnaire  vc-data-integrity#98

• Where and how to file issues arising?

  • https://github.com/w3c/vc-data-integrity/issues

• Pointer to any explainer for the spec?

  • https://www.w3.org/TR/vc-data-integrity/#introduction

Other comments:

The three specifications listed above are cryptographic message securing mechanisms and are intended to be reviewed together. The first specification, Verifiable Credential Data Integrity, is the base specification that defines the base concepts and algorithms. The "EdDSA Cryptosuite" and "ECDSA Cryptosuite" specifications are concrete implementations of the base specification and each define specific cryptographic algorithms and processes to be used when providing data integrity protection for Verifiable Credentials.

When reviewing the Security and Privacy considerations, it is important to first be aware of the Security and Privacy Considerations for Verifiable Credentials:

• Verifiable Credential Security Considerations
• Verifiable Credential Privacy Considerations

and then consider the Security and Privacy considerations provided in the Verifiable Credential Data Integrity specification:

• Verifiable Credential Data Integrity Security Considerations
• Verifiable Credential Data Integrity Privacy Considerations

and then finally consider the Security and Privacy considerations for each cryptography suite.

[verocri]

We're working on it with @simoneonofri @innotommy @Sh-Amir

[simoneonofri]

Review completed, thanks to all the reviewers and to the group for collaboration. We can now work on the different issues

[Sh-Amir]

I have added my concerns as two additional issues on the topic. Sorry for the last-minute review :)