Definition of credential_definition on OID4VCI section E.1.3.3 seems to be missing the inclusion of credentialSubject

[Pedro Felix]

The definition of credential_definition on OID4VCI section E.1.3.3 seems to be missing the inclusion of credentialSubject. Note that the non-normative example on OID4VCI section E.1.3.4 includes a credentialSubject inside credential_definition and it points to OID4VCI section E.1.3.3 as the source for its definition.

‌

‌

[Kristina Yasuda]

Hi, credentialSubject is not missing in the Credential Offer. If you look at the Credential Offer of other Credential Format Profiles, none of them pass credentialSubject parameter. this is because Credential Offer is a mere Offer from the Issuer that the Wallet may or may not accept it. credentialSubject is used by the Wallet to tell the issuer which of the claims in that the Issuer can offer for that Credential, the Wallet is actually interested in receiving (data minimization)

Moreover, as described in section 11.2,

The Wallet MUST consider the parameter values in the Credential Offer as not trustworthy since the origin is not authenticated and the message integrity is not protected

‌

[Kristina Yasuda]

I added the text in this PR to clarify because the same question has been asked in the issue #1875 too.

[Kristina Yasuda]

PR merged