RFC023: X509Credential

rfc/rfc023-x509credential.md

@@ -180,8 +180,17 @@ rules:
 - The credential MUST be in JWT format.
 - `type`: MUST include `VerifiableCredential` and `X509Credential`.
 - `issuer`: MUST be a valid `did:x509` identifier.
-- `credentialSubject`: MUST only contain fields explicitly present in the `did:x509` DID policies with the format <
-  policy_type>:<policy_attribute>, for example `subject:O` or `san:otherName`.
+- `credentialSubject`: MUST only contain fields explicitly present in the `did:x509` DID policies with the fields mapped by each type as a separate map. An example: 
+```
+{
+  "subject": {
+    "O" : "My Organisation"
+  },
+  "san" : {
+    "email" : "[email protected],"
+  }
+}
+```
 
 The credential subject can be identified by any DID method (e.g. `did:web`) accepted by the credential verifier.
 
@@ -283,7 +292,10 @@ validated to ensure the credential is within its valid timeframe.
 
 ## Security Considerations
 
-TODO: Trust, which ca-fingerprint to use, ...
+The following security considerations are to be considered:
+
+- The Root CA of the did:x509 needs to be checked against the root CA structure of the use case. For instance, in case
+  of UZI certificates the ROOT CA must match the associated root CA chain.
 
 ### Certificate Revocation
 
@@ -307,7 +319,9 @@ entity controlling the `did:x509` DID.
 - [DID:X509 Method Specification](https://trustoverip.github.io/tswg-did-x509-method-specification/)
 - [X.509 Certificate Revocation (OCSP/CRL)](https://datatracker.ietf.org/doc/html/rfc5280)
 
-## PKI overheid & UZI certificates
+# An application of the RFC023: UZI server certificates
+
+## PKI overheid & UZI server certificates
 
 The Dutch government has a Public Key Infrastructure (PKI) that is used to establish trust between parties. The PKI
 framework is currently in place and makes use of PKI Overheid Certificates issued by the root CAs of the Dutch
@@ -349,10 +363,13 @@ contains the following information (of intrest):
 
 ## Mapping UZI certificate to X509Credential
 
-### The ROOT Ca
+The mapping of certificates to x509 is depending
+
+### The ROOT G3
 
 The `did:x509` specification dictates that the fingerprint of the Root CA is part of the did:x509. For mapping an UZI
-certificate to an X509Credential the ROOT CA MUST match one of the certificates in the UZI register hierarchy. 
+certificate to an X509Credential the ROOT CA MUST match one of the certificates in the UZI ROOT CA register hierarchy.
+For G3 this is:
 
 ```asciidoc
         ┌────────────────────────────────────┐        
@@ -368,9 +385,10 @@ certificate to an X509Credential the ROOT CA MUST match one of the certificates
     └────────────────────────────────────────────┘    
 ```
 
-### Field mapping
-The following fields are commonly used for mapping UZI cetificates to X509Credentials
-* The `subject:O` the name of the holder of the certificate.
+### Field mapping of the UZI credential
+
+The following fields are commonly used for mapping UZI certificates to X509Credentials
+* The `subject:O` the name of the holder of the certificate. Maps to `subject.O` in the X509Credential.
 * The `subject.L` The subject locality (city)
 * The `san:otherName` a string containing `<OID CA>-<versie-nr>-<UZI-nr>-<pastype>-<Abonnee-nr>-<rol>-<AGB-code>`,
   where:
@@ -382,7 +400,7 @@ The following fields are commonly used for mapping UZI cetificates to X509Creden
   * `<rol>` is the role of the holder of the certificate, always "0.00"
   * `<AGB-code>` is the AGB code of the holder of the certificate.
 
-## The use of UZI server certificate in the Nuts network
+## The use of UZI server certificate in the Nuts network or identifying organizations
 
 The focus on trust in the NUTS network for organizations lies primarily on the URA number identified as the
 `<Abonnee-nr>` on the UZI certificate. This number is used to identify the holder of the certificate within the Dutch