2 ms·
> For instance: The relying party server needs to call the auth server on novel users. Thats a new, unavoidable indicator! Not really. There is no requirement
by bawolff 1y ago
> For instance: The relying party server needs to call the auth server on novel users. Thats a new, unavoidable indicator!
Not really. There is no requirement here for an auth server to neccesarily even exist.
That said, your broader point is correct, that the details matter a tremendous amount.
- Tadpole9181 1y agoOh, that's my bad, I re-read the privacy pass protocol to brush up and it does use signing without requiring the RP to necessarily make another call to the original approver server. I also see there's been work on hidden witness ZKP, so the RP may not even know who approved a given token. Very cool! Always happy to be proven wrong with cool tech!