r:e Frederik and revocation: I definitely agree that solving the revocation problem is important for the use cases where the Holder isn't in control of the Delegate Holder. From a format perspective we know how to solve this (IETF status lists in the delegate sd-jwt work just fine). The difficulty becomes how to distribute them (as a Wallet application doesn't have an easy way to do it).
The current spec proposes leveraging OpenID4VP to do 'delegation-via-presentation'. When considering revocation, we really want to do 'delegation-via-issuance' (as we likely also want to be able to do refresh, updates etc in addition to supporting revocation). I think it's possible to build upon what VCI has done today to enable that in a privacy preserving way. It probably makes more sense to discuss the spec in that context (and then make sure that the format we are proposing here would work!). r:e Christian Thanks, and agreed! I think common policy claims in particular is something that would be really valuable to have in the delegate sd-jwt, rather than each use case re-inventing their own. cheers, Gareth
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
