search

oauth-wg / oauth-selective-disclosure-jwt

https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/
Other
55 stars 27 forks source link

"Holder Public Key Claim" should be "Key Binding Key Claim" or similar #352

Closed danielfett closed 5 months ago

danielfett commented 9 months ago

There is a subsection called "Holder Public Key Claim" that talks about the holder's public key. However, we usually now call this "Key Binding".

We should modify that subsection to more generally talk about the key binding (public) key, but it would be fine to mention that this could be used for holder binding.

rohan-wire commented 8 months ago

There is a subsection called "Holder Public Key Claim" that talks about the holder's public key. However, we usually now call this "Key Binding".

We should modify that subsection to more generally talk about the key binding (public) key, but it would be fine to mention that this could be used for holder binding.

A lot of folks are used to primarily using JWTs with symmetric keys, therefore they might be equally likely to expect an issuer binding as a holder binding. I think it is good to spell this out explicitly in section headings and in the first use of Key Binding.

Sakurann commented 5 months ago

agreed to rename "Holder Public Key Claim" section.