I need my payments Seth Landry On Wed, Jul 31, 2024 at 8:07 AM, <oauth-requ...@ietf.org> wrote:
Send OAuth mailing list submissions to oauth@ietf.org To subscribe or unsubscribe via email, send a message with subject or body 'help' to oauth-requ...@ietf.org You can reach the person managing the list at oauth-ow...@ietf.org When replying, please edit your Subject line so it is more specific than "Re: Contents of OAuth digest..." Today's Topics: 1. Re: We cannot trust Issuers (Brian Campbell) ---------------------------------------------------------------------- Message: 1 Date: Wed, 31 Jul 2024 06:31:21 -0600 From: Brian Campbell <bcampb...@pingidentity.com> Subject: [OAUTH-WG] Re: We cannot trust Issuers To: Leif Johansson <le...@mnt.se> Cc: IETF oauth WG <oauth@ietf.org> Message-ID: <CA+k3eCQom6=o+fSYWRd+qWZnWqki3Enij1X8tYhn75Ksuz=j...@mail.gmail.com> Content-Type: multipart/alternative; boundary="00000000000020500b061e8a473a" On Tue, Jul 23, 2024 at 11:15 AM Leif Johansson <le...@mnt.se> wrote: > On Mon, 2024-07-22 at 19:43 -0400, Richard Barnes wrote: > > I would observe that any solution based on garden-variety digital > > signature (not something zero-knowledge like BBS / JWP) will have > > problems with issuer/verifier collusion. One-time tokens and batch > > issuance don't help. There is no such thing as SD-JWT with > > issuer/verifier collusion resistance. At best you could have SD-JWP. > > > > I don't think this needs to be a blocker on SD-JWT. There are use > > cases that don't require issuer/verifier collusion resistance. We > > should be clear on the security considerations and warn people away > > who care about issuer/verifier collusion resistance, and accelerate > > work on SD-JWP if that's an important property to folks. > > > > > +1 on this > I'm generally a +1 on this too. There is an attempt at a discussion around unlinkablity in the privacy considerations at https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-10.html#name-unlinkability currently. Concrete suggestions to that text about how to better frame the risks and difficulties around Issuer/Verifier Unlinkability (perhaps especially with respect to something like a government issuer compelling collusion from verifiers) would be welcome for consideration. -- _CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you._ -------------- next part -------------- A message part incompatible with plain text digests has been removed ... Name: not available Type: text/html Size: 2919 bytes Desc: not available ------------------------------ Subject: Digest Footer _______________________________________________ OAuth mailing list -- oauth@ietf.org To unsubscribe send an email to oauth-le...@ietf.org ------------------------------ End of OAuth Digest, Vol 189, Issue 37 **************************************
_______________________________________________ OAuth mailing list -- oauth@ietf.org To unsubscribe send an email to oauth-le...@ietf.org
