v0.7.0 (dev)

Upgrading

  • The wia_trust_anchors configuration parameter of all services that issue credentials has been renamed to wptl_trust_anchors. Additionally, the wallet_provider configuration has had parameters added, among which are the Key Attestation private key and certificate. This certificate should validate under one of the wptl_trust_anchors, just like the WIA certificate does. Note that the trust anchor under which these certificates are issued need not be the same for the same Wallet Provider.

  • The PID, as issued by the pid_issuer, was updated to match the EUDI PID Rulebook. Some mdoc attribute identifiers now differ from their previous names: birthdate is now birth_date, nationalities is now nationality, and street_address, postal_code, locality, and country are now resident_street, resident_postal_code, resident_city, and resident_country respectively. house_number is included as part of resident_street. place_of_birth is now an object with country and locality properties. The mdoc doctype identifier was changed to match the EUDI PID Rulebook. The attribute age_over_18 has been removed. issuing_country, issuing_authority and sex are added as new attributes. birthdate is now encoded as a full-date (CBOR tag 1004). The issuing_country and issuing_authority must be configured in the PID issuer settings. The NL-specific mdoc attributes bsn and recovery_code have moved to the domestic eu.europa.ec.eudi.pid.nl.1 namespace, as required for attributes not defined in the Rulebook. The pid_attributes paths in the wallet configuration and any Relying Party requests or registration certificates for these attributes must be updated accordingly.

  • As part of OpenID4VCI Key Attestations, the Wallet Provider now serves a Status List Token for its Key Storage. In order to facilitate this, it has had the following parameters added to its configuration:

    • The main section of the configuration has a public_url parameter, which should contain the URL at which the Wallet Provider is publicly reachable.

    • The key_storage_status_list section has the combination of key_identifier and key_certificate, where the latter should contain the public key corresponding to the private in the HSM to which the former parameter points.

    • Also present in the key_storage_status_list are the optional expiry_in_hours and tracking_validity_in_days parameters, both of which dictate expiration periods as included in the Key Storage Status List Token.

  • The wallet_client_ids setting has been removed from the verification server configuration. It was used to verify the issuer of the Proof of Association (PoA), which has been removed.

New features

  • Issuers have a new optional setting credential_preview_endpoint (default true). When set to false, the issuer does not serve the non-standard Credential Preview Endpoint, behaving like a standard OpenID4VCI issuer. This is intended for testing the wallet against such issuers; note that the wallet still requires previews for PID and disclosure based issuance.

  • Wallet supports X509 certificates with ES384 and RSA (min 2048) keys.

Interoperability improvements

  • The attestation proof type has been implemented according to OpenID4VCI, HAIP and TS3. Both the Issuer and the WSCD have switched to this proof type instead of jwt. NB: The jwt proof type has not yet been updated to conform to OpenID4VCI 1.0 and its implementation is now effectively dead code.

  • The wallet now also accepts a registration certificate in JWT format that is included in verifier_info or issuer_info as a compact JWT, without the additional base64url encoding required by ETSI TS 119 472-2.

  • The PID, as issued by the pid_issuer, was updated to match the EUDI PID Rulebook. Note that portrait, even though being mandatory, is not included at all because the BRP does not provide it. place_of_birth is also not marked as mandatory because our implementation cannot handle that yet.

  • The JPEG 2000 image format, which may be included in the mDL, is now supported.

Bug fixes

  • The wallet accepts wallet configurations fetched from the configuration server again. Since v0.6.0, it required the typ header of the configuration JWT to be exactly JWT, while the configuration is signed with jwt. The typ header of all JWTs is now compared case-insensitively, as required by RFC 7515.

  • The wallet now only stores the ETag of a wallet configuration after accepting it. Previously, a rejected configuration was considered unmodified on every subsequent fetch, so it was never evaluated again.