Re: [COSE] Consensus Call: Adoption of the COSE Token

I personally believe that the core CBOR Web Token (CWT) spec should define equivalents of the same seven general-purpose claims that JSON Web Token (JWT) http://tools.ietf.org/html/rfc7519 defined (iss, sub, aud, exp, nbf, iat, and jti), define the CWT Claims Registry, and stop there.  Keeping the target simple in that manner means that this could get done VERY quickly.

Then applications, such as ACE protocols and applications, could define additional claims used by those applications and register them in the CWT Claims Registry.  Keeping the general-purpose and application-specific claim definitions in different specs is important to having CWT be a general-purpose spec, rather than being viewed as being slanted towards a particular application or application area.  It also means it will get done much faster.

IoT/ACE expertise is critical for defining the supplemental IoT/ACE claims.  It's unnecessary for developing the base CWT spec.  Whereas the expertise that created JWT, which we'd be doing a functional clone of, is in the OAuth working group.  Therefore, I believe the best answer is:

B) Define the COSE Token inside the OAuth working group.

				-- Mike

P.S.  For those wanting to wrap their heads around what we're concretely talking about, Erik Wahlström was kind enough to write a first draft https://tools.ietf.org/html/draft-wahlstroem-oauth-cbor-web-token-00, with some input from Hannes and myself.

-----Original Message-----
From: COSE [mailto:cose-bounces@ietf.org] On Behalf Of Hannes Tschofenig
Sent: Monday, November 09, 2015 1:38 AM
To: Justin Richer; cose@ietf.org
Subject: Re: [COSE] Consensus Call: Adoption of the COSE Token

Hi Justin, Hi Kepeng,

I believe the participants of the Yokohama IETF meeting already decided against (D) with their agreement that this work is important.

In terms of expertise I believe COSE, OAuth, and ACE would be in a good position. While OAuth is currently in a re-chartering process (as you
know) there is a lot of work on the plate already even though it is distributed over a number of folks. Furthermore, there also seems to be a strong overlap between the participants of the ACE and the COSE working group whereby I believe that we have more participants in ACE than in COSE since the scope is much broader.

Ultimately we are doing something very simple here: we are copying the JSON encoded claims to CBOR encoded claims.

I believe that the AD should decide about where the work goes.

Ciao
Hannes

On 11/07/2015 09:01 AM, Justin Richer wrote:
> At the Yokohama meeting, the chairs agreed to do a consensus call regarding the adoption and placement of new work to define a COSE Token, analogous to the JWT from JOSE. In the room, there was a general sentiment of support for the work being done, with the wide adoption of JWT and its driving of JOSE being a common theme of precedent. What wasn’t clear is where the work should be done and to what end it should drive. The six positions we are asking the working group to consider and voice their support for are:
> 
> A) Define the COSE Token within the COSE working group along side the COSE Messages (and potentially COSE Auxiliary Algorithms) draft.
> B) Define the COSE Token inside the OAuth working group.
> C) Define the COSE Token inside the ACE working group.
> D) Don’t define the COSE Token anywhere.
> E) You need more information to decide.
> F) You don’t give a flying rat about the COSE Token.*
> 
> The consensus call will remain open for two weeks from today, closing on November 21, 2015; at which time, hopefully we will have a clear answer and direction to point this work.
> 
> Thank you,
>  — Justin & Kepeng, your COSE chairs
> 
> * I promised those in the room at Yokohama to offer a flying rat option, for which I am deeply sorry.
> _______________________________________________
> COSE mailing list
> COSE@ietf.org
> https://www.ietf.org/mailman/listinfo/cose
> 