Subject: [Secret] Using "Credential"

From: Jeremie Miller <[email-masked]>
Date: Mon, 4 Apr 2022 13:52:10 -0600

I have a concern about the potential confusion from using the word
credential here and its usage in the Verifiable Credentials space (
https://www.w3.org/TR/vc-data-model/).

If for example s/credential/certificate/ and the title was "Secure
Certificate Transfer" there would be potential confusion around the
relationship to TLS certificates.

There's significant momentum in the OpenID Foundation that is building on
the W3C's VC definition with multiple specs for credential presentation and
issuance already entering implementers drafts, all of which involve
transferring credentials between parties.

While I understand that the generic definition of the word "credential" is
potentially the most ideal one for how this draft/group is using it, I'm
still uncomfortable with the confusion it will cause since this usage is
not adopting any of the other formalized VC terms such as holder, issuer,
presentation, etc.

As for the proposed capabilities of the draft, I also see potential
applicability for its adoption in various VC/OIDC/OAUTH use-cases.  For
example, similar functionality exists in JAR by-reference (
https://www.rfc-editor.org/rfc/rfc9101.html#name-passing-a-request-object-by-)
and more notably in PAR (https://www.rfc-editor.org/rfc/rfc9126.html).

Recent issuance discussions have also started to ask how to handle an
asynchronous flow for which this could be a relevant solution.

Jer