CACAO Delegation Holder Binding Method 2022

Data Model

The following sections outlines the data model for this document.

CacaoDelegationHolderBinding2022

When a holder desires to indicate Holder Binding based on a CACAO delegation, they MUST add a holderBinding property to a W3C Verifiable Presentation (VP) that uses the data model described in this specification.

Property	Description
type	The `type` property MUST be `CacaoDelegationHolderBinding2022`.
cacaoDelegation	The `cacaoDelegation` property MUST be a URI. If it is a URI, it is expected that resolution of the URI results in a CACAO serialized as base64url-encoded CARv1 which describes the delegation between the holder and the original subject of the verifiable credentials.

If desired, it is expected that implementers would use the data URI scheme to include the content of the IPLD object directly in the cacaoDelegation property.

               {
                  "holder": "did:key:1234:...",
                  "holderBinding": {
                     "type": "CacaoDelegationHolderBinding2022",
                     // CACAO serialized as base64url-encoded CARv1
                     "cacaoDelegation": "data:;base64,uOqJlcm9vdHOB2CpY..."
                  },
                  "verifiableCredentials": [
                     {
                        // verifiable credential in JSON-LD form
                        // with Data Integrity Proof
                     }
                  ]
                  ...
                  "proof": {
                     "verificationMethod": "did:key:1234#key-1",
                     "type": "Ed25519Signature2018",
                     "jws": "...", ...
                  }
               }

            {
               "holder": "did:key:1234:...",
               "holderBinding": {
                  "type": "CacaoDelegationHolderBinding2022",
                  // CID
                  "cacaoDelegation": "ipfs://bafybeigdyr..."
               },
               "verifiableCredentials": [
                  {
                     // verifiable credential in JSON-LD form
                     // with Data Integrity Proof
                  }
               ]
               ...
               "proof": {
                  "verificationMethod": "did:key:1234#key-1",
                  "type": "Ed25519Signature2018",
                  "jws": "...", ...
               }
            }

Algorithms

The following section outlines the algorithms that are used to generate and validate Holder Binding as described by this document.

Generate Algorithm

The following process, or one generating the exact output, MUST be followed when generating a holderBinding property conformant with this specification.

Let holderBinding be the resulting Object that represents the Holder Binding in the verifiable presentation.
Let verifiableCredentials be the verifiable credentials that are included in the verifialbe presentation which the holder wishes to bind to the verifiable presentation.
Let capabilities be an array of CapGrok that has a targeted action present for each bound verifiable credential using the urn:capability:credentials: namespace. The resource of the targeted action is either the verifiable credential id property, or more generally the fully-qualified verifiable credential type property prepended by the string type:.
Apply the CapGrok algorithm on capabilities to produce a deterministic human-readable statement. Let statement be the resulting statement.
Let payload be an IPLD Object which contains the holder as the aud property and the subject of the verifiable credentials as the iss property.
Include the capabilities in the resources property and statement in the statement property in the payload.
Sign and pack the CACAO and let cacaoDelegation be the serialized base64url-encoded CARv1 containing the CACAO.
Inlcude a type property in the holderBinding Object with the value set to CacaoDelegationHolderBinding2022.
Include the cacaoDelegation property in the holderBinding Object. property.

Validate Algorithm

The following process, or one generating the exact output, MUST be followed when validating a verifiable presentation:

Let verifiableCredentials be the (sub-)set of verifiable credentials in the verifiable presentation the verifier wishes to check the holder binding for.
Let holderBinding be the holderBinding property in the verifiable presentation. If the verifiablePresenation has no holderBinding property, then stop processing, otherwise continue with the next step.
Check if the type in holderBinding equals CacaoDelegationHolderBinding2022. If not, then stop processing, otherwise continue with the next step.
Let cacaoDelegation be the cacaoDelegation property in holderBinding. If there is no such property, then stop processing, otherwise continue with the next step.
Deserialize cacaoDelegation from base64url-encoded CARv1 into a JSON Object and let cacao be the JSON-encoded form of the decoded CACAO.
Verify the signature of cacao according to the CACAO type. If the signature verification failed, stop processing, otherwise continue with the next step.
Let delegator be the iss property in the payload property of cacao and let delegee be the aud property in the payload property of cacao. If these are not present, stop processing, otherwise contineue with the next step.
Check if delegator matches the id property of the credentialSubject properties in the verifiable credentials in verifiableCredentials. If there is no id property in any of the verifiable credentials, stop processing, otherwise continue with the next step.
Check if delegee matches the holder property in the verifiable presentation. If holder is not present, or it doesn't match, stop processing, otherwise continue with the next step.
Let capabilities be the resouces array in the cacao. If not present, stop processing, otherwise continue with the next step.
Let statement be the statement in the cacao. If not present, stop processing, otherwise continue with the next step.
Apply the CapGrok algorithm onto statement and let statementCapGrok be the resulting the statement.
Check if statement in the caaco matches statementCapGrok. If it doesn't match, stop processing, otherwise continue with the next step.
Check if there is at least one CapGrok in capabilities that has an applicable targeted action present for each verifiable credential in verifiableCredentials. A targeted action applies if 1) the resouce of the targeted action matches the id property of the verifiable credential or 2) if any of the fully-qualified array items in type prepended with the String type: in the verifiable credential matches the resource of the targeted action. If there is a verifiable credential that has no applicable targeted action, stop processing, otherwise continue with the next step.
Indicate that the holder binding was successfully validated.

Introduction

Web3 Technology Stack

Terminology

Data Model

CacaoDelegationHolderBinding2022

Algorithms

Generate Algorithm

Validate Algorithm

Privacy Considerations

Security Considerations

Accessibility Considerations

Internationalization Considerations