[OAUTH-WG] Re: OAuth Digest, Vol 189, Issue 37

Moneybenn <cajungotshop@gmail.com> Wed, 31 July 2024 13:11 UTC

From: Moneybenn <cajungotshop@gmail.com>
In-Reply-To: <172243082068.6614.5134548496979794859@ietfa.amsl.com>
References: <172243082068.6614.5134548496979794859@ietfa.amsl.com>
MIME-Version: 1.0
Date: Wed, 31 Jul 2024 09:11:48 -0400
Message-ID: <CAB-s2DCHQ8cRDrzhgoCc_65kDn0PhFW=TxvTt90LtoSDxuT9eg@mail.gmail.com>
To: oauth-request@ietf.org, oauth@ietf.org
Content-Type: multipart/alternative; boundary="000000000000447fc6061e8ad6f1"
Message-ID-Hash: VI5H2IMBOTS3FRTMHHTN74GYOKWF7VOW
Precedence: list
Subject: [OAUTH-WG] Re: OAuth Digest, Vol 189, Issue 37
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/JlN0YNo8_J6o2kFusVDhP5-iSK8>

 I need my payments
Seth Landry

On Wed, Jul 31, 2024 at 8:07 AM, <oauth-request@ietf.org> wrote:

Send OAuth mailing list submissions to
oauth@ietf.org

To subscribe or unsubscribe via email, send a message with subject or
body 'help' to
oauth-request@ietf.org

You can reach the person managing the list at
oauth-owner@ietf.org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of OAuth digest..."

Today's Topics:

1. Re: We cannot trust Issuers (Brian Campbell)


----------------------------------------------------------------------

Message: 1
Date: Wed, 31 Jul 2024 06:31:21 -0600
From: Brian Campbell <bcampbell@pingidentity.com>
Subject: [OAUTH-WG] Re: We cannot trust Issuers
To: Leif Johansson <leifj@mnt.se>
Cc: IETF oauth WG <oauth@ietf.org>
Message-ID:
<CA+k3eCQom6=o+fSYWRd+qWZnWqki3Enij1X8tYhn75Ksuz=jvA@mail.gmail.com>
Content-Type: multipart/alternative;
boundary="00000000000020500b061e8a473a"

On Tue, Jul 23, 2024 at 11:15 AM Leif Johansson <leifj@mnt.se> wrote:

> On Mon, 2024-07-22 at 19:43 -0400, Richard Barnes wrote:
> > I would observe that any solution based on garden-variety digital
> > signature (not something zero-knowledge like BBS / JWP) will have
> > problems with issuer/verifier collusion. One-time tokens and batch
> > issuance don't help. There is no such thing as SD-JWT with
> > issuer/verifier collusion resistance. At best you could have SD-JWP.
> >
> > I don't think this needs to be a blocker on SD-JWT. There are use
> > cases that don't require issuer/verifier collusion resistance. We
> > should be clear on the security considerations and warn people away
> > who care about issuer/verifier collusion resistance, and accelerate
> > work on SD-JWP if that's an important property to folks.
> >
>
>
> +1 on this
>

I'm generally a +1 on this too. There is an attempt at a discussion around
unlinkablity in the privacy considerations at
https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-10.html#name-unlinkability
currently. Concrete suggestions to that text about how to better frame the
risks and difficulties around Issuer/Verifier Unlinkability (perhaps
especially with respect to something like a government issuer compelling
collusion from verifiers) would be welcome for consideration.

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged
material for the sole use of the intended recipient(s). Any review, use,
distribution or disclosure by others is strictly prohibited.  If you have
received this communication in error, please notify the sender immediately
by e-mail and delete the message and any file attachments from your
computer. Thank you._
-------------- next part --------------
A message part incompatible with plain text digests has been removed ...
Name: not available
Type: text/html
Size: 2919 bytes
Desc: not available

------------------------------

Subject: Digest Footer

_______________________________________________
OAuth mailing list -- oauth@ietf.org
To unsubscribe send an email to oauth-leave@ietf.org


------------------------------

End of OAuth Digest, Vol 189, Issue 37
**************************************

[OAUTH-WG] Re: OAuth Digest, Vol 189, Issue 37 Moneybenn