Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

Subject: Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)   Hi Kristina Yes I realise that if the RP knows the schema then it will know the structure of the VC. In cases where an Issuer issues more than one type

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

uot; familyName": "9h5vgv6TpFV6GmnPtugiMLl5tHetHeb5X_2cKHjN7cw", "birthdate": "fvLCnDm3r4VSYcBF3pIlXP4ulEoHuHOfG_YmFZEuxpQ" } } } Thanks, Nikos -Original Message----- From: Kristina Yasuda Sent: Wednesday, Ju

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

quot;fvLCnDm3r4VSYcBF3pIlXP4ulEoHuHOfG_YmFZEuxpQ" } Majority of JWT-VC implementations do not use "@context" property of vc-data-model, so I would be reluctant to put information on which claim is an SD claim there. Quick note that we are defining SD-JWT not only for

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

ot;, while optional claims are hashed and included in "sd_digests". Best, Kristina From: David Chadwick Sent: Friday, June 24, 2022 2:16 AM To: Kristina Yasuda ; oauth@ietf.org Subject: Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT) Hi Kristina Yes I realise that if the

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

Hi, You are saying "merge payload". But how? In example 4 of section A.3, "given_name", "family_name", "birthdate" must be moved inside the "vc" claim to produce a valid payload. But nothing indicates that. Best, Nikos -- Nikos Fotiou - http://pages.cs.aueb.gr/~fotiou Researcher - Mobile

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

Hi Nikos, Am 28.06.22 um 13:22 schrieb Nikos Fotiou: Hi Daniel, I just want to reverse your arguments and I will stop spamming. I will focus on your “sub” example. When a VC is encoded as a JWT, and according to specs (https://www.w3.org/TR/vc-data-model/#proof-formats) “sub MUST

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

@ietf.org Subject: Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT) Hi Nikos, the requirement for putting the claims into a separate structure becomes more obvious from your example. On the surface, you can see that the data types don't match the specifications - the email address

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

xMNHayCrfPG0FDsqbyDs", "birthdate": "Ia1Tc6_Xnt5CJc2LtKcu6Wvqr42glBGGcjGOye8Zf3U", "sd_digests":["sub", "given_name", "family_name", "email", "phone_number", "address", "birthdate"] } Best,

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

> On 28 Jun 2022, at 10:28, Neil Madden wrote: > > >> On 28 Jun 2022, at 08:37, Daniel Fett > > wrote: >> >> […] >> >>> >>> The fact that HASH(SALT | CLAIM-VALUE) is vulnerable to length extension >>> attacks is also troubling, even if I can’t

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

> On 28 Jun 2022, at 08:37, Daniel Fett > wrote: > > […] > >> >> The fact that HASH(SALT | CLAIM-VALUE) is vulnerable to length extension >> attacks is also troubling, even if I can’t see an immediate attack. But it’s >> a weird property that Bob, for example, could make a commitment to

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

l": "fPZ92dtYMCN2Nb-2ac_zSH19p4yakUXrZl_-wSgaazA", "phone_number": "QdSffzNzzd0n60MsSmuiKj6Y6Enk2b-BS-KtEePde5M", "address": "JFu99NUXPq55f6DFBZ22rMkxMNHayCrfPG0FDsqbyDs", "birthdate": "Ia1Tc6_Xnt5CJc2LtKcu6Wvqr42glBGGcjGOye8Zf3U", "

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

Hi Neil, thanks for your feedback! The security considerations are certainly far from complete in this first draft (and didn't intend to be). Your comments will help us to improve this part of the draft. Am 23.06.22 um 20:52 schrieb Neil Madden: I’m not entirely sure the OAuth WG is a

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

Hi Nikos, Am 24.06.22 um 16:16 schrieb Nikos Fotiou: Hi, I was wondering what is the reason for introducing the sd_digests claim. I think it complicates integration with existing systems. For example, I am pretty sure that the VC included in Example 4 is wrong. Since the verifier can learn

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

Hi, I was wondering what is the reason for introducing the sd_digests claim. I think it complicates integration with existing systems. For example, I am pretty sure that the VC included in Example 4 is wrong. Since the verifier can learn from the SD-JWT-RELEASE which claims are hashed, why is

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

Hi Denis I tend to agree with you. Sending the same JWT to multiple different RPs is providing them all with a correlating handle and this drawback should be pointed out. Kind regards David On 23/06/2022 18:04, Denis wrote: Hi

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

, Kristina   From: OAuth On Behalf Of David Chadwick Sent: Thursday, June 23, 2022 10:20 AM To: oauth@ietf.org Subject: Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

: Thursday, June 23, 2022 10:20 AM To: oauth@ietf.org Subject: Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT) Hi Daniel Whilst I commend your initial efforts at SD, I find that the current draft is too privacy invasive since it reveals to the RP every property type that the user possesses

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

I’m not entirely sure the OAuth WG is a suitable venue for this kind of document. It should at least get some review from CFRG, to get feedback on the crypto aspects. I have some initial comments about the cryptography being used. Commitments to claim values are of the form HASH(SALT |

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

Hi Daniel Whilst I commend your initial efforts at SD, I find that the current draft is too privacy invasive since it reveals to the RP every property type that the user possesses, even though it does not reveal the property values. Revealing property types might

Re: [OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

Hi Daniel, The key sentence from the introduction is the following sentence: However, when a signed JWT is intended to be multi-use, it needs to contain the superset of all claims the user might want to release to verifiers at some point. Before diving into the proposed solution, it

[OAUTH-WG] Presenting Selective Disclosure JWT (SD-JWT)

All, Kristina and I would like to bring to your attention a new draft that we have been working on with many others over the past weeks. "Selective Disclosure JWT (SD-JWT)" describes a format for signed JWTs that support selective disclosure (SD-JWT), enabling sharing only a subset of the