[media-types] Re: [IANA #1421573] application/vc+sd-jw t registration request

Apologies for the delay.  I've caught up on the thread for this one and its
companion and this one's approved.

-MSK

On Wed, Dec 10, 2025 at 2:57 PM Amanda Baber via RT <
[email protected]> wrote:

> Hi Murray,
>
> Sending a reminder for this one from October 1st. Mike Jones sent a
> response on behalf of W3C asking that the registration be approved as-is.
> See below for more.
>
> thanks,
> Amanda
>
> On Wed Oct 01 08:05:36 2025, [email protected] wrote:
> > Hi Murray,
> >
> > Sorry this slipped through the cracks.  Responses to your questions
> > and observations are inline below, prefixed by “Mike>”.
> >
> > I will note that the text requesting the registration is in a W3C
> > Recommendation (a final specification) https://www.w3.org/TR/vc-jose-
> > cose/ and so not subject to modification.  Therefore, I would request
> > that the registration be approved based on the existing specification
> > text.
> >
> > Thank you,
> > -- Mike
> >
> > From: Murray S. Kucherawy <[email protected]>
> > Sent: Wednesday, July 23, 2025 10:27 AM
> > To: [email protected]
> > Cc: [email protected]
> > Subject: [media-types] Re: [IANA #1421573] application/vc+sd-jwt
> > registration request
> >
> > Sorry for the delay here.  A few minor things, otherwise this should
> > be good to go.
> >
> > -MSK
> >
> > On Tue, Jun 24, 2025 at 9:10 PM Amanda Baber via RT <iana-mime-
> > [email protected]<mailto:[email protected]>> wrote:
> > Name: Ivan Herman
> >
> > Email: [email protected]<mailto:[email protected]>
> >
> > These aren't part of the template in RFC 6838.
> >
> > Media type name: application
> >
> > Media subtype name: vc+sd-jwt
> >
> > Required parameters: N/A
> >
> > Optional parameters: N/A
> >
> > Encoding considerations: binary
> >
> > application/sd-jwt values are a series of base64url-encoded values
> > (some of which may be the empty string) separated by period ('.') and
> > tilde ('~') characters.
> >
> > This seems out of place; it should be included in the referenced
> > published specification.
> >
> > Mike> In fact, this text is included in the referenced published
> > Mike> specification at https://www.w3.org/TR/vc-jose-cose/#vc-json-jwt.
> > Mike> I’ll also note that other similar media type registrations, such
> > Mike> as application/jwt at https://www.iana.org/assignments/media-
> > Mike> types/application/jwt also includes include similar encoding
> > Mike> considerations language.
> >
> > Security considerations: As defined in https://www.w3.org/TR/vc-jose-
> > cose/#security-considerations. See also the security considerations in
> > Selective Disclosure for JWTs (SD-JWT)
> > (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-
> > disclosure-jwt).
> >
> > Do either of those talk about whether the payload of this media type
> > contains executable code?  RFC 6838 Section 4.6 requires that to be
> > covered explicitly one way or the other, and after a cursory read of
> > those, I didn't see it either.  Happy to be corrected if I missed
> > something.
> >
> > Mike> The encoding considerations make it clear that these data
> > Mike> structures are strings of URL-safe ASCII characters.  These are
> > Mike> not executable.
> >
> > Interoperability considerations: As defined in
> > https://www.w3.org/TR/vc-jose-cose/#conformance.
> >
> > Published specification: https://www.w3.org/TR/vc-jose-cose
> >
> > Applications which use this media: W3C Verifiable Credential issuer,
> > holder, and verifier software, conforming to the [VC-DATA-MODEL-2.0]
> > (https://www.w3.org/TR/vc-data-model-2.0/), are among the applications
> > that will use the media types. Conforming application types are
> > described in https://www.w3.org/TR/vc-jose-cose/#conformance and
> > https://www.w3.org/TR/vc-data-model-2.0/#conformance.
> >
> > Fragment identifier considerations: N/A
> >
> > Restrictions on usage: N/A
> >
> > Provisional registration? (standards tree only): No
> >
> > Additional information:
> >
> > 1. Deprecated alias names for this type: N/A
> > 2. Magic number(s): N/A
> > 3. File extension(s): N/A
> > 4. Macintosh file type code: N/A
> > 5. Object Identifiers: N/A
> >
> > Person to contact for further information:
> >
> > 1. Name: Ivan Herman
> > 2. Email: [email protected]<mailto:[email protected]>
> >
> > Intended usage: COMMON
> >
> > Author/Change controller: W3C Verifiable Credentials Working Group
> > [email protected]<mailto:[email protected]>
> >
> > -MSK
>

_______________________________________________
media-types mailing list -- [email protected]
To unsubscribe send an email to [email protected]