QR-Code Security Enforcements

[peppelinux]

openid/OpenID4VP#329 (comment)

It would be beneficial to include the following in the QR code:

A nonce
An expiration time (exp)

The Relying Party (RP) should bind the user-agent with the issued QR code in such a way that a scam attack would not succeed unless the adversary knows and configures their user-agent with the same data as the victim's user-agent.

[fmarino-ipzs]

@peppelinux @grausof this is something that we should handle in milestone 0.9. WDYT?

[peppelinux]

No it is only an open discussion with several concerns and weakness, I only tried to explain some further key elements but it is still not clear how they would appear as usefull or necessary for the improvement of the security of the qr-code

no action for now, even because nonce and exp is something that can be explicitly handled by the RP in its backend, using bindings and expiration times after the issuance