You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: draft-ietf-oauth-status-list.md
+10-6Lines changed: 10 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -490,7 +490,7 @@ By including a "status" claim in a Referenced Token, the Issuer is referencing a
490
490
491
491
## Referenced Token in JOSE {#referenced-token-jose}
492
492
493
-
The Referenced Token MAY be encoded as a "JSON Web Token (JWT)" according to {{RFC7519}}, as an SD-JWTs {{RFC9901}}, as an SD-JWT VCs {{SD-JWT.VC}} or other formats based on JOSE.
493
+
The Referenced Token MAY be encoded as a "JSON Web Token (JWT)" according to {{RFC7519}}, as an SD-JWT {{RFC9901}}, as an SD-JWT VC {{SD-JWT.VC}} or other formats based on JOSE.
494
494
495
495
The following content applies to the JWT Claims Set:
496
496
@@ -727,7 +727,7 @@ If a Relying Party encounters an error while validating one of the Status List T
727
727
There are two options for a Relying Party to retrieve the Status List Aggregation.
728
728
An Issuer MAY support any of these mechanisms:
729
729
730
-
- Issuer metadata: The Issuer of the Referenced Token publishes an URI which links to Status List Aggregation, e.g. in publicly available metadata of an issuance protocol
730
+
- Issuer metadata: The Issuer of the Referenced Token publishes a URI which links to Status List Aggregation, e.g. in publicly available metadata of an issuance protocol
731
731
- Status List Parameter: The Status Issuer includes an additional claim in the Status List Token that contains the Status List Aggregation URI.
732
732
733
733
~~~ ascii-art
@@ -926,7 +926,7 @@ The tuple of uri and index inside the Referenced Token are unique and therefore
926
926
927
927
Two or more colluding parties (e.g Relying Parties and or the Status Issuer) may link two transactions involving the same Referenced Token by comparing the status claims of received Referenced Tokens and therefore determine that they have interacted with the same Holder.
928
928
929
-
To avoid privacy risks of this possible collusion, it is RECOMMENDED that Issuers provide the ability to issue batches of one-time-use Referenced Tokens, enabling Holders to use in a single interaction with a Relying Party before discarding. See [](#implementation-linkability) to avoid further correlatable information by the values of `uri` and `idx`, Status Issuers are RECOMMENDED to:
929
+
To avoid privacy risks of this possible collusion, it is RECOMMENDED that Issuers provide the ability to issue batches of one-time-use Referenced Tokens, enabling Holders to use them in a single interaction with a Relying Party before discarding. See [](#implementation-linkability) to avoid further correlatable information by the values of `uri` and `idx`, Status Issuers are RECOMMENDED to:
930
930
931
931
- choose non-sequential, pseudo-random or random indices
932
932
- use decoy entries to obfuscate the real number of Referenced Tokens within a Status List
@@ -948,7 +948,7 @@ There are strong privacy concerns that have to be carefully taken into considera
948
948
949
949
As previously explained, there is the potential risk of observability by Relying Parties (see [](#privacy-relying-party)) and Outsiders (see [](#privacy-outsider)). That means that any Status Type that transports information beyond the routine statuses VALID and INVALID about a Referenced Token can leak information to other parties. This document defines one additional Status Type with "SUSPENDED" that conveys such additional information, but in practice all statuses other than VALID and INVALID are likely to contain information with privacy implications.
950
950
951
-
Ecosystems that want to use other Status Types than "VALID" and "INVALID" should consider the possible leakage of data and profiling possibilities before doing so and evaluate if revocation and re-issuance might a better fit for their use-case.
951
+
Ecosystems that want to use other Status Types than "VALID" and "INVALID" should consider the possible leakage of data and profiling possibilities before doing so and evaluate if revocation and re-issuance might be a better fit for their use-case.
952
952
953
953
# Operational Considerations {#implementation}
954
954
@@ -1295,7 +1295,7 @@ This section requests registration of the following media types {{RFC2046}} in
1295
1295
the "Media Types" registry {{IANA.MediaTypes}} in the manner described
1296
1296
in {{RFC6838}}.
1297
1297
1298
-
To indicate that the content is an JWT-based Status List:
1298
+
To indicate that the content is a JWT-based Status List:
1299
1299
1300
1300
* Type name: application
1301
1301
* Subtype name: statuslist+jwt
@@ -1315,7 +1315,7 @@ To indicate that the content is an JWT-based Status List:
1315
1315
* Change controller: IETF
1316
1316
* Provisional registration? No
1317
1317
1318
-
To indicate that the content is an CWT-based Status List:
1318
+
To indicate that the content is a CWT-based Status List:
1319
1319
1320
1320
* Type name: application
1321
1321
* Subtype name: statuslist+cwt
@@ -1823,6 +1823,10 @@ CBOR encoding:
1823
1823
1824
1824
\[\[ To be removed from the final specification \]\]
0 commit comments