Skip to content

Commit 027cdf3

Browse files
committed
more nits
1 parent 66a0b50 commit 027cdf3

1 file changed

Lines changed: 10 additions & 6 deletions

File tree

draft-ietf-oauth-status-list.md

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -490,7 +490,7 @@ By including a "status" claim in a Referenced Token, the Issuer is referencing a
490490

491491
## Referenced Token in JOSE {#referenced-token-jose}
492492

493-
The Referenced Token MAY be encoded as a "JSON Web Token (JWT)" according to {{RFC7519}}, as an SD-JWTs {{RFC9901}}, as an SD-JWT VCs {{SD-JWT.VC}} or other formats based on JOSE.
493+
The Referenced Token MAY be encoded as a "JSON Web Token (JWT)" according to {{RFC7519}}, as an SD-JWT {{RFC9901}}, as an SD-JWT VC {{SD-JWT.VC}} or other formats based on JOSE.
494494

495495
The following content applies to the JWT Claims Set:
496496

@@ -727,7 +727,7 @@ If a Relying Party encounters an error while validating one of the Status List T
727727
There are two options for a Relying Party to retrieve the Status List Aggregation.
728728
An Issuer MAY support any of these mechanisms:
729729

730-
- Issuer metadata: The Issuer of the Referenced Token publishes an URI which links to Status List Aggregation, e.g. in publicly available metadata of an issuance protocol
730+
- Issuer metadata: The Issuer of the Referenced Token publishes a URI which links to Status List Aggregation, e.g. in publicly available metadata of an issuance protocol
731731
- Status List Parameter: The Status Issuer includes an additional claim in the Status List Token that contains the Status List Aggregation URI.
732732

733733
~~~ ascii-art
@@ -926,7 +926,7 @@ The tuple of uri and index inside the Referenced Token are unique and therefore
926926

927927
Two or more colluding parties (e.g Relying Parties and or the Status Issuer) may link two transactions involving the same Referenced Token by comparing the status claims of received Referenced Tokens and therefore determine that they have interacted with the same Holder.
928928

929-
To avoid privacy risks of this possible collusion, it is RECOMMENDED that Issuers provide the ability to issue batches of one-time-use Referenced Tokens, enabling Holders to use in a single interaction with a Relying Party before discarding. See [](#implementation-linkability) to avoid further correlatable information by the values of `uri` and `idx`, Status Issuers are RECOMMENDED to:
929+
To avoid privacy risks of this possible collusion, it is RECOMMENDED that Issuers provide the ability to issue batches of one-time-use Referenced Tokens, enabling Holders to use them in a single interaction with a Relying Party before discarding. See [](#implementation-linkability) to avoid further correlatable information by the values of `uri` and `idx`, Status Issuers are RECOMMENDED to:
930930

931931
- choose non-sequential, pseudo-random or random indices
932932
- use decoy entries to obfuscate the real number of Referenced Tokens within a Status List
@@ -948,7 +948,7 @@ There are strong privacy concerns that have to be carefully taken into considera
948948

949949
As previously explained, there is the potential risk of observability by Relying Parties (see [](#privacy-relying-party)) and Outsiders (see [](#privacy-outsider)). That means that any Status Type that transports information beyond the routine statuses VALID and INVALID about a Referenced Token can leak information to other parties. This document defines one additional Status Type with "SUSPENDED" that conveys such additional information, but in practice all statuses other than VALID and INVALID are likely to contain information with privacy implications.
950950

951-
Ecosystems that want to use other Status Types than "VALID" and "INVALID" should consider the possible leakage of data and profiling possibilities before doing so and evaluate if revocation and re-issuance might a better fit for their use-case.
951+
Ecosystems that want to use other Status Types than "VALID" and "INVALID" should consider the possible leakage of data and profiling possibilities before doing so and evaluate if revocation and re-issuance might be a better fit for their use-case.
952952

953953
# Operational Considerations {#implementation}
954954

@@ -1295,7 +1295,7 @@ This section requests registration of the following media types {{RFC2046}} in
12951295
the "Media Types" registry {{IANA.MediaTypes}} in the manner described
12961296
in {{RFC6838}}.
12971297

1298-
To indicate that the content is an JWT-based Status List:
1298+
To indicate that the content is a JWT-based Status List:
12991299

13001300
* Type name: application
13011301
* Subtype name: statuslist+jwt
@@ -1315,7 +1315,7 @@ To indicate that the content is an JWT-based Status List:
13151315
* Change controller: IETF
13161316
* Provisional registration? No
13171317

1318-
To indicate that the content is an CWT-based Status List:
1318+
To indicate that the content is a CWT-based Status List:
13191319

13201320
* Type name: application
13211321
* Subtype name: statuslist+cwt
@@ -1823,6 +1823,10 @@ CBOR encoding:
18231823

18241824
\[\[ To be removed from the final specification \]\]
18251825

1826+
-19
1827+
1828+
* grammar, spelling, nits
1829+
18261830
-18
18271831

18281832
* add references to SD-JWT VC and SD-CWT

0 commit comments

Comments
 (0)