oauth-wg / oauth-selective-disclosure-jwt

https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/
Other
57 stars 31 forks source link

The definition of a "key binding JWT" would need to be reworded #493

Closed Denisthemalice closed 2 weeks ago

Denisthemalice commented 2 weeks ago

The current definition of Key Binding JWT is:

Key Binding JWT (KB-JWT): A JWT for proving Key Binding as defined in Section 4.3. A Key Binding JWT is said to "be tied to" a particular SD-JWT when its payload includes a hash of the SD-JWT in its sd_hash claim.

Referring to a subsequent Section is not adequate for a definition. The definition should be understandable without the need to look at another section. The KB-JWT does much more than the current description.

Replace this definition by:

Key Binding JWT (KB-JWT): A JWT that allows a Holder to disclose a set of claims that were obfuscated in a SD-JWT, to restrict the use of a SD-JWT to one designated Verifier, to limit the use of the SD-JWT to a single exchange and that allows the Verifier to make sure that these limitations are enforced by an entity that used a private key corresponding to a public key contained in the SD-JWT.