make iat in SD-JWT selectively disclosable during presentation

[Sakurann]

from @peppelinux

well, the "human behaviour" may create the practice to get you to update the PID on your birthday, producing a certain information leakage in the meaning of iat. I propose that iat should be in MAY and that there is no problem with making it opaque and SD

[Sakurann]

this is obsolete since sd-jwt vc already made iat selectively disclosable. https://drafts.oauth.net/oauth-sd-jwt-vc/draft-ietf-oauth-sd-jwt-vc.html#section-3.2.2.2-4

need to discuss if we want to mandate iat to be selectively disclosable, since sd-jwt vc spec says iat MAY be selectively disclosable

[nemqe]

Dumb question, but if the iat leaks, don't then exp or nbf leak as well?

[danielfett]

Not necessarily. It can be chosen independently.

[danielfett]

We should just remove any extra rule regarding the claims disclosability in HAIP and do whatever SD-JWT VC ends up mandating.

[jogu]

Discussed on today's working group call: @javereec to review/comment.

Jan asked: Am I right that in mdoc this information is not selectively disclosable?

[javereec]

Regarding my comment in the WG. I checked this in 18013-5 and how I read it, the MSO contains ValidityInfo, which contains signed, validFrom and validUntil which are not selectively disclosable.

I understand that adding it for SD-JWT VC might bring a benefit, but it would be inconsistent with capabilities from mdoc.

[Sakurann]

discussed in the WG call. WG agreement to align with the sd-jwt vc requirements unless there is a strong reason not to. this issue predates sd-jwt vc progress. closing in a week unless objections.