conflicting text about unlinkability and exp/iat/nbf
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 125
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
https://www.rfc-editor.org/info/rfc9901/#section-10.1-9 says:
Likewise, claims carrying time information, like iat, exp, and nbf, MUST either be randomized within a time period considered appropriate (e.g., randomize iat within the last 24 hours and calculate exp accordingly) or rounded (e.g., rounded down to the beginning of the day).
where as https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-unique-values-encoded-in-th says:
Claims containing time-related information, such as issuance or expiration dates, SHOULD be either individually randomized within an appropriate time window (e.g., within the last 24 hours), or rounded (e.g., to the start of the day), to avoid unintended correlation factors.
This seems to have downgraded the 'MUST' to a 'SHOULD'. I'd imagine that wasn't intentional?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare the wording in RFC 9901 section 10.1 and the OpenID4VCI section “Unique Values Encoded in the ...” linked in the issue. Check whether the MUST/SHOULD difference is intentional, then align the specification wording or document the rationale for keeping it; done means the discrepancy has a clear resolution.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100