Selective disclosure of the email address

[jespertheend]

This blog post contains a section describing selective disclosure of the email address:

Important: The email claim can be selectively disclosed. If it is selectively disclosed, you receive a hash, instead of the email address, that you can verify by generating the same hash against the expected email address. We recommend supporting both formats.

But the spec never mentions anything about this mechanism. In fact, draft-hardt-email-verification.md mentions:

though this protocol does not use selective disclosure features

So now I'm a bit confused on whether I should actually support this scenario.
Both Gmail and https://rowan.fyi/made/email-provider don't seem to issue jwt's with this mechanism either, so I'm not really able to test my implementation anyway.

[dickhardt]

@jespertheend the blog post is incorrect. We are using the SD-JWT format so existing libraries can be used, and for the browser to mediate the RP and issuer interaction without disclosing the RP identity to the issuer using the KB token.

[rowan-m]

I've got some updates to cover and will make sure the blog post gets corrected. Thank you for pointing this out!

[samuelgoto]

Re-opening, since it is not clear to me that the browser recommendation is necessarily the bit that needs to be changed, rather than the protocol.

[samuelgoto]

Keeping this open until dickhardt/email-verification#21 gets resolved. @rowan-m I'd hold on to making any documentation / recommendation changes before we resolve this issue.