@@ -1592,19 +1592,19 @@ <h3>Decoy Values</h3>
1592
1592
to increase the privacy of [=subjects=]. While algorithms for employing decoy
1593
1593
values are out of scope for this specification, implementers are advised that
1594
1594
the use of decoy values can harm privacy if the decoy values do not accurately
1595
- simulate the population associated with the status list. If decoy values are not
1596
- accurately simulated, it can reduce the anonymity provided in the set by the
1597
- number of decoy values that are detectably not a part of the status list
1598
- population. The most privacy-preserving status list is one that never changes
1599
- since the behavior of the population cannot be determined if no observable
1600
- events happen.
1595
+ simulate the population associated with the status list. If decoy values can
1596
+ be distinguished from real values, the anonymity provided in the set will be
1597
+ reduced by the number of decoy values that are detectable as such. The most
1598
+ privacy-preserving status list is one that never changes, since the behavior
1599
+ of the population cannot be determined if no observable events occur.
1601
1600
</ p >
1602
1601
< p >
1603
1602
Given how difficult it is to statistically simulate a population when it comes
1604
1603
to status entries, and that general advice cannot be given since [=verifiable
1605
1604
credentials=] serve a broad set of use cases, implementers are advised to
1606
1605
allocate status list entry indexes randomly and strive to eliminate the rate at
1607
- which status entries are changed.
1606
+ which status entries are changed. Status list entry allocation is most privacy
1607
+ preserving when it does not trigger any observable change to a status list.
1608
1608
</ p >
1609
1609
</ section >
1610
1610
0 commit comments