Add important privacy/security considerations for DCQL

openid / OpenID4VP

57 stars 20 forks source link

Open danielfett opened 3 weeks ago

danielfett commented 3 weeks ago

When credential matching via claim_sets, the presence/absence of certain claims might leak data (all claims used for deciding response must be included in consent)
Response must be the same, whether there is no match for credentials or the user didn't consent.

danielfett commented 3 weeks ago

Also, issue #300 🎉

bc-pi commented 3 weeks ago

Also, issue #300 🎉

This is that, no?