Re: [COSE] [IANA #1284212] expert review for draft-ietf-cose-cwt-claims-in-headers (cose)

[Carsten Bormann <[e-mail]>]

On Nov 5, 2023, at 09:41, Michael Jones <[e-mail]> wrote:
> 
> Carsten, you asked " In all these cases, does the CWT added to the header form its own CWT that can be evaluated as such independently before jumping into the COSE object, or is it just intended to convey additional parameters to the processing intended for the COSE object with the other header parameters?"
> 
> To be clear, even normal CWTs (and JWTs) are simply bags of claims.  Their definitions express syntax - not fully-actionable semantics.  Profiles define semantics for the kinds of CWTs (or JWTs) that they define.  Cwt-claims-in-headers are the same.  They define syntax for where you can put claims.  It's up to profiles like lake-edhoc or SCITT to define how they're using those claims and what processing is associate with them.  Cwt-claims-in-headers doesn't change anything in that regard.

Hi Mike,

thank you for elucidating this so clearly.
You provide a description of JWTs and CWTs.

What I am interested in right now is using these as COSE header parameters.
In the COSE world, we try to be a bit more tied down on the semantics of the information in a COSE data item.
So you are motivating why using a CWT as a header parameter that is not further qualified as to its meaning in the COSE data item, should not be possible in COSE.

Together with an unambiguous “profile" identification, where the profile defines the semantics of any CCSes/CWTs included unambiguously, CWTs (or CCSes) do make sense in a COSE header.

Giving the header parameter carrying them a header parameter number that is specific to the usage (profile, if you want to call it this way) is one way to do this, and that is why I like the way EDHOC is using the kccs/kcwt header parameters.

Using a future “typ” parameter might supply semantics as well; to make a generic CCS/CWT header parameter useful we just would need to ensure that a “typ” is present and that this “typ" actually does define the semantics of a generic CCS/CWT header parameter (and possibly some restrictions on that parameter and where it may occur).  We could register a “typ” in conjunction with the generic CCS/CWT header parameter.

Grüße, Carsten