Change draft name - Githubissues

peppelinux / draft-demarco-oauth-status-assertions

OAuth 2.0 Status Assertions for Digital Credentials

Other

4 stars 5 forks source link

Change draft name #5

Closed peppelinux closed 4 months ago

peppelinux commented 8 months ago

it would be good to avoid the term "attestations" because it is already used for a different purpose (in the IETF).

Could it be "status tokens" or "status assertions"?

peppelinux commented 7 months ago

What about Status Evidence?

This would be close to the Wallet Trust Evidence we have for eIDAS

OR13 commented 7 months ago

I suggest we have a chat with RATS about this... they use these terms a lot, and will be very unhappy if we do not attempt to foster alignment... as will I : )

bc-pi commented 7 months ago

"status assertions" seems reasonably good/appropriate here. The term "attestation" is just quite popular right now and carries some assumptions/connotations due to wide use in a different context. The term "assertion" is overloaded too (as are most terms) but less problematically so. And I think "assertion" does nicely convey the intent.

peppelinux commented 7 months ago

I suddenly realized that "status $something" misses the subject, the name would therefore be "Digital Credential Status Assertions"

This specification excludes its use with traditional OAuth 2.0/OIDC tokens. While the OAuth Status List shares some similarities, the OAuth 2.0 Introspection endpoint is deemed sufficient for such tokens due to several key differences:

Interaction: Parties interact differently in the context of traditional tokens compared to this specification.
Privacy: Distinct privacy requirements apply to each scenario.
Offline usage: Offline use cases, which necessitate this specification, are not a requirement for legacy infrastructures utilizing traditional tokens.

peppelinux commented 5 months ago

@marinaado Interesting reference: https://github.com/ietf-wg-scitt/draft-ietf-scitt-architecture/pull/227/files#diff-585fb424519b79cf000445f3425fa56d328cbaca5d2a622740ddc4e5ca91dbe1R936

peppelinux commented 5 months ago

Following the Architecture for Trustworthy and Transparent Digital Supply Chains (SCITT), this looks pretty close to the purpose of this specs

{{NIST.SP.800-63-3}} defines "assertion" as "A statement from a verifier to an RP that contains information about a subscriber.
Assertions may also contain verified attributes."

@SaraConsoliACN could you please create a PR with the proposal of the specification name change?

peppelinux commented 4 months ago

Resolved by https://github.com/peppelinux/draft-demarco-oauth-status-attestations/pull/38