@@ -417,7 +417,7 @@ If the `iss` value contains a path component, any terminating `/` MUST be
417
417
removed before inserting ` /.well-known/ ` and the well-known URI suffix
418
418
between the host component and the path component.
419
419
420
- The following is a non-normative example of a HTTP request for the JWT VC Issuer
420
+ The following is a non-normative example of an HTTP request for the JWT VC Issuer
421
421
Metadata configuration when ` iss ` is set to ` https://example.com/tenant/1234 ` :
422
422
423
423
```
@@ -1104,7 +1104,7 @@ described in (#privacy-preserving-retrieval-of-type-metadata).
1104
1104
1105
1105
Some claims in the SD-JWT VC and properties in the Type Metadata, e.g., ` display ` , allows issuers and providers of metadata to
1106
1106
specify human-readable information. These can contain arbitrary textual information that
1107
- may be displayed to developers. As such, any consuming application MUST ensure that maliciously
1107
+ may be displayed to end users and developers. As such, any consuming application MUST ensure that maliciously
1108
1108
crafted information cannot be used to compromise the security of the application
1109
1109
or the privacy of the user. To this end, the following considerations apply:
1110
1110
@@ -1150,13 +1150,13 @@ to phone home to the Issuer.
1150
1150
1151
1151
For example, a malicious Issuer could generate a unique value for the Issuer identifier
1152
1152
per Holder, e.g., ` https://example.com/issuer/holder-1234 ` and host the JWT VC Issuer Metadata.
1153
- The Verifier would create a HTTPS GET request to the Holder-specific well-known URI
1153
+ The Verifier would create an HTTP GET request to the Holder-specific well-known URI
1154
1154
when the SD-JWT VC is verified. This would allow the malicious Issuer to keep track where
1155
1155
and how often the SD-JWT VC was used.
1156
1156
1157
1157
Verifiers are advised to establish trust in an SD-JWT VC by pinning specific Issuer identifiers
1158
- and should monitor suspicious behaviour such as frequently rotating Issuer identifiers.
1159
- If such behaviour was detected, Verifiers are advised to reject SD-JWT VCs issued by such
1158
+ and should monitor suspicious behaviour such as frequent rotation of those identifiers.
1159
+ If such behaviour is detected, Verifiers are advised to reject SD-JWT VCs issued by those
1160
1160
Issuers.
1161
1161
1162
1162
Holders are advised to reject SD-JWT VCs if they contain easily correlatable information
@@ -1175,14 +1175,14 @@ format encoded as CBOR and secured using COSE.
1175
1175
1176
1176
In (#retrieving-type-metadata), various methods for distributing and retrieving
1177
1177
Type Metadata are described. For methods which rely on a network connection to a
1178
- URL (e.g., provided by an Issuer), third parties (like the Issuer) may be able
1178
+ URL (e.g., provided by an Issuer), the Issuer and other third parties may be able
1179
1179
to track the usage of a credential by observing requests to the Type Metadata URL.
1180
1180
1181
1181
Consumers SHOULD prefer methods for retrieving Type Metadata that do not
1182
1182
leak information about the usage of a credential to third parties. The
1183
1183
recommendations in (#robust-retrieval) apply.
1184
1184
1185
- <reference anchor =" IANA.well-known " target =" http ://www.iana.org/assignments/well-known-uris" >
1185
+ <reference anchor =" IANA.well-known " target =" https ://www.iana.org/assignments/well-known-uris" >
1186
1186
<front>
1187
1187
<title>Well-Known URIs</title>
1188
1188
<author>
@@ -1540,6 +1540,7 @@ We would like to thank
1540
1540
Aaron Parecki,
1541
1541
Alen Horvat,
1542
1542
Andres Uribe,
1543
+ Andrii Deinega,
1543
1544
Babis Routis,
1544
1545
Christian Bormann,
1545
1546
George J Padayatti,
0 commit comments