304388 2025-12-17 23:09:13 -0800 Digital Credentials: potentially broken with Annex C and ZKP on Safari 2026-07-20 18:44:26 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED MOVED InRadar P2 Normal --- 268516 1 marcosc marcosc webkit-bug-importer zeuthen oldest_to_newest 2166860 0 marcosc 2025-12-17 23:09:13 -0800 It seems there is something broken with Annex C and ZKP on Safari Quoting the Android Security team "you can repro in iOS by just going to verifier.multipaz.org, select Annex C as protocol, and hit the "Age over 18 (ZKP)" button" 2166861 1 webkit-bug-importer 2025-12-17 23:10:25 -0800 <rdar://problem/166766151> 2166943 2 zeuthen 2025-12-18 06:26:22 -0800 I did some more digging and this is another case of the root problem that if you set DeviceRequest version to 1.1 then Webkit bails unless `useCases` is set. This is a bug in WebKit because there is no requirement for the RP to set `useCases` even if version is set to 1.1 Because ZKP is a v1.1 feature, we set version of DeviceRequest to 1.1 on verifier.multipaz.org for the "Age over 18 (ZKP)" button but we don't set `useCases` because, well, it's not required. I have confirmed that if `useCases` is set on a DeviceRequest v1.1 request with ZKP, then things work fine. 2232229 3 marcosc 2026-07-20 18:44:21 -0700 Root cause understood (thanks, David): per comment 3, a DeviceRequest with version 1.1 is rejected unless `useCases` is set, even though `useCases` isn't required for v1.1. The relevant handling lives in platform code outside the open-source WebKit tree, so this is being tracked and addressed under rdar://166766151 rather than here. Closing on the WebKit side; the interop fix will ship via the platform.