Is at least one of exp & status required?

[jogu]

Spec now says:

• It is at the discretion of the Issuer whether to use exp claim and/or a status claim to express the validity period of an SD-JWT VC.

You can read this as "at least one of exp and status MUST be present", but you can also read it as "the issuer might decide to omit both exp and status". I'm not sure which is meant, but I think it would be good to have a clearer wording.

---

I'd tend to agree, I think in particular that MUST is not covered elsewhere.

I am not sure if the current language means "issuer can choose to use neither exp nor status" or if it means "issuer has to use at least one of exp & status"? That might be best handled in a new issue though.

Originally posted by @jogu in #165 (comment)

[paulbastian]

I think it's a good idea to include some form of expiration. Credentials that are valid forever seem unnecessary and dangerous.

[tlodderstedt]

There are credentials in the physical world that do not expire, such birth certs or diplomas. What would that mean for such credentials?

[jogu]

Discussion on this morning's WG call: There are credentials where the issuer might want to exclude both fields. Some/many credentials will have expiries anyway due to the related x509 certificates expiring. We might want to consider recommending it as many common credentials should have a defined lifetime.