search

oauth-wg / oauth-selective-disclosure-jwt

https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/
Other
57 stars 31 forks source link

The definition of the Selectively Disclosable JWT (SD-JWT) would need to be reworded #491

Closed Denisthemalice closed 2 weeks ago

Denisthemalice commented 2 weeks ago

The current definition of Selectively Disclosable JWT (SD-JWT) is:

Selectively Disclosable JWT (SD-JWT): A composite structure, consisting of an Issuer-signed JWT (JWS, [RFC7515]) and zero or more Disclosures, which supports selective disclosure as defined in this document. It can contain both regular claims and digests of selectively-disclosable claims.

When looking at the new Figure 1 (SD-JWT Issuance and Presentation Flow), it can be seen that there is a difference between :

The "all Disclosures" are not part of the SD-JWT. It they were, they would be signed and removing one of them would break the signature of the Issuer.

Change into:

Selectively Disclosable JWT (SD-JWT): A composite structure, consisting of an Issuer-signed JWT (JWS, [RFC7515]) that contains both regular claims and one or more digests of selectively- disclosable claims. When a SD-JWT is sent back to a Holder, all the disclosures corresponding to the selectively-disclosable claims are also returned. When a SD-JWT is presented to a Verifier, all or only a subset of the disclosures previously obtained by the Holder are presented to the Verifier.