oauth-wg / oauth-selective-disclosure-jwt

https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/
Other
56 stars 30 forks source link

"Presentation" is capitalised as if it's a defined term, but I can't find a definition #356

Closed jogu closed 3 months ago

jogu commented 11 months ago

There are various sentences like:

When Key Binding is not enforced, any entity in possession of an SD-JWT Presentation can forward the contents to third parties

where presentation has a capital P as if it's a defined term. Probably it should have an actual definition (I can't find one) but if not it should probably be lower cased?

Sakurann commented 11 months ago

This is how Presentation is defined in OID4VP:

Presentation: Data that is presented to a specific Verifier, derived from one or more Verifiable Credentials that can be from the same or different Credential Issuers.

https://openid.github.io/OpenID4VP/openid-4-verifiable-presentations-wg-draft.html#section-2-3.8

and I think it's better define it than just make it lower-case, as the term is used pretty frequently.

bifurcation commented 10 months ago

I don't think just removing the capitalization helps. It's still an undefined term. In the spirit of #374, it seems like we actually want two concepts here, (1) handing someone an Issuer JWT + disclosures, where they can verify its integrity, drop disclosures and/or hand it to someone else, and (2) handing someone an Issuer JWT + disclosures + KB JWT, where the only thing they can do is verify it.

bc-pi commented 7 months ago

I think https://github.com/oauth-wg/oauth-selective-disclosure-jwt/issues/384 goes a long way towards addressing this.

I meant #394, sorry.

Sakurann commented 7 months ago

(I think you meant 394, @bc-pi..?)

bc-pi commented 3 months ago

I believe the merging of https://github.com/oauth-wg/oauth-selective-disclosure-jwt/pull/394 clears this one up