Outdated context

[koptan]

Hi,

Let's assume I made my own JSON-LD schema and then hosted it under some public URL, then I start using that URL as a context to issue VC and VP.

Then for some reason, the URL is not valid anymore (Down or URL changed), in that case, what will happen to the old VCs that were generated with the old URL, still being able to be verified? or the old URL should be active and running to get the VCs verified?

[mirceanis]

The context must be available somehow to the verifier to be able to perform the verification.
Relying on a server to serve the context file for every verification is a big problem for JSON-LD. First of all because of what you describe, when the server goes down for whatever reason.
The second problem is that it can be used for tracking. If an issuer generates unique context URLs for every credential they issue, they can then listen to download requests and figure out when a credential is being verified and by which IP. I'm not aware of anyone doing this, but it is possible.

Another problem is that these context URLs are not mandated to resolve to a machine readable file, which makes things even more annoying for developers.. (Lots of credentials use https://schema.org as a context entry, even though that URL does not resolve to a JSON context file).

</rant>

To overcome these issues, the JSON-LD bunch recommend that the context files be cached, or pre-loaded instead of downloaded from the URL. For the pre-loading workaround, this means that verifiers kinda need to know in advance what kinds of credentials they need to verify, or what kinds of DIDs and crypto suites they will accept.
Caching still requires the contexts to be available from time to time.

[koptan]

Thanks, @mirceanis, I did the following test:

Initially, I used some URLs to generate the proof for VC. then after that I modified my VC by removing the old URL, and using a new URL: https://www.w3.org/2018/credentials/v1 then I tried to verify the VC and I found it was working and verified.

Do you know if this behavior is correct?

And will changing the context URLs affect the verification process?

[mirceanis]

Veramo automatically adds the default credential context, so if you changed the URL to the default one (meaning that the only remaining context was the default one), this means that your credential did not need the additional context to begin with. This is all speculation, of course, until you share some examples.

The general idea remains: every property of the credential must be defined in one of the context entries.

[koptan]

I am not using Veramo. Sorry for confusing you, I made my own implementation for VC verification.

I am asking a general question about how the JSON-LD normalizing process and "urdna2015" Alogo is working and how this process is going to impact the verification process.

So to summarize what I understand from you:

• If we have an outdated URL the normalization is not going to work.
• We can replace the URL with a new one if it has the same schema.
• URLs inside the context are not part of the integrity check so we can replace it and verification will keep working.

Please correct me if there is a wrong understanding from my side.

Thanks.