Open selfissued opened 3 weeks ago
I'm fine with the working group discussing it, but the underlying facts of the situation are that both JWS and COSE support detached payloads. Therefore, this PR is editorial, in that it doesn't change the normative meaning of the specification or add any functionality that didn't already exist.
What it does do is remove any ambiguity that may be in people's minds about this functionality already existing and being usable with Verifiable Credentials.
As for security, there's nothing less secure about signing detached content than attached content. In both cases, you continue processing the input only if the signature validates.
The issue was discussed in a meeting on 2024-08-21
Fixes #278
Also updated the SD-JWT terminology to use the term "JWT Claims Set", which the SD-JWT spec now does.
Preview | Diff