[media-types] Re: [IANA #1421573] application/vc+sd-jw t registration request

Murray, I’m on a W3C VCWG call now, which made me wonder if you’re ready to approve this registration now.

                                                                Thank you,
                                                                -- Mike

From: Michael Jones
Sent: Wednesday, October 1, 2025 1:05 AM
To: Murray S. Kucherawy <[email protected]>; [email protected]
Cc: [email protected]; Brent Zundel <[email protected]>
Subject: RE: [media-types] Re: [IANA #1421573] application/vc+sd-jwt registration request

Hi Murray,

Sorry this slipped through the cracks.  Responses to your questions and observations are inline below, prefixed by “Mike>”.

I will note that the text requesting the registration is in a W3C Recommendation (a final specification) https://www.w3.org/TR/vc-jose-cose/ and so not subject to modification.  Therefore, I would request that the registration be approved based on the existing specification text.

                                                                Thank you,
                                                                -- Mike

From: Murray S. Kucherawy <[email protected]<mailto:[email protected]>>
Sent: Wednesday, July 23, 2025 10:27 AM
To: [email protected]<mailto:[email protected]>
Cc: [email protected]<mailto:[email protected]>
Subject: [media-types] Re: [IANA #1421573] application/vc+sd-jwt registration request

Sorry for the delay here.  A few minor things, otherwise this should be good to go.

-MSK

On Tue, Jun 24, 2025 at 9:10 PM Amanda Baber via RT <[email protected]<mailto:[email protected]>> wrote:
Name: Ivan Herman

Email: [email protected]<mailto:[email protected]>

These aren't part of the template in RFC 6838.

Media type name: application

Media subtype name: vc+sd-jwt

Required parameters: N/A

Optional parameters: N/A

Encoding considerations: binary

application/sd-jwt values are a series of base64url-encoded values (some of which may be the empty string) separated by period ('.') and tilde ('~') characters.

This seems out of place; it should be included in the referenced published specification.

Mike> In fact, this text is included in the referenced published specification at https://www.w3.org/TR/vc-jose-cose/#vc-json-jwt.  I’ll also note that other similar media type registrations, such as application/jwt at https://www.iana.org/assignments/media-types/application/jwt also includes include similar encoding considerations language.

Security considerations: As defined in https://www.w3.org/TR/vc-jose-cose/#security-considerations. See also the security considerations in Selective Disclosure for JWTs (SD-JWT) (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt).

Do either of those talk about whether the payload of this media type contains executable code?  RFC 6838 Section 4.6 requires that to be covered explicitly one way or the other, and after a cursory read of those, I didn't see it either.  Happy to be corrected if I missed something.

Mike> The encoding considerations make it clear that these data structures are strings of URL-safe ASCII characters.  These are not executable.

Interoperability considerations: As defined in https://www.w3.org/TR/vc-jose-cose/#conformance.

Published specification: https://www.w3.org/TR/vc-jose-cose

Applications which use this media: W3C Verifiable Credential issuer, holder, and verifier software, conforming to the [VC-DATA-MODEL-2.0] (https://www.w3.org/TR/vc-data-model-2.0/), are among the applications that will use the media types. Conforming application types are described in https://www.w3.org/TR/vc-jose-cose/#conformance and https://www.w3.org/TR/vc-data-model-2.0/#conformance.

Fragment identifier considerations: N/A

Restrictions on usage: N/A

Provisional registration? (standards tree only): No

Additional information:

1. Deprecated alias names for this type: N/A
2. Magic number(s): N/A
3. File extension(s): N/A
4. Macintosh file type code: N/A
5. Object Identifiers: N/A

Person to contact for further information:

1. Name: Ivan Herman
2. Email: [email protected]<mailto:[email protected]>

Intended usage: COMMON

Author/Change controller: W3C Verifiable Credentials Working Group [email protected]<mailto:[email protected]>

-MSK

_______________________________________________
media-types mailing list -- [email protected]
To unsubscribe send an email to [email protected]