IETF Last Call Review of draft-ietf-oauth-selective-disclosure-jwt-17
review-ietf-oauth-selective-disclosure-jwt-17-secdir-lc-emery-2025-04-13-00

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area directors.
 Document editors and WG chairs should treat these comments just like any other
last call comments.

This standards track draft specifies a mechanism for disclosing targeted claims
in a JSON Web Token (JWT).

This security considerations section does exist and provides examples of the
consequences of a naive Verifier in relation to the security and correctness of
the protocol.  The section continues with a discussion on salt generation and
hash algorithm selection.  Despite specifying SHA-256 as the default hash
algorithm, the protocol does not appear to be susceptible to length extension
attacks because the Issuer signs the SD-JWT, which includes each of the
Disclosure hashes.  The security implications of the optional key binding
feature (Holder proves authenticity of SDs to Verifier) are also discussed. 
Lastly, the section covers disclosing claim names, validity claims,
verification key life-cycle, credential forwarding, SD-JWT* integrity, and type
attacks.  I believe that this section provides sufficient coverage for the
various types of attacks and procedures to mitigate against such attacks.

The authors have also included a privacy section, which includes subsections on
unlinkability, SD-JWT confidentiality in transit and at rest, usage of digest
decoys, and considerations of identifying Issuers.  The privacy section appears
to be comprehensive and the outlined procedures to protect privacy seems to be
adequate.

General Comments:

Thank you for including examples in each of the pertinent sections of the draft.

Editorial Comments:

s/ecosystem/operating environment/

for those who celebrate ;)