Re: [COSE] [Cose]: RFC8152(bis) question(s) (draft-ietf-anima-constrained-voucher)

[Toerless Eckert <[e-mail]>]

On Thu, Jul 22, 2021 at 06:20:18PM +0200, Carsten Bormann wrote:
> The European Digital Green Card (Covid pass) uses a CWT with claim -260.
> Given that the claim -260 is registered in the CWT registry [1], there is no need to provide any other semantics with the signed object.

?? Let me see if i correctly parsed the relevant info from the docs:

-> A CWT is a COSE object right ?

-> RFC8392 does specify a Media Type application/cwt for it, so there IS
   some level of semantic for the COSE payload expressed in the COSE object Media Type.
   Except that the actual semantic of the cwt is in the CBOR claim key field.

If i understand it right, this would be an example i was looking for,
and given the short name 'cwt' i couldn't find it, looking for 'cose' in the
Media Type registry. I guess our work could equally have asked for a
more hib abbreviation application/cbv (constrained brski voucher) ;-)

I am not so sure if demuxing the actual semantic by the claim key field
alone would be sufficient when you had cases where you may needed to find
a specific type CWT. Like when you had a drawer full of tokens, and you
wanted to find the health certificate purely from the envelope without
having to open up the COSE envelope and look into the claim key field of
every token in the drawer. But i guess the expectation in general is that
you wouldn't run into this situation in the targeted use-cases, and if you
do, yo'd have to put another envelope around the tokens with a new
registry (or mapping the CWT registry to that envelope).

> If you do not use a CWT, you may want some other form of identification of what the payload is about, and the COSE content-type header parameter (3) is one of them.

Right. So why did RFC8392 not use the COSE content type field but
invented its own claim key field ? Question for yet another WG (ACE) ? ;-))

Cheers
   Toerless

> Grüße, Carsten
> 
> [1]: https://www.iana.org/assignments/cwt/cwt.xhtml
> Scroll down to hcert

-- 
---
[e-mail]