[OAUTH-WG] Reminder: Alternative text for sd-jwt privacy considerations.

[Watson Ladd <[e-mail]>]

Dear oauth wg,

Happy 2025! I hope everyone has had a nice set of holidays. As a
reminder I put forward the following proposal for text to add to
either privacy or security considerations of sd-jwt, but the timing
was unfortunate, coming Christmas eve.
Comments on it welcome.

"SD-JWT conceals only the values that aren't revealed. It does not
meet standard security notations for anonymous credentials. In
particular Verifiers and Issuers can know when they have seen the same
credential no matter what fields have been opened, even none of them.
This behavior may not accord with what users naively expect or are
lead to expect from UX interactions and lead to them make choices they
would not otherwise make. Workarounds such as issuing multiple
credentials at once and using them only one time can help for keeping
Verifiers from linking different showing, but cannot work for Issuers.
This issue applies to all selective disclosure based approaches,
including mdoc. "

Sincerely,
Watson

--
Astra mortemque praestare gradatim