IETF Logo Mail Archive

[OAUTH-WG] Re: SD-JWT linkability

Carsten Bormann <cabo@tzi.org> Wed, 18 December 2024 05:35 UTC

Return-Path: <cabo@tzi.org>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B344C1CAF48 for <oauth@ietfa.amsl.com>; Tue, 17 Dec 2024 21:35:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.906
X-Spam-Level:
X-Spam-Status: No, score=-1.906 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1Kjjrd3zxIht for <oauth@ietfa.amsl.com>; Tue, 17 Dec 2024 21:35:55 -0800 (PST)
Received: from smtp.zfn.uni-bremen.de (smtp.zfn.uni-bremen.de [134.102.50.21]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74130C1840D9 for <oauth@ietf.org>; Tue, 17 Dec 2024 21:35:55 -0800 (PST)
Received: from smtpclient.apple (p548dc3ec.dip0.t-ipconnect.de [84.141.195.236]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.zfn.uni-bremen.de (Postfix) with ESMTPSA id 4YCj876Zt4zDCcc; Wed, 18 Dec 2024 06:35:50 +0100 (CET)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.300.87.4.3\))
From: Carsten Bormann <cabo@tzi.org>
In-Reply-To: <b8e4be44-465d-4603-8dd8-2628f4a9449c@posteo.de>
Date: Wed, 18 Dec 2024 06:35:40 +0100
Content-Transfer-Encoding: quoted-printable
Message-Id: <972C54E3-829B-449D-852B-4224B68C7054@tzi.org>
References: <CACsn0ckGp4AocD1fQbMCs45P_Z5vjveggzDJw=-Vk5kxinM28Q@mail.gmail.com> <080c5dba-c3af-47d5-a773-ea41f5f720b4@danielfett.de> <3E1E5A8D-D6D8-41AA-8522-D5323143A1DB@tzi.org> <b8e4be44-465d-4603-8dd8-2628f4a9449c@posteo.de>
To: Paul Bastian <paul.bastian@posteo.de>
X-Mailer: Apple Mail (2.3826.300.87.4.3)
Message-ID-Hash: QVCWHI7TQMCIDJUOIOFFVNJC3TIEJBZL
X-Message-ID-Hash: QVCWHI7TQMCIDJUOIOFFVNJC3TIEJBZL
X-MailFrom: cabo@tzi.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-oauth.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: oauth@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [OAUTH-WG] Re: SD-JWT linkability
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/4yU5R1IgYm0mNT-pTExoX5oOvcY>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>

On 17. Dec 2024, at 21:04, Paul Bastian <paul.bastian@posteo.de> wrote:
> 
> RFC7049 doesn't even have a privacy consideration section although it contains linkable data structures that may be utilized to track users.

I’m not sure why you pick an RFC that has been superseded a while ago by an Internet Standard, but let’s take it up from there:

There are many standards in the Internet that can be used to communicate data that may be utilized to track users.  I’d start with RFC 20, ASCII, then RFC 791, RFC 9293 (which recently superseded RFC 793), RFC 8949, …

However, none of these standards claim “selective disclosure” right on the lid.
There is a reason why you need FDA(*) approval for a product that claims to be medicine.

Grüße, Carsten

(*) In the US; substitute your favorite Bundesamt here.

v2.46.0 | Report a Bug | By Email | System Status