[OAUTH-WG] Re: SD-JWT linkability

[Paul Bastian <[e-mail]>]

I think  people on this list are overly critical towards SD-JWT and I 
don't understand it. I'm not aware that these kind of statements have 
been done in other IETF standards in a comparable context. Please 
correct me why neither JWT, CWT, JOSE, COSE, CBOR nor X.509 have 
specific text about these kind of things. RFC7049 doesn't even have a 
privacy consideration section although it contains linkable data 
structures that may be utilized to track users.

SD-JWT is a data container that brings some additional features to 
JWT/JWS, but nothing more than that and we shouldn't treat it 
differently. To me, SD-JWT includes a thourough privacy consideration 
section on unlinkability which is way beyond what other IETF 
specifications have done is looks sufficient to me.

Best regards,

Paul

On 13.12.24 15:30, Carsten Bormann wrote:
> This is all great, but it is informative text except for a few sprinkled interoperability keywords “for the implementer” (when, apparently, it already has been decided to use this mechanism).
>
> The point, however, is that this specification has a limited area of applicability.
> Outsourcing security decisions about this to an unwitting user is never the right approach.
> The assumption that a user will intuitively understand the consequences of disclosure is a tall order.
> (“Intuitive” is code for “familiar”, and every second five people are born that are not familiar with the consequences.)
>
> Beyond the nice discussion, usage of the mechanism needs to be governed by a strong, fully actionable applicability statement.
>
> Grüße, Carsten
>
> _______________________________________________
> OAuth mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]