JSON Web Proof#

Mike Jones, David Waite — JOSE WG document

• Why: The JOSE-side container for credentials using newer selective-disclosure and unlinkability algorithms (BBS-style) — the path beyond JWS/SD-JWT for zero-knowledge-ish verifiable credentials.
• What: JWP: a JWS-like container that integrity-protects multiple payloads in one message, with a presentation form supporting selective disclosure of individual payloads, additional proof computation, and a Presentation Header to prevent replay. JPT (JSON Proof Token) constrains payloads to claims, targeting SD-JWT's problem domains with newer algorithms.
• How: At IETF 124 the work added a "subclaim" syntax — based on CBOR Pointer (no negative array indexing, no indexing into serialized CBOR), chosen over JSON Path, SD-JWT VC metadata paths, and OID4VP's DCQL for remote-safety, simplicity, and CBOR-readiness — so a presentation can disclose just ["address","country"] or an is_over_18 predicate instead of a whole claim. Motivated by common feedback from two independent digital-credential prototypes. Other open items: aligning JWP's algorithm/header registries with JWK/CWK (which don't know about them — possibly by reusing the JWS/COSE algorithm registries), BLS key representation (compressed/ZCash style per IANA early review), and JSON/CBOR example parity that has already uncovered spec bugs.
• Where applicable: Verifiable credentials and digital wallets. WG document in active revision; the subclaim decision is the one to track.