RESOLVED MOVED304388
Digital Credentials: potentially broken with Annex C and ZKP on Safari 
https://bugs.webkit.org/show_bug.cgi?id=304388
Summary Digital Credentials: potentially broken with Annex C and ZKP on Safari
Marcos Caceres
Reported 2025-12-17 23:09:13 PST
It seems there is something broken with Annex C and ZKP on Safari Quoting the Android Security team "you can repro in iOS by just going to verifier.multipaz.org, select Annex C as protocol, and hit the "Age over 18 (ZKP)" button"
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2025-12-17 23:10:25 PST
<rdar://problem/166766151>
David Zeuthen
Comment 2 2025-12-18 06:26:22 PST
I did some more digging and this is another case of the root problem that if you set DeviceRequest version to 1.1 then Webkit bails unless `useCases` is set. This is a bug in WebKit because there is no requirement for the RP to set `useCases` even if version is set to 1.1 Because ZKP is a v1.1 feature, we set version of DeviceRequest to 1.1 on verifier.multipaz.org for the "Age over 18 (ZKP)" button but we don't set `useCases` because, well, it's not required. I have confirmed that if `useCases` is set on a DeviceRequest v1.1 request with ZKP, then things work fine.
Marcos Caceres
Comment 3 2026-07-20 18:44:21 PDT
Root cause understood (thanks, David): per comment 3, a DeviceRequest with version 1.1 is rejected unless `useCases` is set, even though `useCases` isn't required for v1.1. The relevant handling lives in platform code outside the open-source WebKit tree, so this is being tracked and addressed under rdar://166766151 rather than here. Closing on the WebKit side; the interop fix will ship via the platform.
Note You need to log in before you can comment on or make changes to this bug.