bk99.de entertain the web since 1997

bk99.de
RFC · PrivacyStandard explained

RFC 9901: Selective disclosure for JWTs

Summary

RFC 9901 defines SD-JWT so that holders disclose only the claims they need from a signed record. Digital credentials do not have to choose between full disclosure and no verifiability. Data minimisation can be enforced cryptographically.

Ideas

  • Issuers sign hash bindings instead of making all values visible.
  • Holders choose suitable disclosures for each recipient.
  • Key binding can tie possession to a key.

Remarks

  • RFC 9901 has the status “Proposed Standard”; current errata and successor documents should also be checked.

Recommendations

  • Request only the claims you actually need.
  • Check issuer, disclosures, nonce and key binding.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2013

RFC 6973: Considering privacy in internet protocols

RFC 6973 provides systematic guidance for spotting privacy consequences as early as protocol design. Privacy is an architectural property and not just a user interface option. Unintended linkability often comes from identifiers that stay stable for a long time.

CCC · 2024

We know where your car is parked

Michael Kreil and Flüpke show how movement data from 800,000 electric cars, including owner information, was accessible without protection and revealed sensitive routines. The two of them gave the talk together. The exposed data concerned around 800,000 electric cars.

HF · 2023

Federated learning with Flower

The article trains transformers via Flower without bringing the participants’ raw data together centrally. Only local model updates are coordinated and aggregated. Flower coordinates federated training rounds between clients and server.