Re: [COSE] Newly Submitted Draft - CBOR Web Token (CWT) Claims in COSE Headers

[Hannes Tschofenig <[e-mail]>]

Hi Mike,

Thanks for the quick response. Section 5.3 of the JWT RFC explains what is being done but no use case is given. Why would someone want to encrypt a claim and then put the plaintext version into the outer header.

The argument (in JWT) is given as follows:

"
   This might be used, for
   instance, in application processing rules to determine whether and
   how to process the JWT before it is decrypted.
"

>From a security point of view it is not clever to make decisions based on unprotected data when the same data is encrypted in the actual payload.

On top of that Section 5.3 of the JWT RFC furthermore does not mandate that the recipient compares the unencrypted data with the version of the encrypted data. (Only a SHOULD is given and that is even softened in the rest of the sentence.)

Ciao
Hannes


From: Mike Jones <[e-mail]>
Sent: Wednesday, March 2, 2022 6:35 PM
To: Hannes Tschofenig <[e-mail]>om>; Tobias Looker <tobias.looker=[e-mail]>rg>; [e-mail]
Subject: RE: Newly Submitted Draft - CBOR Web Token (CWT) Claims in COSE Headers


The use case is the same as that which motivated Section 5.3 of JWT "Replicating Claims as Header Parameters" https://datatracker.ietf.org/doc/html/rfc7519#section-5.3 - encrypted CWTs for which you'd like to have unencrypted instances of particular claims to determine how to process the CWT prior to decrypting it.  Note that https://datatracker.ietf.org/doc/html/rfc7519#section-10.4 explicitly registers the "iss", "sub", and "aud" claims as JWE header parameter values exactly for this purpose.



This draft defines a syntax for COSE to likewise enable the corresponding CWT claims to be passed in the clear in the COSE header, just as JWT claims can be replicated as JOSE header parameters when needed.



                                                                                  -- Mike

From: Hannes Tschofenig <[e-mail]<mailto:[e-mail]>>
Sent: Wednesday, March 2, 2022 12:21 AM
To: Tobias Looker <tobias.looker=[e-mail]<mailto:tobias.looker=[e-mail]>>; [e-mail]<mailto:[e-mail]>
Cc: Mike Jones <[e-mail]<mailto:[e-mail]>>
Subject: RE: Newly Submitted Draft - CBOR Web Token (CWT) Claims in COSE Headers

Hi Tobias,

Could you say something about the use cases or provide an example of what you want to accomplish?

Ciao
Hannes

From: COSE <[e-mail]<mailto:[e-mail]>> On Behalf Of Tobias Looker
Sent: Wednesday, March 2, 2022 5:32 AM
To: [e-mail]<mailto:[e-mail]>
Cc: [e-mail]<mailto:[e-mail]>
Subject: [COSE] Newly Submitted Draft - CBOR Web Token (CWT) Claims in COSE Headers

Hi All,

This is an email to introduce the newly submitted draft titled "CBOR Web Token (CWT) Claims in COSE Headers", the current abstract is as follows.

"This document describes how to include CBOR Web Token (CWT) claims in the header parameters of any COSE structure. This functionality helps to facilitate applications that wish to make use of CBOR Web Token (CWT) claims in encrypted COSE structures and/or COSE structures featuring detached signatures, while having some of those claims be available before decryption and/or without inspecting the detached payload."

https://datatracker.ietf.org/doc/draft-looker-cose-cwt-claims-in-headers/

As covered in the introduction of this draft, a similar mechanism already exists for JWT and we see value in providing a way to do the same with CWTs.


Thanks,

[Mattr website]<https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiW1WeN4boYw%26u%3Dhttps%253a%252f%252fmattr.global%252f&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076709977%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=tKqCMzLUQNCeORd908YqfqZoT7tCy%2FMVwXdjpch1sDY%3D&reserved=0>



Tobias Looker

MATTR
CTO

[phone]
[e-mail]<mailto:[e-mail]>

[Mattr website]<https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiW1WeN4boYw%26u%3Dhttps%253a%252f%252fmattr.global%252f&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076709977%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=tKqCMzLUQNCeORd908YqfqZoT7tCy%2FMVwXdjpch1sDY%3D&reserved=0>

[Mattr on LinkedIn]<https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiW1SbN9fvNg%26u%3Dhttps%253a%252f%252fwww.linkedin.com%252fcompany%252fmattrglobal&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076719975%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=t%2BidOI32oaKuTJf1AkcG%2B%2FirIJwbrgzXVZnjOAC52Hs%3D&reserved=0>

[Mattr on Twitter]<https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiW1WdMte6ZA%26u%3Dhttps%253a%252f%252ftwitter.com%252fmattrglobal&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076729970%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=BD9WWyXEjVGlbpbCja93yW%2FzLJZpe%2Ff8lGooe8V6i7w%3D&reserved=0>

[Mattr on Github]<https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fscanmail.trustwave.com%2F%3Fc%3D15517%26d%3Dw46s4eMXULV_ns1ZfAKYLbVKcqey_PHiWwGdMoDtMw%26u%3Dhttps%253a%252f%252fgithub.com%252fmattrglobal&data=04%7C01%7CSteve.Lowes%40mbie.govt.nz%7C5a65fe33c70b41fd8ba908d976f3a2f1%7C78b2bd11e42b47eab0112e04c3af5ec1%7C0%7C0%7C637671611076729970%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=4AhRuXZCnU5i3hcngo4H3UiNayYUtXpRcImV4slS1mw%3D&reserved=0>

This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.