On Mon, 2024-07-22 at 19:43 -0400, Richard Barnes wrote: > I would observe that any solution based on garden-variety digital > signature (not something zero-knowledge like BBS / JWP) will have > problems with issuer/verifier collusion. One-time tokens and batch > issuance don't help. There is no such thing as SD-JWT with > issuer/verifier collusion resistance. At best you could have SD-JWP. > > I don't think this needs to be a blocker on SD-JWT. There are use > cases that don't require issuer/verifier collusion resistance. We > should be clear on the security considerations and warn people away > who care about issuer/verifier collusion resistance, and accelerate > work on SD-JWP if that's an important property to folks. >
+1 on this _______________________________________________ OAuth mailing list -- oauth@ietf.org To unsubscribe send an email to oauth-le...@ietf.org
