Normative references to IDA specs are not on the latest date

[bitbucket-import-issues]

Originally submitted by Kosuke Koiwai (Kosuke Koiwai) on 2025-09-01

for example, the dates below should be 1 October 2024.

https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#name-normative-references-2

[IDA-verified-claims] Lodderstedt, T., Fett, D., Haine, M., Pulido, A., Lehmann, K., and K. Koiwai, "OpenID Identity Assurance Schema Definition", 9 August 2023,

‌

[OpenID4IDAClaims] Lodderstedt, T., Fett, D., Haine, M., Pulido, A., Lehmann, K., and K. Koiwai, "OpenID Connect for Identity Assurance Claims Registration 1.0", 16 June 2023,

‌

---

Bitbucket status: new

Bitbucket origin: issue 1476

[bitbucket-import-issues]

Originally submitted by Kosuke Koiwai (Kosuke Koiwai) on 2025-09-10

While checking other references, I found that ISO8601 has newer edition.

https://www.iso.org/iso/catalogue_detail?csnumber=40874

[bitbucket-import-issues]

Originally submitted by Kosuke Koiwai (Kosuke Koiwai) on 2025-09-10

Also, the ICAO document we refer for the 3-letter country code has been updated to the eighth edition, and now the document doesn't carry the full list of 3-letter country codes and points to ISO 3166 instead.

https://www.icao.int/publications/Documents/9303_p3_cons_en.pdf

‌

https://www2023.icao.int/publications/Documents/9303_p3_cons_en.pdf

Two- and three-letter codes shall be obtained from the [ISO 3166] maintenance agency - [ISO 3166/MA], ISO’s focal

point for country codes. These codes are regularly updated in [ISO 3166-1] and are publically available

(https://www.iso.org/iso-3166-country-codes.html).

Codes not included in [ISO 3166-1], such as extensions for other States and organizations, or other exceptions, are

outlined in the following table:

‌

(The original seventh edition what we refer was found on the archive.org)

https://web.archive.org/web/20151002120126/https://www.icao.int/publications/Documents/9303_p3_cons_en.pdf)

The following are the two- and three-letter codes for entities specified and regularly updated in [ISO 3166-1], with

extensions for certain States and organizations being identified by an asterisk. The current version of the codes may be

obtained from the [ISO 3166] maintenance agency - [ISO 3166/MA], ISO’s focal point for country codes.

‌

[bitbucket-import-issues]

Originally submitted by Kosuke Koiwai (Kosuke Koiwai) on 2025-09-10

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63a.pdf

NIST SP 800-63 is also recently updated.

[bitbucket-import-issues]

Originally submitted by Kosuke Koiwai (Kosuke Koiwai) on 2025-09-24

I talked with NAT and his advice was that we can refer to the newer ICAO spec and ISO spec, and this change is non-normative as long as the values themselves are unchanged.

‌

[bitbucket-import-issues]

Originally submitted by Kosuke Koiwai (Kosuke Koiwai) on 2025-10-15

ISO3166 and ICAO country codes are referred in two specs:

Claims Registration

Claims Registration spec refers ISO3166 and ICAO differently in multiple places:

Claim	Type	Description
place_of_birth	JSON object	End-user’s place of birth. The value of this member is a JSON structure containing some or all of the following members:
		country: String representing country in [!ISO3166-1] Alpha-2 or [!ISO3166-3] syntax.
nationalities	array	End-user’s nationalities using ICAO 3-letter codes [!ICAO-Doc9303], 2-letter ICAO codes may be used in some circumstances for compatibility reasons.

‌

Extended address claim

This specification extends the address claim as defined in [!OpenID] by another sub field containing the country as ISO code.

country_code: Optional. country part of an address represented using an ISO 3-letter code [!ISO3166-3], e.g., "USA" or "JPN". 2-letter ISO codes [!ISO3166-1] may be used for compatibility reasons. country_code may be used as alternative to the existing country field.

‌

Verified Claims

Verified Claims spec refers ISO3166 and ICAO9303 in evidence types sections, all in the same way.

Evidence type document

document_details: Optional. JSON object representing the document used to perform the identity verification. It consists of the following properties:

• issuer: Optional. JSON object containing information about the issuer of this document. This object consists of the following properties:

  • country_code: Optional. String denoting the country or supranational organization that issued the document as ISO 3166/ICAO 3-letter codes [!ICAO-Doc9303], e.g., "USA" or "JPN". 2-letter ICAO codes may be used in some circumstances for compatibility reasons.

Evidence type electronic_record

record: Optional. JSON object representing the record used to perform the identity verification. It consists of the following properties:

• source: Optional. JSON object containing information about the source of this record. This object consists of the following properties:

  • country_code: Optional. String denoting the country or supranational organization that issued the evidence as ISO 3166/ICAO 3-letter codes [!ICAO-Doc9303], e.g., "USA" or "JPN". 2-letter ICAO codes may be used in some circumstances for compatibility reasons.

Evidence type vouch

attestation: Optional. JSON object representing the attestation that is the basis of the vouch. It consists of the following properties:

• voucher: Optional. JSON object containing information about the entity giving the vouch. This object consists of the following properties:

  • country_code: Optional. String denoting the country or supranational organization that issued the evidence as ISO 3166/ICAO 3-letter codes [!ICAO-Doc9303], e.g., "USA" or "JPN". 2-letter ICAO codes may be used in some circumstances for compatibility reasons.

‌

Following the past discussions in the issues, those inconsistencies in country codes are left that way to avoid breaking changes.

https://bitbucket.org/openid/ekyc-ida/issues/1274/review-of-country-codes-in-the-ekyc-ida

some of these points are reasonable but to avoid breaking change we can tolerate these relatively minor issues

‌

I also found some errors:

1. “ISO3166-3” seems to be mistakenly referred as a spec for 3-letter codes, while ISO3166-3 is a list of formerly used country names in places such as:

   1. place_of_birth/ country requires “[!ISO3166-1] Alpha-2 or [!ISO3166-3] syntax”,and
   2. country_coderequies “an ISO 3-letter code [!ISO3166-3]” or “2-letter ISO codes [!ISO3166-1] may be used”

2. in the vouch evidence section, attestation / voucher / country_code says “String denoting the country or supranational organization that issued the evidence”, while a voucher should be a person

Given that, I propose the fix in the next post in the thread

[bitbucket-import-issues]

Originally submitted by Kosuke Koiwai (Kosuke Koiwai) on 2025-10-15

proposed fix, with deleted text and added text are marked as such:

Claims Registration

Claim	Type	Description
place_of_birth	JSON object	End-user’s place of birth. The value of this member is a JSON structure containing some or all of the following members:
		country: String representing country in [!ISO3166-1] Alpha-2 or [!ISO3166-3] Alpha-3 syntax codes.
nationalities	array	End-user’s nationalities using ICAO 3-letter codes [!ICAO-Doc9303], 2-letter ICAO codes may be used in some circumstances for compatibility reasons. End-user’s nationalities using [!ISO3166-1] Alpha-3 codes or [!ICAO-Doc9303] 3-letter codes. ISO Alpha-2 codes or ICAO 2-letter codes may be used in some circumstances for compatibility reasons. *Note: [!ICAO-Doc9303] refers to [!ISO3166-1] and only the codes not in ISO3166 are defined in the ICAO doc.

Extended address claim

This specification extends the address claim as defined in [!OpenID] by another sub field containing the country as ISO code.

country_code: Optional. country part of an address represented using an ISO 3-letter code [!ISO3166-13], e.g., "USA" or "JPN". 2-letter ISO codes [!ISO3166-1] may be used for compatibility reasons. country_code may be used as alternative to the existing country field.

‌

Verified Claims

Evidence type document

document_details: Optional. JSON object representing the document used to perform the identity verification. It consists of the following properties:

• issuer: Optional. JSON object containing information about the issuer of this document. This object consists of the following properties:

  • country_code: Optional. String denoting the country or supranational organization that issued the document as ISO 3166/ICAO 3-letter codes [!ICAO-Doc9303] [!ISO3166-1] Alpha-3 codes or [!ICAO-Doc9303] 3-letter codes, e.g., "USA" or "JPN". 2-letter ICAO codes ISO Alpha-2 codes or ICAO 2-letter codes may be used in some circumstances for compatibility reasons.
  • *Note: [!ICAO-Doc9303] refers to [!ISO3166-1] and only the codes not in ISO3166 are defined in the ICAO doc.

Evidence type electronic_record

record: Optional. JSON object representing the record used to perform the identity verification. It consists of the following properties:

• source: Optional. JSON object containing information about the source of this record. This object consists of the following properties:

  • country_code: Optional. String denoting the country or supranational organization that issued the evidence as ISO 3166/ICAO 3-letter codes [!ICAO-Doc9303] [!ISO3166-1] Alpha-3 codes or [!ICAO-Doc9303] 3-letter codes, e.g., "USA" or "JPN". 2-letter ICAO codes ISO Alpha-2 codes or ICAO 2-letter codes may be used in some circumstances for compatibility reasons.
  • *Note: [!ICAO-Doc9303] refers to [!ISO3166-1] and only the codes not in ISO3166 are defined in the ICAO doc.

Evidence type vouch

attestation: Optional. JSON object representing the attestation that is the basis of the vouch. It consists of the following properties:

• voucher: Optional. JSON object containing information about the entity giving the vouch. This object consists of the following properties:

  • country_code: Optional. String denoting the country or supranational organization that issued the evidence the entity giving the vouch as ISO 3166/ICAO 3-letter codes [!ICAO-Doc9303] [!ISO3166-1] Alpha-3 codes or [!ICAO-Doc9303] 3-letter codes, e.g., "USA" or "JPN". 2-letter ICAO codes ISO Alpha-2 codes or ICAO 2-letter codes may be used in some circumstances for compatibility reasons.
  • *Note: [!ICAO-Doc9303] refers to [!ISO3166-1] and only the codes not in ISO3166 are defined in the ICAO doc.

‌

‌

I’ll also delete the ISO3166-3 reference and modify the ICAO reference to up-to-date.

[bitbucket-import-issues]

Originally submitted by Kosuke Koiwai (Kosuke Koiwai) on 2025-10-22

NIST SP 800-63 is no longer referenced in the spec, just used as an example of trust framework.