You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
"body": "Would this work for you as well @OR13 ?",
23157
+
"createdAt": "2026-01-30T08:35:50Z",
23158
+
"updatedAt": "2026-01-30T08:35:50Z"
23159
+
},
23160
+
{
23161
+
"author": "OR13",
23162
+
"authorAssociation": "NONE",
23163
+
"body": "I think this is much better. It puts the responsibility for any weird behavior regarding network requests for invalid tokens, on the spec that defines those tokens.\n\nI will clear my discuss, when the new revision is published.",
23164
+
"createdAt": "2026-01-30T13:32:06Z",
23165
+
"updatedAt": "2026-01-30T13:32:06Z"
23166
+
}
23167
+
],
23168
+
"reviews": [
23169
+
{
23170
+
"id": "PRR_kwDOJZ2aqs7d5DTA",
23171
+
"commit": {
23172
+
"abbreviatedOid": "198bac1"
23173
+
},
23174
+
"author": "OR13",
23175
+
"authorAssociation": "NONE",
23176
+
"state": "COMMENTED",
23177
+
"body": "",
23178
+
"createdAt": "2026-01-29T13:28:29Z",
23179
+
"updatedAt": "2026-01-29T13:28:30Z",
23180
+
"comments": [
23181
+
{
23182
+
"originalPosition": 5,
23183
+
"body": "Why is this SHOULD not a MUST? Its always good to describe when SHOULDs are expected to be ignored.\r\n\r\nThe only reason I can see for the SHOULD is that sometimes \"tracking / telemetry is useful\"...\r\n\r\n\"To ensure tracking is NOT RECOMMENDED, an invalid Referenced Token SHOULD halt all subsequent Status List procedures, including token fetching, unless further evaluation is explicitly required by the use case.\"\r\n\r\n... If you have another use case in mind, I would recommend sharing it... for personal credentials... this reads uncomfortably.",
23184
+
"createdAt": "2026-01-29T13:28:29Z",
23185
+
"updatedAt": "2026-01-29T13:28:30Z"
23186
+
}
23187
+
]
23188
+
},
23189
+
{
23190
+
"id": "PRR_kwDOJZ2aqs7eJEL6",
23191
+
"commit": {
23192
+
"abbreviatedOid": "198bac1"
23193
+
},
23194
+
"author": "paulbastian",
23195
+
"authorAssociation": "CONTRIBUTOR",
23196
+
"state": "COMMENTED",
23197
+
"body": "",
23198
+
"createdAt": "2026-01-30T08:12:28Z",
23199
+
"updatedAt": "2026-01-30T08:12:29Z",
23200
+
"comments": [
23201
+
{
23202
+
"originalPosition": 5,
23203
+
"body": "Hi @OR13 ,\r\n\r\ngiven that we have the \"unless\" condition in there, we are fine to make this a MUST.\r\n\r\n```suggestion\r\nUpon receiving a Referenced Token, a Relying Party MUST first perform the validation of the Referenced Token - e.g., checking for expected attributes, valid signature and expiration time. The processing rules for Referenced Tokens (such as JWT or CWT) MUST precede any evaluation of a Referenced Token's status. For example, if a token is evaluated as being expired through the \"exp\" (Expiration Time) but also has a status of 0x00 (\"VALID\"), the token is considered expired. If the validation procedures for the Referenced Token determine it is invalid, no further procedures regarding Status List MUST be performed, e.g. fetching a Status List Token, unless the Referenced Token procedures or the use case require further evaluation.\r\n```",
"body": "> we still have some mention of sd-jwt vc i the abstract / terminology, but I guess that would be fine\r\n\r\nI removed the other mentions of SD-JWT VC, so it fits better.",
23280
+
"createdAt": "2026-01-30T08:54:13Z",
23281
+
"updatedAt": "2026-01-30T08:54:13Z"
23282
+
},
23283
+
{
23284
+
"author": "paulbastian",
23285
+
"authorAssociation": "CONTRIBUTOR",
23286
+
"body": "@OR13",
23287
+
"createdAt": "2026-01-30T08:55:05Z",
23288
+
"updatedAt": "2026-01-30T08:55:05Z"
23289
+
}
23290
+
],
23291
+
"reviews": [
23292
+
{
23293
+
"id": "PRR_kwDOJZ2aqs7eJeLk",
23294
+
"commit": {
23295
+
"abbreviatedOid": "2ebffcb"
23296
+
},
23297
+
"author": "c2bo",
23298
+
"authorAssociation": "MEMBER",
23299
+
"state": "APPROVED",
23300
+
"body": "we still have some mention of sd-jwt vc i the abstract / terminology, but I guess that would be fine",
23301
+
"createdAt": "2026-01-30T08:37:11Z",
23302
+
"updatedAt": "2026-01-30T08:40:02Z",
23303
+
"comments": [
23304
+
{
23305
+
"originalPosition": 14,
23306
+
"body": "```suggestion\r\nToken formats secured by JOSE {{RFC7515}} or COSE {{RFC9052}}, such as JWTs {{RFC7519}}, SD-JWTs {{RFC9901}, CWTs {{RFC8392}} and ISO mdoc {{ISO.mdoc}}, have vast possible applications. Some of these applications can involve issuing a token whereby certain semantics about the token or its validity may change over time. Communicating these changes to relying parties in an interoperable manner, such as whether the token is considered invalidated or suspended by its issuer is important for many of these applications.\r\n```",
0 commit comments