9 docs tagged with "Concept"

Explanation-oriented content that builds understanding of how something works and why.

Accessibility Design Guidelines

When designing solutions for the EUDI Wallet Ecosystem, both Relying Parties (RPs) and European Accessibility Act. Providers must consider accessibility requirements that ensure their services are usable by all citizens, including those with disabilities. This document outlines the high-level accessibility frameworks and key considerations for designing accessible solutions.

Binding Mechanisms

OpenID4VP gives Relying Parties several mechanisms for checking different types of binding. Which of them work for a given credential depends on the features the issuer provided at issuance time and the relying parties use case:

Claim Binding

Claim binding lets a Relying Party check that the presenter still controls a specific piece of identifying data you bound to the credential at issuance, by comparing a claim you copied into the credential against a fresh presentation of the credential you originally drew it from. A vehicle registration credential can carry the vehicle identification number copied from the vehicle's own registration document; a professional credential can carry the holder's name copied from the identity document used to identify them. Checking the copied claim against a fresh presentation of the original tells the Relying Party that the presenter genuinely still controls the identity or object the claim represents, not merely that they hold a copy of your credential.

client_id, nonce and state

Three request parameters recur throughout the binding guarantees: client_id, nonce, and state. The table

Credentials

An EUDI Wallet credential is a digitally issued, verifiable statement of fact about a person — such

Key Binding

Key binding - also known as device binding - lets a Relying Party check that the entity presenting your credential is the same entity you issued it to, by requiring that entity to prove control of a device-bound key you bound to the credential at issuance. Without it, a Relying Party can only confirm that a credential is authentic: signed data can be copied exactly, out of a backup, off a compromised device, or out of a badly secured log, without invalidating your signature.