DCQL

Full Title

Digital Credentials Query Language

Tags / links to resources / technology discussed, related to this session:

Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:

Introduction to DCQL

DCQL became the only query language for OpenID4VP, PE2 got removed to make things simpler, less implementation effort
limited feature set for simplicity
good implementation feedback so far

Purpose

purpose is currently optional freetext field
worries about phishing attacks (not bufferoverflows etc)
purpose in unsigned seems more dangerous
purpose in signed requests makes more sense, could be integrated in RP certificate
- sign over prose? i.e. put it into KB-JWT?
- in transaction_data we show and sign RP-chosen text
increases accountability
18013-5 defining integers/enums/codes for common use cases, e.g. buy alkohol
- codes may be limited and there are more use cases than codes
- codes are better for being language independent
freetext may be harder to display for Wallets, e.g. max length?
user decision may not be significantly influenced by the purpose string
- purpose may give guidance why certain credentials are requested
unclear if purpose was a requirement by ISO group
rough consensus to remove it, Brian will do a PR

Advanced Features

currently we only have exact value matching
is there a need for functions, e.g. greater-than, array membership etc..
- e.g. matching if nationality is within array
Dimitri: operators look very similar to JSON Schema
- current ideas are based on Daniel Fett’s draft
things will be added to OpenID4VP 1.1, as 1.0 ship is sailing in the next days
we should be careful to not add too many features, as the niceness of DCQL is its consensus feature set and still easy-to-implement
David: matching attribute values across multiple credentials is an important feature
- Gareth: matching names does not work very well in practice
Ahbi + Matteo: strong typing is required for ZKP features
- problem that we have multiple credential formats with different typing
- Hicham: be aware that we potentially add lots of complexity
- Paul + Lee: Basic Value matching is important and may add privacy
Helen: Array matching seems the most important use case