Re: [COSE] [Cose]: RFC8152(bis) question(s) (draft-ietf-anima-constrained-voucher)

[Carsten Bormann <[e-mail]>]

On 22. Jul 2021, at 18:41, Toerless Eckert <[e-mail]> wrote:
> 
> 
> On Thu, Jul 22, 2021 at 06:20:18PM +0200, Carsten Bormann wrote:
>> The European Digital Green Card (Covid pass) uses a CWT with claim -260.
>> Given that the claim -260 is registered in the CWT registry [1], there is no need to provide any other semantics with the signed object.
> 
> ?? Let me see if i correctly parsed the relevant info from the docs:
> 
> -> A CWT is a COSE object right ?

Yes, with an unprotected CWT claims set (UCCS) inside [1].

[1]: https://www.ietf.org/archive/id/draft-ietf-rats-uccs-01.html
(We are doing this the wrong way around…)

> -> RFC8392 does specify a Media Type application/cwt for it, so there IS
>   some level of semantic for the COSE payload expressed in the COSE object Media Type.
>   Except that the actual semantic of the cwt is in the CBOR claim key field.

That is not one field; the claim keys are map keys.

> If i understand it right, this would be an example i was looking for,
> and given the short name 'cwt' i couldn't find it, looking for 'cose' in the
> Media Type registry. I guess our work could equally have asked for a
> more hib abbreviation application/cbv (constrained brski voucher) ;-)
> 
> I am not so sure if demuxing the actual semantic by the claim key field
> alone would be sufficient when you had cases where you may needed to find
> a specific type CWT. Like when you had a drawer full of tokens, and you
> wanted to find the health certificate purely from the envelope without
> having to open up the COSE envelope and look into the claim key field of
> every token in the drawer.

That is not a good strategy, as any token you present is disclosing some information and you only want to disclose that to someone that your overseeing principal authorizes to receive it.  So you better have a better grip on the tokens that you can hand out.

>> If you do not use a CWT, you may want some other form of identification of what the payload is about, and the COSE content-type header parameter (3) is one of them.
> 
> Right. So why did RFC8392 not use the COSE content type field but
> invented its own claim key field ?

CWT for COSE what JWT is for JOSE.
No invention at all.

Grüße, Carsten