Support recursive disclosures about sd-jwt-ts HOT 9 OPEN

Let me check the spec later, would be good to double check this. I might've missed this when reading through it.

from sd-jwt-ts.

I see, yes that is not possible currently. I think for now I will just apply the fix you provided with the __FIELD_NAME_TBD within the object. Not the cleanest but it should suffice for now. Thanks for pointing it out.

from sd-jwt-ts.

Just to be clear, it means that you can selectively disclose each attribute within a nested object AND the nested fully by itself? If it is an OR it is already supported, but not both together within a single credential.

from sd-jwt-ts.

I think it's an AND. You can e.g. have the whole credential object selectively discloseable, and within that object you could then either have:

• always disclosed values
• selectively discoseable values

and this could be nested as many layers deep as you want.

So to parse an SD-JWT to the decoded payload you would have to parse a disclosure, see if it has an _sd field of itself, and then do the same trick, until you find an object that does not have the _sd property anymore

from sd-jwt-ts.

But by making the credential object itself selectively disloseable, you don't give away that there is an credential object to begin with. In the complex example currently it is the case that you can see the credential key, while you could hide that, as well as make all items of the credential object itself selectively discloseable

from sd-jwt-ts.

It seems the Meeco implementation does support recursive disclosures: https://github.com/Meeco/sd-jwt

from sd-jwt-ts.

I can't seem to find an example of what this library does not support, do you have a direct link?

from sd-jwt-ts.

See the link to the spec I posted in my initial message: https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-06.html#name-example-sd-jwt-with-recursi

from sd-jwt-ts.

I think the following output is not possible:

{
  "_sd": ["credential-property-digest"]
}

With the following disclosures:

["salt", "credential", {
   "_sd": ["first-name-digest", "last-name-digest"]
}] // digest = "credential-property-digest"

["salt", "firstName", "Timo"] // digest = "first-name-digest"
["salt", "lastName", "Glastra"] // digest = "last-name-digest"

from sd-jwt-ts.