Apply changes suggested by @iherman on T3/T5 threats.

Author: msporny

threat-model/threats/t3-identifier-based-correlation.yaml

@@ -5,32 +5,37 @@ tags: [privacy]
 taxonomyName: STRIDE
 taxonomyClass: Information Disclosure
 description: >-
-  A [=verifiable credential=] can contain long-lived identifiers that can
-  be used to correlate a [=subject=] across contexts. These include
+  A [=verifiable credential=] can contain long-lived identifiers that can
+  be used to correlate a [=subject=] across contexts. These include
   [=subject=] identifiers in <code>credentialSubject.id</code>, credential
   identifiers, email addresses, government-issued identifiers, and
   organization-issued identifiers. When a [=E2|holder=]
   [=P8|generates a presentation=] and [=F3|exchanges=] it, any such
-  identifier that is disclosed to a [=E3|verifier=] can be linked to identifiers
+  identifier that is disclosed to a [=E3|verifier=] can be linked to identifiers
   disclosed elsewhere. Two [=E3|verifiers=], or an [=E1|issuer=] and a
   [=E3|verifier=], can then collude to track the [=E2|holder=] across
   domains and build a profile. Whether this threat is present depends on
-  deployment choices: which identifiers an [=E1|issuer=] places in a
-  credential; whether they can be selectively disclosed; and whether a
-  [=E2|holder=]'s software warns before sharing them; among other choices.
+  deployment choices: which identifiers an [=E1|issuer=] places in a
+  credential; whether they can be selectively disclosed; and whether a
+  [=E2|holder=]'s software warns before sharing them; among other choices.
 response:
   - id: R1
-    name: Selectively Disclosable and/or Single-Use Identifiers
+    name: Selectively Disclosable and/or Single-Use Identifiers
     type: Reduce
     description: >-
-      Deployments requiring anti-correlation properties can use identifiers that
+      Deployments requiring anti-correlation properties can use identifiers that
       are selectively disclosable, bound to a single origin, single-use, or
-      replaced by short-lived single-use bearer tokens. [=Holders=] prefer
-      [=verifiable credentials=] from [=issuers=] that support selective
-      disclosure of correlating identifiers, and securing-mechanism authors
+      replaced by short-lived single-use bearer tokens. Selective disclosure is
+      available across both families of securing mechanism: [[[VC-DATA-INTEGRITY]]]
+      defines selective disclosure cryptosuites, and [[[VC-JOSE-COSE]]] can carry
+      selective disclosure formats such as SD-JWT. A [=E2|holder=] therefore does
+      not have to choose a particular securing mechanism to obtain selective
+      disclosure of correlating identifiers. [=Holders=] prefer
+      [=verifiable credentials=] from [=issuers=] that support selective
+      disclosure of correlating identifiers, and securing-mechanism authors
       avoid designs that require correlating identifiers that cannot be
-      selectively disclosed or the use of verifiable credentials that do
-      not support selective disclosure.
+      selectively disclosed or the use of verifiable credentials that do
+      not support selective disclosure.
   - id: R2
     name: Warn Holders Before Sharing Correlatable Identifiers
     type: Reduce

threat-model/threats/t5-cryptographic-suite-obsolescence.yaml

@@ -44,3 +44,32 @@ response:
       experience. Deployments reduce the chance of a latent weakness by
       having experienced reviewers audit the suites and libraries they use,
       and by using red teaming to remove bias from those security reviews.
+  - id: R4
+    name: Issuer-Deployed Forgery Defense
+    type: Reduce
+    description: >-
+      [=E1|Issuers=] can deploy the mechanisms described in
+      [[[VC-FORGERY-DEFENSE]]], which layer additional, independent defenses
+      onto issued [=verifiable credentials=] so that a credential's authenticity
+      does not rest on a single securing mechanism alone. When an [=E1|issuer=]
+      applies these defenses at [=P3|issuance=], a [=E3|verifier=] can rely on
+      them at [=P10|verification=] to detect forged or modified
+      [=credentials=] even if one cryptography suite is later weakened or
+      broken. This raises the cost of a successful forgery and narrows the
+      window in which an obsolete suite can be exploited.
+  - id: R5
+    name: Use Reputable Cryptographic Libraries and Specialized Building Blocks
+    type: Reduce
+    description: >-
+      Secure cryptography is difficult and demands specialized skills;
+      implementers should not re-implement complex cryptographic algorithms
+      themselves. Wherever possible, deployments use well-established,
+      reputable cryptographic libraries that are actively maintained and
+      widely reviewed, and accept that a correct and secure implementation
+      requires expertise most application developers do not have. This
+      concern is not limited to cryptography: the other constituents of a
+      [=verifiable credential=] implementation, such as canonicalization,
+      securing-mechanism processing, and status checking, likewise call for
+      specialized care. Efforts such as [[[VCALM]]] aim to make it easier to
+      assemble implementations from vetted, specialized building blocks
+      rather than re-implementing sensitive components from scratch.