can be more complex as well. <ins> The Release is sent together with the SD-JWT from the holder to the verifier. </ins> 3.3. <del> A verifier first checks that the </del> <ins> A verifier checks that </ins> <del> was indeed signed by the private key belonging to the public key contained in </del> <ins> The detailed algorithm is described below. </ins> <del> . The verifier can then check that for each claim in </del> <ins> 4. </ins> <del> , the hash </del> <ins> This section defines data formats of SD-JWT that contains hashes of the salted claim values and SD-JWT Salt/Value Container that contains the mapping of the plain-text claim values and the salt values. </ins> <del> matches the hash under the given claim name in the SD-JWS. </del> <ins> 4.1. </ins> <del> 4. </del> <ins> An SD-JWT is a JWT that is optionally signed using the issuer's private key and contains following claims as payload. </ins> <del> A SD-JWS is a JWT signed using the issuer's private key.  The following shows an example for a SD-JWS document: </del> <ins> 4.1.1. </ins> <del> In </del> <ins> Payload of SD-JWT can consist of the following claims. </ins> <del> , the hashes are built by hashing over a JSON array containing the salt and the claim value, in the JSON notation: </del> <ins> 4.1.1.1. </ins> <del> . The salt values and the hashes are Base64url encoded, trailing </del> <ins> SD-JWT MUST include hashes of the salted claim values that are included by the issuer under the property </ins> <del> removed.  Note that the precise JSON encoding can vary, and therefore, the JSON encodings are sent to the holder along with the SD-JWS, as described below. </del> <ins> . </ins> <del> TODO: Consider using Base85 instead. </del> <ins> Issuer MUST choose a unique salt value for each claim value.  Each salt value MUST contain at least 128 bits of pseudorandom data, making it hard for an attacker to guess.  The salt value MUST then be encoded as a string.  It is RECOMMENDED to BASE64URL encode at least 16 pseudorandom bytes. </ins> <del> The SD-JWS is then signed by the issuer, to create a document like the following (shortened for presentation): </del> <ins> Issuer MUST build the hashes by hashing over a string that is formed by JSON-encoding an ordered array containing the salt and the claim value, e.g.: </ins> <del> 5. </del> <ins> .  The hash value is then BASE64URL-encoded.  Note that the precise JSON encoding can vary, and therefore, the JSON encodings MUST be sent to the holder along with the SD-JWT, as described below. </ins> <del> Besides the SD-JWS itself, the holder needs to learn the raw claim values that are contained in the SD-JWS, along with the precise input to the hash calculation, and the salts. </del> <ins> object can be a 'flat' object, directly containing all claim names and hashed claim values without any deeper structure. </ins> <del> The issuer therefore creates a Salt/Value Container (SVC) as follows: </del> <ins> object can also be a 'structured' object, where some claims and their respective hashes are contained in places deeper in the structure. It is up to the issuer to decide how to structure the representation such that it is suitable for the use case.  Examples 1 and 2 below show this using the OIDC </ins> <del> For transporting the SVC together with the SD-JWS from the issuer to the holder, the SVC is base64url encoded (as the parts of any JWS, todo reference) and appended to the SD-JWS using </del> <ins> claim, a structured claim.  Appendix 1 shows a more complex example using claims from eKYC (todo: reference). </ins> <del> as the separator: </del> <ins> Note that it is up to the issuer's discretion whether to turn the same payload of SD-JWT into 'flat' or 'structured' </ins> <del> (Shortened for presentation.) </del> <ins> SD-JWT object. </ins> <del> 6. </del> <ins> 4.1.1.2. If the issuer wants to enable holder binding, it includes a public key associated with the holder, or a reference thereto. It is out of the scope of this document to describe how the holder key pair is established.  For example, the holder MAY provide a key pair to the issuer, the issuer MAY create the key pair for the holder, or holder and issuer MAY use pre-established key material. Note: need to define how holder public key is included, right now examples are using I think. 4.1.1.3. The SD-JWT payload typically contains other JWT claims, such as , , etc. 4.1.2. This example shows a simple SD-JWT containing user claims.  The issuer here decided to use a completely flat structure, i.e., the claim can only be disclosed in full. In this example, these claims are the payload of the SD-JWT: The following shows the resulting SD-JWT payload: The SD-JWT is then signed by the issuer to create a document like the following: (Line breaks for presentation only.) 4.1.3. In this example, the issuer decided to create a structured object for the hashes.  This allows for the release of individual members of the address claim separately. The user claims are as in Example 1 above.  The resulting SD-JWT payload is as follows: 4.2. Besides the SD-JWT itself, the holder needs to learn the raw claim values that are contained in the SD-JWT, along with the precise input to the hash calculation, and the salts.  There MAY be other information the issuer needs to communicate to the holder, such as a private key key if the issuer selected the holder key pair. 4.2.1. A SD-JWT Salt/Value Container (SVC) is a JSON object containing at least the top-level property . Its structure mirrors the one of in the SD-JWT, but the values are the inputs to the hash calculations the issuer used, as strings. The SVC MAY contain further properties, for example, to transport the holder private key. </ins> <del> The following shows the contents of a proof document: </del> <ins> 4.2.2. The SVC for Example 1 is as follows: 4.2.3. The SVC for Example 2 is as follows: 4.3. For transporting the SVC together with the SD-JWT from the issuer to the holder, the SVC is base64ur-encoded and appended to the SD-JWT using as the separator.  For Example 1, the combined format looks as follows: (Line breaks for presentation only.) 4.4. The following shows the contents of a release document for Example 1: </ins> For each claim, an array of the salt and the claim value is contained in the object. <del> The SD-JWS Proof is then signed by the holder, to create a document like the following: </del> <ins> Again, the release document follows the same structure as the </ins> <del> 7. </del> <ins> in the SD-JWT.  For Example 2, a release document limiting to and only could look as follows: The SD-JWT Release MAY contain further claims, for example, to ensure a binding to a concrete transaction (in the example the and claims). If holder binding is desired, the SD-JWT Release is signed by the holder.  If no holder binding is to be used, the algorithm is used, i.e., the document is not signed. </ins> <del> The SD-JWS and the SD-JWS Proof can be combined into one document </del> <ins> In any case, the result is encoded as described in RFC7519 (here for Example 1): (Line breaks for presentation only.) 4.5. The SD-JWT and the SD-JWT Release can be combined into one document </ins> using <del> as a separator: </del> <ins> as a separator (here for Example 1): </ins> <del> 8. </del> <ins> (Line breaks for presentation only.) 5. Verifiers MUST follow RFC8725 for checking the SD-JWT and, if signed, the SD-JWT Release. Verifiers MUST go through (at least) the following steps before trusting/using any of the contents of an SD-JWT: If any step fails, the input is not valid and processing MUST be aborted. 6. </ins> For the security of this scheme, the following properties are required of the hash function: <del> 9. </del> <ins> Add: The Salts must be random/long enough so that the attacker cannot brute force them. Note: No need for the wallet-generated hashes? to prevent issuer- verifier collusion 6.1. 7. </ins> TBD <del> 10. </del> <ins> 8. </ins> We would like to thank ... <del> 11. </del> <ins> 9. </ins> TBD