-When including a link to an external resource in a [=verifiable credential=], it -is desirable to know whether the resource has been modified after the -[=verifiable credential=] was issued. This applies to cases where there is an -external resource that is remotely retrieved, as well as to cases where the -[=issuer=] and/or [=verifier=] might have local cached copies of a resource. It -is also desirable to know that the contents of the JSON-LD context(s) used in -the [=verifiable credential=] are the same when used by both the [=issuer=] and -[=verifier=]. +When including a link to an external resource in a [=verifiable credential=], +it is desirable to know whether the resource that is pointed to is the same at +signing time as it is at verification time. This applies to cases where there is +an external resource that is remotely retrieved as well as to cases where the +[=issuer=] and/or [=verifier=] may have local cached copies of a resource. +
++It is also desirable to know that the contents of the JSON-LD context(s) used in +the [=verifiable credential=] are the same when used by both the +[=issuer=] and [=verifier=]. +
+
+To validate that a resource referenced by a [=verifiable credential=] is the
+same at verification time as it is at issuing time, an implementer MAY include a
+property named relatedResource that
+stores an array of objects that describe additional integrity metadata about
+each resource referenced by the [=verifiable credential=]. If
+`relatedResource` is present, there MUST be an object in the array
+for each remote resource for each context used in the verifiable credential.
The requirement that contexts be listed in `relatedResource` is currently being debated in the VCWG. This requirement might be removed in future iterations of the specification.
-
-To extend integrity protection to a related resource, an [=issuer=] of a
-[=verifiable credential=] MAY include the `relatedResource` property:
+Each object in the `relatedResource` array MUST contain the
+following: the [[URL]] to the resource named `id` and the
+digestSRI information for the resource
+constructed using the method specified in
+Subresource Integrity.
| Property | -Description | - - -
|---|---|
| `id` | --The identifier for the resource is REQUIRED and conforms to the format defined -in Section [[[#identifiers]]]. The value MUST be unique among the list of -related resource objects. - | -
| `mediaType` | --An OPTIONAL valid media type as listed in the - -IANA Media Types registry. - | -
| `digestSRI` | --A cryptographic digest, as defined in [[[SRI]]]. - | -
| `digestMultibase` | --A cryptographic digest, as defined in [[[VC-DATA-INTEGRITY]]]. - | -
The Working Group is currently attempting to determine whether cryptographic hash expression formats can be unified across all of the VCWG core specifications. Candidates for this mechanism include `digestSRI` and `digestMultibase`. There are arguments for and against unification that the WG is currently debating.
--If a `mediaType` is listed, implementations that retrieve the resource -using [[[?RFC9110]]] SHOULD: +There MUST NOT be more than one object in the `relatedResource` per +`id`. +
++An object in the `relatedResource` array MAY contain a property named +`mediaType` that indicates the expected media type for the indicated +`resource`. If a `mediaType` is included, its value +SHOULD:
-Any object in the [=verifiable credential=] that contains an `id` +Any object in the [=verifiable credential=] that contains an `id` [[URL]] property MAY be annotated with integrity information as specified in this -section. +section by inclusion of `digestSRI` +in the object.
--Any objects for which selective disclosure or unlinkable disclosure is desired -SHOULD NOT be included as an object in the `relatedResource` array. +Any objects for which selective disclosure is desired SHOULD NOT be included as +an object in the `relatedResource` array.
-Specification authors that write algorithms that fetch a resource based on the `id` of an object inside a [=conforming document=] need to consider whether that resource's content is vital to the validity of that document. If it is, the -specification MUST produce a validation error unless the resource matches the -expected media type and cryptographic digest. +specification MUST produce a validation error unless the resource has the +expected media type and its bytes hash to the expected digest.
Implementers are urged to consult appropriate sources, such as the @@ -3201,7 +3176,7 @@
An example of a related resource integrity object referencing JSON-LD contexts.
+ title="Usage of the relatedResource property">
"relatedResource": [{
"id": "https://www.w3.org/ns/credentials/v2",
"digestSRI":
@@ -3242,8 +3216,9 @@ Integrity of Related Resources
"id": "did:example:ebfeb1f712ebc6f1c276e12ec21",
"image": {
"id": "https://university.example.org/images/58473",
+ "digestSRI":
+ "sha384-ZfAwuJmMgoX3s86L7x9XSPi3AEbiz6S/5SyGHJPCxWHs5NEth/c5S9QoS1zZft+J",
"mediaType": "application/svg+xml",
- "digestMultibase": "zQmdfTbBqBPQ7VNxZEYEj14VmRuZBkqFbiwReogJgS1zR1n"
},
...
}