[Id-event] Review: Subject Identifiers

[Justin Richer <[e-mail]>]

I’ve read through draft-ietf-secevent-subject-identifiers and for the most part it’s in good shape. Apologies if any of these points have been thoroughly covered in other reviews. 

§1: While this is a SET-focused spec, I would like to see more discussion about how this identifier structure can be used outside of a SET or a JWT in general. 

§3.3: small typo, “email” should be “phone number” in introducing example.

§3: I’m wondering if there’s worth in defining semantic flags that can be used across types. Like “pseudonymous” or “per-provider-id” or the like? That might be a step beyond what this is trying to do, though the current definitions do not allow extension of existing types with new fields.

I’d also like to see a note that multiple subject types could be presented together without using the “aliases” structure. This mostly would apply outside of SET which defines a single “sub-id” container, but as above I think this can be more generally used.

Overall, I think it’s a pretty simple and straightforward spec and should go forward.

Thanks,
 — Justin