Detailed status assertions

draft-demarco-oauth-status-assertions.md

@@ -676,6 +676,125 @@ may not always coincide with the actual usability of a Digital Credential,
 allowing Verifiers to examine and make educated conclusions based on a
 variety of scenarios.
 
+# Complex Status Assertions
+
+Status assertions can be complex, and are not limited to simple boolean information.
+This enables verifier policies to be conditioned on the presence of secured information, instead of the absence of information.
+This section proposes syntax to support complex assertions.
+The `validity` claim MUST be present and be either `true` or `false`.
+The `validity_reasons` claim MAY be present and if present MUST be an object.
+The semantics of the claims within the `validity_reasons` object are determined by the issuer.
+
+An example of a boolean status is:
+
+~~~
+{
+    "alg": "ES256",
+    "typ": "status-assertion+jwt",
+    "kid": "w8ZOZRcx21Zpry7H-0VLBsH7Wf7WXb6TeK3qVMCpY44"
+}
+.
+{
+    "iss": "https://issuer.example.org",
+    "iat": 1504699136,
+    "exp": 1504785536,
+    "credential_hash": "xnlAq6Ma8fgu1z4hdGphJnKLulaVHpLCFeZFUGpQ2dA",
+    "credential_hash_alg": "sha-256",
+    "validity": false,
+    "validity_reasons": {
+      "suspended": true,
+    },
+    "cnf": {
+      "jwk": {
+        "kid": "1wL9OG_AZOniODhs2xvMchvFcBWhpQPz3uW29LhqvI0",
+        "alg": "ES256",
+        "kty": "EC",
+        "crv": "P-256",
+        "x": "_2ySUmWFjwmraNlo15r6dIBXerVdy_NpJuwAKJMFdoc",
+        "y": "MV3C88MhhEMba6oyMBWuGeB3dKHP4YADJmGyJwwILsk"
+      }
+    }
+}
+~~~
+
+An example of an enumeration status is:
+
+~~~
+{
+    "alg": "ES256",
+    "typ": "status-assertion+jwt",
+    "kid": "w8ZOZRcx21Zpry7H-0VLBsH7Wf7WXb6TeK3qVMCpY44"
+}
+.
+{
+    "iss": "https://issuer.example.org",
+    "iat": 1504699136,
+    "exp": 1504785536,
+    "credential_hash": "xnlAq6Ma8fgu1z4hdGphJnKLulaVHpLCFeZFUGpQ2dA",
+    "credential_hash_alg": "sha-256",
+    "validity": false,
+    "validity_reasons": {
+      "state": "suspended", // or "revoked"
+    },
+    "cnf": {
+      "jwk": {
+        "kid": "1wL9OG_AZOniODhs2xvMchvFcBWhpQPz3uW29LhqvI0",
+        "alg": "ES256",
+        "kty": "EC",
+        "crv": "P-256",
+        "x": "_2ySUmWFjwmraNlo15r6dIBXerVdy_NpJuwAKJMFdoc",
+        "y": "MV3C88MhhEMba6oyMBWuGeB3dKHP4YADJmGyJwwILsk"
+      }
+    }
+}
+~~~
+
+An example of dynamic status using a small matrix:
+
+~~~
+{
+    "alg": "ES256",
+    "typ": "status-assertion+jwt",
+    "kid": "w8ZOZRcx21Zpry7H-0VLBsH7Wf7WXb6TeK3qVMCpY44"
+}
+.
+{
+    "iss": "https://issuer.example.org",
+    "iat": 1504699136,
+    "exp": 1504785536,
+    "credential_hash": "xnlAq6Ma8fgu1z4hdGphJnKLulaVHpLCFeZFUGpQ2dA",
+    "credential_hash_alg": "sha-256",
+    "validity": true,
+    "validity_reasons": {
+      "preferences": [[1, 0.25, 0.76 ...] ...]
+    },
+    "cnf": {
+      "jwk": {
+        "kid": "1wL9OG_AZOniODhs2xvMchvFcBWhpQPz3uW29LhqvI0",
+        "alg": "ES256",
+        "kty": "EC",
+        "crv": "P-256",
+        "x": "_2ySUmWFjwmraNlo15r6dIBXerVdy_NpJuwAKJMFdoc",
+        "y": "MV3C88MhhEMba6oyMBWuGeB3dKHP4YADJmGyJwwILsk"
+      }
+    }
+}
+~~~
+
+An example of multiple assertions:
+
+~~~
+HTTP/1.1 200 Created
+Content-Type: application/json
+
+{
+    "status_assertion_responses": [
+      $JWT_1, // Not revoked, boolean assertion
+      $JWT_2, // alg = none, suspended indicator
+      $JWT_3, // Preferences matrix assertion
+    ]
+}
+~~~
 
 # Security Considerations
 
@@ -782,6 +901,13 @@ Status Assertions are based on a privacy-by-design approach, reflecting
 a deliberate effort to balance security and privacy needs in the
 Digital Credential ecosystem.
 
+## Validity Reasons
+
+Status assertions can reveal information about the holder or subject that was not commited to in the original credential issuance.
+Providing a reason that a digital credential is no longer valid can be essential to certian use cases, and unacceptable for others.
+For example, in a healthcare setting, a patient should not have medical reasons for a suspended credential disclosed in assertions of suspension.
+However, in a supply chain context, a product suspension might benefit from additional information, such as batch or lot information.
+
 # IANA Considerations
 
 ## JSON Web Token Claims Registration