Skip to content

delegation::verify_chain takes no presenter, so a VDC is still a bearer credential #23

Description

@stormer78

#21 made the VAC non-bearer: authority::verify_chain now requires the leaf to grant to the
presenter. The VDC has the same rule, normatively, in merged Working Draft 02 — and this
library does not implement it.

The gap

spec/body.md Invocation Binding:

A VDC is not a bearer token. A verifier MUST NOT accept a party as acting in the
delegator's name unless that party demonstrates control of the verification method
associated with credentialSubject.id at the time of the request. A VDC presented without
such a demonstration is evidence that a delegation exists; it is not evidence that the
party presenting it is the delegate.

delegation::verify_chain has no presenter parameter at all:

pub fn verify_chain(
    chain: &[DTGCredential],
    principal: &str,
    requested_act: &str,
    at: DateTime<Utc>,
) -> Result<VerifiedDelegation, DelegationError>

VerifiedDelegation.delegate is returned, so a caller can compare it — but nothing obliges
them to, and nothing in the signature suggests they must. That is exactly the shape the VAC
was in before #21, where both known consumers independently discovered the omission and
patched around it.

Fix

Mirror #21: add presenter: &str, require chain[0]'s subject to equal it, and refuse with
a NotTheDelegate variant. Only the presented VDC's delegate demonstrates anything — the
parties above it in the chain are not present and are asked for nothing, same as for a VAC,
and for the same reason.

Breaking. Worth pairing with the next VDC change rather than shipping a lone bump.

Why it is filed rather than folded into #21

The VAC change came out of a live conflict over audience
(dtgwg-trust-tasks-tf#414)
that was producing refused presentations in two services. The VDC has no audience and no
consumer hitting it yet, so it is the same class of gap without the same urgency — but the
0.7.0 changelog already claims "a VAC and a VDC are both non-bearer", and that is only half
true until this lands.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions