make iat in SD-JWT selectively disclosable during presentation

[Sakurann]

from @peppelinux

well, the "human behaviour" may create the practice to get you to update the PID on your birthday, producing a certain information leakage in the meaning of iat. I propose that iat should be in MAY and that there is no problem with making it opaque and SD

[Sakurann]

this is obsolete since sd-jwt vc already made iat selectively disclosable. https://drafts.oauth.net/oauth-sd-jwt-vc/draft-ietf-oauth-sd-jwt-vc.html#section-3.2.2.2-4

need to discuss if we want to mandate iat to be selectively disclosable, since sd-jwt vc spec says iat MAY be selectively disclosable

[nemqe]

Dumb question, but if the iat leaks, don't then exp or nbf leak as well?

[danielfett]

Not necessarily. It can be chosen independently.