search

oauth-wg / oauth-selective-disclosure-jwt

https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/
Other
57 stars 31 forks source link

It is important to mention the use of decoy digests and of the shuffling of the digests included in the SD-JWT payload #507

Closed Denisthemalice closed 2 weeks ago

Denisthemalice commented 2 weeks ago

Section 4.2.2 (Disclosures for Array Elements) contains a consideration that should also be applied to section 4.2.1 (Disclosures for Object Properties).

Add the following text below the header of this section:

The Issuer SHOULD hide the order of the obfuscated claims in the SD-JWT. To ensure this, it is RECOMMENDED to add decoy digests and to shuffle the digests included in the SD-JWT payload. See section 4.2.5 about Decoy Digests. It is also RECOMMENDED to use a fixed number of digests, so that the Verifier cannot deduce the value of an obfuscated claim name that won't be revealed.