<div dir="ltr"><div>This email is designed to be controversial, not so much to create an argument as to act as a gut check to the OIDF general direction.</div><div><br></div><div>Assertions:</div><div>1. The primary source of privacy issues arise from the misuse of the User Issue Endpoint.</div><div>2. The best way to improve the privacy profile of access methods is to remove the User Issue Endpoint.</div><div><br></div><div>I believe these assertions match the general trend of access management in the past few years.</div><div>I would like to explore the elimination of the User Issue Endpoint in all future access methods.</div><div><br></div><div>The current alternative of interest to me is creating policy statements and/or credentials that can flow from the user to the agents.</div><div><br></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><font face="-apple-system, system-ui, system-ui, Segoe UI, Roboto, Helvetica Neue, Fira Sans, Ubuntu, Oxygen, Oxygen Sans, Cantarell, Droid Sans, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Lucida Grande, Helvetica, Arial, sans-serif" color="#38761d"><span style="font-size:14px;background-color:rgb(242,242,242)">Peace ..tom jones</span></font></div></div></div><br></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Thu, Sep 4, 2025 at 6:16 AM Brian Campbell via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>I suspect the intent of the homework runs a little deeper. Like perhaps coordinating with the UserInfo Verifiable Credentials authors to see if they are interested in reengaging with the work. Or understanding the rationale for some of the design decisions made - id token vs. userinfo endpoint vs. credential issuance endpoint being one that seems particularly relevant but just one. </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Aug 21, 2025 at 11:39 AM Dick Hardt via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Here is my homework as assigned by the working group chair. :)</div><div dir="ltr"><br></div><div>KB = OpenID Connect Key Binding</div><div>UVC = OpenID Connect UserInfo Verifiable Credentials</div><div>Links to specs at bottom</div><div><br></div><div><b>Tl;dr:<br></b>KB adds the key to an ID Token<br>UVC creates a verifiable credential with same info, but VC syntax</div><div>KB does it in one call to OP</div><div>UVC requires two calls to OP</div><div><br></div><div><b>Key Bound Token</b></div><div>KB outputs an id_token that includes a `cnf` claim of the public key</div><div>UVC outputs a verifiable credential with a `did:jwk:ey...` claim<br>Both include all the same user claims </div><div><br></div><div><br></div><div><b>Authentication Request</b></div><div>- KB uses `dpop` scope as well as `dpop_jkt` parameter</div><div>- UVC uses `userinfo_credential`</div><div dir="ltr"><br></div><div>KB has extra layer of security as `dpop_jkt` provides additional assurance between authentication request and token request</div><div><br><b>Token Request</b></div><div>- KB - RP passes DPoP JWT as header </div><div>- UVC has no changes</div><div><br></div><div><b>Token Response</b></div><div>- KB - OP passes back id_token that includes `cnf` claim</div><div>- UVC - OP passes back an access_token as well as c_nonce and c_nonce_expires_in</div><div><br></div><div>At this point, KB has completed the key binding ... </div><div><br></div><div><b>Credential Request and Response </b></div><div>UVC continues on <br></div><div>- RP generates a verifiable credential request and passes it with the access_token as a bearer token to the OP's credential endpoint </div><div>- OP returns a verifiable credential</div><div><br></div><div dir="ltr"><br><div><a href="https://dickhardt.github.io/openid-key-binding/main.html" target="_blank">https://dickhardt.github.io/openid-key-binding/main.html</a></div><div><a href="https://github.com/dickhardt/openid-key-binding" target="_blank">https://github.com/dickhardt/openid-key-binding</a></div><div><br></div><div><a href="https://openid.net/specs/openid-connect-userinfo-vc-1_0.html" target="_blank">https://openid.net/specs/openid-connect-userinfo-vc-1_0.html</a></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div></div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div>
<br>
<i style="margin:0px;padding:0px;border:0px;outline:0px;vertical-align:baseline;background:rgb(255,255,255);font-family:proxima-nova-zendesk,system-ui,-apple-system,system-ui,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",Arial,sans-serif;color:rgb(85,85,85)"><span style="margin:0px;padding:0px;border:0px;outline:0px;vertical-align:baseline;background:transparent;font-family:proxima-nova-zendesk,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",Arial,sans-serif;font-weight:600"><font size="2">CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.</font></span></i>_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div>