Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Credential Lifecycle] - Revocation with retroactive flag #302

Draft
wants to merge 3 commits into
base: versione-corrente
Choose a base branch
from
Draft

[Credential Lifecycle] - Revocation with retroactive flag #302

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9363a2c
[Credential Lifecycle] - Revocation with retroactive flag
SaraConsoliACN Jun 3, 2024
c5dd8dc
Updated according to the latest "draft-demarco-oauth-status-assertion…
SaraConsoliACN Jun 28, 2024
14e7525
blank space removed
SaraConsoliACN Jun 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/en/revocation-lists.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,9 @@ Credential Revocation Flows can start under different scenarios, such as:
- The Authentic Sources that for any administrative reasons update one or more attributes of a User, shall inform the Issuer of related Credentials.
- The Issuers, for technical security reasons (e.g. in the case of compromised cryptographic keys, death of the User, etc.), can decide to revoke the Credentials.

The Credential in some cases MUST be considered valid (thus is still accurate, useful and valid) for the period before the revocation: a driving license, revoked due expiration or other reasons, is still valid for the period before the revocation.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The Credential in some cases MUST be considered valid (thus is still accurate, useful and valid) for the period before the revocation: a driving license, revoked due expiration or other reasons, is still valid for the period before the revocation.
There are cases where a Credential MAY be considered valid (thus is still accurate, useful and valid) for a period after the revocation: a driving license, revoked due expiration or other reasons, MAY be still valid for the period after the revocation.

is this what you want to say?
could you please bring also legal evidences as example according to the italian regulation?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not really, considering the example of Residence Certificate: I may be resident in Rome up to 31st of December 2023. I change my residency to Milan from 1st of January 2024, thus the previous residency certificate gets revoked.
The residency certificate revoked (Rome's residency) is still valid for any activity/action related to year 2023 and before (e.g. I need to pay taxes in Rome city for 2023, and these taxes are paid in 2024).

Copy link
Member

@peppelinux peppelinux Jun 8, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the scope of this project is the definition of the technical rules. Legal and administrative aspects specifically related to the scopes of the credentials, according to their type or use cases, must be taken out of this specification.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As a general comment, the verifier policy always determines "validity", issuer's provide guidance and integrity protection, the "validity" is always in the eye of the verifier.

You might consider language like:

A verifier MAY accept credentials presented outside of their validity period, or with revoked or suspended status.
Verifier policies are out of scope for this document.


Revocation MUST therefore include a flag indicating whether it is retroactive or not. It SHOULD not invalidate further use of the credential, as it MAY be used to attest activity outside the revocation interval. If the "retroactive flag" is activated, the credential MUST be invalid also for the period prior to the revocation date. If the "retroactive flag" is not activated, the credential MUST be considered valid up to revocation date and could be used to demonstrate that, before revocation, the holder was entitled to perform related activities.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where this "flag" was discussed?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When there are 2 only possible options, you can differentiate them with a flag instead of having different parameters as the differentiating factor doesn't change the overall specifications. This is an approach, if you prefer different approach let us know

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would be cautious not to expose/mix operational guidance to issuers and verifiers, with protocol guidance to implementers.

For example:

It is recommended that Issuers maintain a log including the time and optionally reason for revocation or suspensions.

Retention policies for such logs are out of scope for this specification, and may be constrained by regional requirements, etc...


The revocation scenarios involve two main flows:

Expand Down
Loading