Return-Path: X-Original-To: oauth@ietfa.amsl.com Delivered-To: oauth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B520C169422 for ; Wed, 11 Dec 2024 17:00:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.107 X-Spam-Level: X-Spam-Status: No, score=-2.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3RXDYT69ee7d for ; Wed, 11 Dec 2024 17:00:29 -0800 (PST) Received: from mail-wm1-x331.google.com (mail-wm1-x331.google.com [IPv6:2a00:1450:4864:20::331]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCFADC14F71C for ; Wed, 11 Dec 2024 17:00:29 -0800 (PST) Received: by mail-wm1-x331.google.com with SMTP id 5b1f17b1804b1-436202dd730so267995e9.2 for ; Wed, 11 Dec 2024 17:00:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1733965228; x=1734570028; darn=ietf.org; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=PhlUf3gaE6Rwc9xZkejhjDAp23IYQW4u9kK1WvyoqNo=; b=gCXrvQYlYvOvvum6MunIpGsqlfuLJkTxTwoJr1AReN4qlsRJIm5fR09+6w05LoJfPS HQcPZXRTc+z2XWOJpZrXZ94J697u/y+jLhbPyTWHH1ic12xaQpKQEnvugThOZnC0+LkU KSnYtxB4bz6B6TQv+wkQmTmyZo5+LV3MGKtGJnwMthQHqaN3CNQOD6hjszPuuNRTyhix /9dWLWggNj3wMK/espl4BL5l1UjX+LAKzrIH7ukY6hLlTdfp0Azza4PwsEJ9jJhDO8aK h+wXm9h2/5VFpBICTANPsf0DKj3HRZvrJrhori7N1AGdK4dDRSqrinGvGzroDMfk2aVn PxbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733965228; x=1734570028; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=PhlUf3gaE6Rwc9xZkejhjDAp23IYQW4u9kK1WvyoqNo=; b=WPnFPliCXk+6zKf++DlLUtgH6NlVPVQJAi8+1SpadQp/F9vZojG6Kp/tg9lkfHA2YA chauuTJxA+zsyOKJk1UT2VQ0Pk2bLRUjVHRwgWyH3IBf76lEv9LpMhBkYp39UigSOIlK L2/v5sgZq2WLaBqGAE/ilVPMhmdOIN7n1jjkPo5cd+cfcgwnyVGpdPosDou6ZZSXHaX8 qHlckQICF1ve/L32E9ofMCYG7RLzZLg8JbxHkuo+X+GifyBaISmtXq1Za6WOIwzMyPUk LLpLTEJwfsxrfhDo68HQyN2zwoacDDds/QBW/Buya4Yp/1n6iPR78EGwRyrYoaGtyKMs 8poQ== X-Gm-Message-State: AOJu0YyOU0xVaqPcc09hpX5FMRwJvJ2O1gw07dNhV7ihlLv+mwvlu1uA YQ9EaLGtuPDbcod3GWw9paa6kXntiKHwmjnWYNfPojid9e60kZWbCe3wUS9T3WQ2Du7zzjyjSLy O1iG9CulTpU7AxGTRDoKmpiYgZEWPxL5H X-Gm-Gg: ASbGncudaL9Tve0hmVEOrSsaRITxaCvvZG7eLHAA61EIKFakXc6tlh26jMuQDcBVzGI nGVL0wNA/2SF/47C04idFh5oMwFTO6qDruVD7jz4jzEkEw7MdPsiYPpvrfyX0mx0MB3sjwSI= X-Google-Smtp-Source: AGHT+IGe7TtpplXlpbYGZlLsPmI69Pg3zJvLYKVcH+UOdJRhO24ezwVL1WHQdILqiVLCKMBhzomDq1ximJa1NHxAqhs= X-Received: by 2002:a05:6000:1543:b0:385:f677:859b with SMTP id ffacd0b85a97d-38787685202mr1444620f8f.10.1733965227868; Wed, 11 Dec 2024 17:00:27 -0800 (PST) MIME-Version: 1.0 From: Watson Ladd Date: Wed, 11 Dec 2024 17:00:16 -0800 Message-ID: To: IETF oauth WG Content-Type: text/plain; charset="UTF-8" Message-ID-Hash: M5UMQALNTX464KXBC6KLVPOTB4DVRMZ2 X-Message-ID-Hash: M5UMQALNTX464KXBC6KLVPOTB4DVRMZ2 X-MailFrom: watsonbladd@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-oauth.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.9rc6 Precedence: list Subject: =?utf-8?q?=5BOAUTH-WG=5D_SD-JWT_linkability?= List-Id: OAUTH WG Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Dear all, I'd like to propose the following edit to resolve the concerns I have around endorsing dangerous applications of SD-JWT: Delete last two lines of https://github.com/oauth-wg/oauth-selective-disclosure-jwt/pull/451/files in 1338 and 1339 Add new paragraph right before the end of the section. "When disclosures include information easily understood to be identifying, users intuitive view of what they are revealing largely matches the underlying technical reality. In cases where the information being disclosed is not identifying, SD-JWT MUST NOT be used as this confusion leads to users making the wrong choices. Applications cannot assume Verifiers behave properly (RFC 3514) and MUST analyze the consequences for such linkage with each credential that could be used." I think this agrees with many of the comments made about my initially stronger edit, while addressing the core danger. Also, it seems this section only really treats issuer/verifier despite promising more. Do we need to rework it? Sincerely, Watson Ladd -- Astra mortemque praestare gradatim