Re: [Cwt-reg-review] [Ace] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

Jim Schaad <ietf@augustcellars.com> Sat, 21 March 2020 15:32 UTC

Return-Path: <ietf@augustcellars.com>
X-Original-To: cwt-reg-review@ietfa.amsl.com
Delivered-To: cwt-reg-review@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB0FC3A0A45; Sat, 21 Mar 2020 08:32:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.888
X-Spam-Level:
X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P9CHkyNn5n2J; Sat, 21 Mar 2020 08:32:22 -0700 (PDT)
Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB2643A09CB; Sat, 21 Mar 2020 08:32:19 -0700 (PDT)
Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sat, 21 Mar 2020 08:31:53 -0700
From: Jim Schaad <ietf@augustcellars.com>
To: 'Seitz Ludwig' <ludwig.seitz@combitech.se>, 'Mike Jones' <Michael.Jones@microsoft.com>, 'Chuck Mortimore' <charliemortimore@gmail.com>, <hannes.tschofenig@arm.com>
CC: <chuck.mortimore@visa.com>, <cwt-reg-review@ietf.org>, <draft-ietf-ace-oauth-authz@ietf.org>, <drafts-expert-review@iana.org>, <ace@ietf.org>
References: <DM6PR00MB0682B491E8F97FDC54D39605F5FA0@DM6PR00MB0682.namprd00.prod.outlook.com> <bf92a7996c9b4e5d936b8f0a0ff3c7a4@combitech.se> <DM6PR00MB068446BBDADA1515EFD6F166F5F90@DM6PR00MB0684.namprd00.prod.outlook.com> <80c2eaa89adc4c6bb4738b3f845ba5f7@combitech.se> <b6622f57c6de46fdb18a76b60dd4e8d1@combitech.se> <13d46c5478b447b4ad010e27832280e9@combitech.se>
In-Reply-To: <13d46c5478b447b4ad010e27832280e9@combitech.se>
Date: Sat, 21 Mar 2020 08:31:51 -0700
Message-ID: <03c301d5ff95$daa4c8a0$8fee59e0$@augustcellars.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_03C4_01D5FF5B.2E4A8480"
X-Mailer: Microsoft Outlook 16.0
Content-Language: en-us
Thread-Index: AQIH8vXl2SuZjuanQ8ojBH3bjXF/DwLHicARAwYVch4DSVoUTgIhn2Y0AyIi6X6nfG/DsA==
X-Originating-IP: [73.180.8.170]
Archived-At: <https://mailarchive.ietf.org/arch/msg/cwt-reg-review/a-oouaH9k9hSrKmY2XdkOnPmBgk>
Subject: Re: [Cwt-reg-review] [Ace] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)
X-BeenThere: cwt-reg-review@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: CWT Registry Review <cwt-reg-review.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/cwt-reg-review>, <mailto:cwt-reg-review-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cwt-reg-review/>
List-Post: <mailto:cwt-reg-review@ietf.org>
List-Help: <mailto:cwt-reg-review-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/cwt-reg-review>, <mailto:cwt-reg-review-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 21 Mar 2020 15:32:29 -0000

No you should not need to make any changes in the document.  This will be taken care of by the RFC Editor.

 

Jim

 

 

From: Ace <ace-bounces@ietf.org> On Behalf Of Seitz Ludwig
Sent: Saturday, March 21, 2020 3:35 AM
To: Mike Jones <Michael.Jones@microsoft.com>om>; Chuck Mortimore <charliemortimore@gmail.com>om>; hannes.tschofenig@arm.com
Cc: chuck.mortimore@visa.com; cwt-reg-review@ietf.org; draft-ietf-ace-oauth-authz@ietf.org; drafts-expert-review@iana.org; ace@ietf.org
Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

 

Please disregard the last message (small keyboard, large fingers). What I intended to write was this:

 

Sorry for the delay, I’ve now looked into the changes necessary and it basically is this line in the draft:

 

8.13. CBOR Web Token Claims

[…]

Claim Key: TBD (suggested: 9) -> … suggested: 42)

 

I wonder if I need to make this change at all since the value is only suggested (and we now have a diverging decision by the designated experts). Can  IANA clarify this for me?

 

Thank you for your patience,

 

 

Ludwig

 

 

From: Seitz Ludwig <ludwig.seitz@combitech.se <mailto:ludwig.seitz@combitech.se> > 
Sent: den 21 mars 2020 11:26
To: Seitz Ludwig <ludwig.seitz@combitech.se <mailto:ludwig.seitz@combitech.se> >; Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com> >; Chuck Mortimore <charliemortimore@gmail.com <mailto:charliemortimore@gmail.com> >; hannes.tschofenig@arm.com <mailto:hannes.tschofenig@arm.com> 
Cc: chuck.mortimore@visa.com <mailto:chuck.mortimore@visa.com> ; ace@ietf.org <mailto:ace@ietf.org> ; draft-ietf-ace-oauth-authz@ietf.org <mailto:draft-ietf-ace-oauth-authz@ietf.org> ; drafts-expert-review@iana.org <mailto:drafts-expert-review@iana.org> ; cwt-reg-review@ietf.org <mailto:cwt-reg-review@ietf.org> 
Subject: RE: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

 

Hello all, soo

 

From: Ace <ace-bounces@ietf.org <mailto:ace-bounces@ietf.org> > On Behalf Of Seitz Ludwig
Sent: den 17 mars 2020 10:01
To: Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com> >; Chuck Mortimore <charliemortimore@gmail.com <mailto:charliemortimore@gmail.com> >; hannes.tschofenig@arm.com <mailto:hannes.tschofenig@arm.com> 
Cc: chuck.mortimore@visa.com <mailto:chuck.mortimore@visa.com> ; ace@ietf.org <mailto:ace@ietf.org> ; draft-ietf-ace-oauth-authz@ietf.org; drafts-expert-review@iana.org <mailto:drafts-expert-review@iana.org> ; cwt-reg-review@ietf.org <mailto:cwt-reg-review@ietf.org> 
Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

 

Fair enough, take my points as the author’s opinion only.  That leaves us with 3 experts to make the decision. Your position is clear, Chuck hasn’t commented on the latest exchange but he was agreeing with you before. I propose we give Hannes another day and if he doesn’t comment we go ahead with your decision, is that acceptable for you?

 

/Ludwig

 

 

From: Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com> > 
Sent: den 16 mars 2020 19:43
To: Seitz Ludwig <ludwig.seitz@combitech.se <mailto:ludwig.seitz@combitech.se> >; Chuck Mortimore <charliemortimore@gmail.com <mailto:charliemortimore@gmail.com> >; hannes.tschofenig@arm.com <mailto:hannes.tschofenig@arm.com> 
Cc: drafts-expert-review@iana.org <mailto:drafts-expert-review@iana.org> ; cwt-reg-review@ietf.org <mailto:cwt-reg-review@ietf.org> ; chuck.mortimore@visa.com <mailto:chuck.mortimore@visa.com> ; draft-ietf-ace-oauth-authz@ietf.org <mailto:draft-ietf-ace-oauth-authz@ietf.org> ; ace@ietf.org <mailto:ace@ietf.org> 
Subject: RE: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

 

Ludwig, yes, while you’re a designated expert, note that the instructions to the designated experts at https://tools.ietf.org/html/rfc8392#section-9 includes this text:

   In cases where a registration decision could

   be perceived as creating a conflict of interest for a particular

   Expert, that Expert should defer to the judgment of the other

   Experts.

 

So, as I see it, you should actually recuse yourself from this decision.  That said, I’ve sent a private note to Hannes asking him to also weigh in.

 

                                                       Cheers,

                                                       -- Mike

 

From: Seitz Ludwig <ludwig.seitz@combitech.se <mailto:ludwig.seitz@combitech.se> > 
Sent: Monday, March 16, 2020 3:18 AM
To: Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com> >; Chuck Mortimore <charliemortimore@gmail.com <mailto:charliemortimore@gmail.com> >; hannes.tschofenig@arm.com <mailto:hannes.tschofenig@arm.com> 
Cc: drafts-expert-review@iana.org <mailto:drafts-expert-review@iana.org> ; cwt-reg-review@ietf.org <mailto:cwt-reg-review@ietf.org> ; chuck.mortimore@visa.com <mailto:chuck.mortimore@visa.com> ; draft-ietf-ace-oauth-authz@ietf.org <mailto:draft-ietf-ace-oauth-authz@ietf.org> ; ace@ietf.org <mailto:ace@ietf.org> 
Subject: [EXTERNAL] RE: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

 

Hi Mike,

 

I will of course abide with a majority decision of the designated experts (note that I’m one of them too). I would therefore be very interested to hear Hannes take on this.

 

Regards,

 

Ludwig

 

From: Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com> > 
Sent: den 13 mars 2020 19:17
To: Seitz Ludwig <ludwig.seitz@combitech.se <mailto:ludwig.seitz@combitech.se> >; Chuck Mortimore <charliemortimore@gmail.com <mailto:charliemortimore@gmail.com> >
Cc: Ludwig Seitz <ludwig_seitz@gmx.de <mailto:ludwig_seitz@gmx.de> >; drafts-expert-review@iana.org <mailto:drafts-expert-review@iana.org> ; cwt-reg-review@ietf.org <mailto:cwt-reg-review@ietf.org> ; chuck.mortimore@visa.com <mailto:chuck.mortimore@visa.com> ; draft-ietf-ace-oauth-authz@ietf.org <mailto:draft-ietf-ace-oauth-authz@ietf.org> ; ace@ietf.org <mailto:ace@ietf.org> 
Subject: Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

 

RFC 8693 defines the “scope” JWT claim for use with OAuth 2.0, and so is application-specific – just like the corresponding CWT “scope” claim is specific to ACE OAuth.

 

Unless Hannes (the other Designated Expert) disagrees with my and Chuck’s assessment by then, I propose that we proceed with the registrations on Monday, registering “scope” with value 41.

 

                                                       -- Mike

 

From: Seitz Ludwig <ludwig.seitz@combitech.se <mailto:ludwig.seitz@combitech.se> > 
Sent: Thursday, March 12, 2020 1:05 AM
To: Chuck Mortimore <charliemortimore@gmail.com <mailto:charliemortimore@gmail.com> >; Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com> >
Cc: Ludwig Seitz <ludwig_seitz@gmx.de <mailto:ludwig_seitz@gmx.de> >; drafts-expert-review@iana.org <mailto:drafts-expert-review@iana.org> ; cwt-reg-review@ietf.org <mailto:cwt-reg-review@ietf.org> ; chuck.mortimore@visa.com <mailto:chuck.mortimore@visa.com> ; draft-ietf-ace-oauth-authz@ietf.org <mailto:draft-ietf-ace-oauth-authz@ietf.org> ; ace@ietf.org <mailto:ace@ietf.org> 
Subject: Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

 

Hello Mike, Chuck,

 

Thank you for clarifying your assessment Mike, thank you Chuck for weighing in.

 

Mike you say: “the scope claim is specific to the ACE OAuth protocol”

 

This is not entirely correct, since the scope claim is defined  in  RFC 8693 for Token Exchange, which is not an ACE protocol. Thus if any other protocol decides to use CWT and Token Exchange they would inherit the CWT abbreviation for that claim we are discussing here.

I would therefore argue that this claim abbreviation has a wider set of applications than just ACE.

 

As for the sparseness of 1 byte abbreviations: The range goes from -24 to 23. The CWT RFC uses 0-8 and none other are currently registered, so we have a few ones left.

 

Regards,

 

Ludwig

 

 

From: Chuck Mortimore <charliemortimore@gmail.com <mailto:charliemortimore@gmail.com> > 
Sent: den 12 mars 2020 01:12
To: Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com> >
Cc: Ludwig Seitz <ludwig_seitz@gmx.de <mailto:ludwig_seitz@gmx.de> >; drafts-expert-review@iana.org <mailto:drafts-expert-review@iana.org> ; cwt-reg-review@ietf.org <mailto:cwt-reg-review@ietf.org> ; chuck.mortimore@visa.com <mailto:chuck.mortimore@visa.com> ; draft-ietf-ace-oauth-authz@ietf.org <mailto:draft-ietf-ace-oauth-authz@ietf.org> ; ace@ietf.org <mailto:ace@ietf.org> 
Subject: Re: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

 

Agree with Mike's assessment.   (One caveat to that is that I'm not close enough to CWT to understand how scare the single byte identifiers actually are.)

 

On Wed, Mar 11, 2020 at 4:39 PM Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com> > wrote:

[Adding correct e-mail addresses for Chuck, who recently joined Visa]

 

There are two reasons that I believe not using up one of the scarce one-byte claim identifiers for "scope" is appropriate:

1.	The claim values for scopes are not short themselves.  They are sets of ASCII strings separated by spaces. So the percentage difference in the total claim representation from adding a single byte will typically be small.
2.	The single-byte claim identifiers already registered at https://www.iana.org/assignments/cwt/cwt.xhtml are claims that are likely to be useful to diverse sets of applications, and therefore merit the short identifiers; whereas, the scope claim is specific to the ACE OAuth protocol and not applicable to diverse sets of applications.  It’s reasonable to give protocol-specific claim identifiers 2-byte representations.

 

I’d be interested to hear from the two other designated experts on my assessment of the situation: Hannes and Chuck.

 

                                                       -- Mike

 

-----Original Message-----
From: Cwt-reg-review <cwt-reg-review-bounces@ietf.org <mailto:cwt-reg-review-bounces@ietf.org> > On Behalf Of Ludwig Seitz
Sent: Saturday, February 29, 2020 6:25 AM
To: drafts-expert-review@iana.org <mailto:drafts-expert-review@iana.org> ; cwt-reg-review@ietf.org <mailto:cwt-reg-review@ietf.org> 
Cc: draft-ietf-ace-oauth-authz@ietf.org <mailto:draft-ietf-ace-oauth-authz@ietf.org> ; ace@ietf.org <mailto:ace@ietf.org> 
Subject: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

 

On 2020-02-26 00:58, Amanda Baber via RT wrote:

> Ludwig, Hannes,

> 

> Can you confirm that you can make the CBOR Web Token Claim change 

> requested below?

> 

> We also have Chuck Mortimore listed as an expert for this registry, 

> but our message to his Salesforce address bounced.

> 

> Best regards,

> 

> Amanda Baber Lead IANA Services Specialist

> 

 

I strongly disagree with the assessment that the scope claim should be pushed into the two-byte range.

 

The reason we introduced the scope claim is that an ACE RS typically does not have a direct connection to the AS, and is therefore unable to retrieve the scope of an access token from other sources than the access token itself.  I therefore assert that ACE access tokens would often need to contain this claim in order to inform the RS.

Since one of the major drivers of the ACE work has been to reduce the authorization overhead (otherwise we could just have used vanilla OAuth 2.0), I find it strange to needlessly add to the overhead by making the encoding of a frequently used claim longer than necessary.

 

I am willing to listen to the arguments that have lead the expert reviewer to denying a value in the one-byte range, and discuss the reasoning further on list.

 

Regards,

 

Ludwig

 

 

> On Tue Feb 18 22:42:22 2020,  <mailto:Michael.Jones@microsoft.com> Michael.Jones@microsoft.com wrote:

>> I'm mostly OK with these registrations, however, DO NOT assign the

>> value 9 to "scope".   Rather, please put it in the two-byte range

>> - for instance, with the value 41.

>> 

>> -- Mike

>> 

>> -----Original Message----- From: Cwt-reg-review 

>> < <mailto:cwt-reg-review-bounces@ietf.org> cwt-reg-review-bounces@ietf.org> On Behalf Of Sabrina Tanamal via RT 

>> Sent: Tuesday, February 18, 2020 1:06 PM Cc:

>>  <mailto:cwt-reg-review@ietf.org> cwt-reg-review@ietf.org Subject: [EXTERNAL] [Cwt-reg-review] [IANA 

>> #1158953] Requested review for IANA registration in 

>> draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

>> 

>> Hi all,

>> 

>> Resending this request for draft-ietf-ace-oauth-authz.

>> 

>> Thanks,

>> 

>> Sabrina Tanamal Senior IANA Services Specialist

>> 

>>> On Sat Dec 21 11:37:11 2019,  <mailto:ludwig_seitz@gmx.de> ludwig_seitz@gmx.de wrote:

>>>> Hello CWT registry reviewers,

>>>> 

>>>> the IESG-designated experts for the CWT claims registry have asked 

>>>> me to send a review request to you about the claims registered 

>>>> here:

>>>> 

>>>>  <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft

>>>> o

>>>> 

>>>> 

ols.ietf.org <http://ols.ietf.org> %2Fhtml%2Fdraft-ietf-ace-oauth-authz-29%23section-

>>>> 8.13&a

>>>> mp;data=02%7C01%7CMichael.Jones%40microsoft.com <http://40microsoft.com> %7Ce23f64ac1ad74269c

>>>> 3

>>>> 

>>>> 

c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63717656

>>>> 7656665548&amp;sdata=r01W5Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk%

>>>> 3

>>>> 

>>>> 

D&amp;reserved=0

>>>> 

>>>> Thank you in advance for you review comments.

>>>> 

>>>> Regards,

>>>> 

>>>> Ludwig

>>>> 

>> 

>> _______________________________________________ Cwt-reg-review 

>> mailing list  <mailto:Cwt-reg-review@ietf.org> Cwt-reg-review@ietf.org

>>  <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww

>> .ietf.org <http://ietf.org> %2Fmailman%2Flistinfo%2Fcwt-

>> 

>> 

reg-

>> review&amp;data=02%7C01%7CMichael.Jones%40microsoft.com <http://40microsoft.com> %7Ce23f64ac1ad

>> 74269c3c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63

>> 7176567656675543&amp;sdata=XxBhQmqxGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VUsH

>> Osg%3D&amp;reserved=0

> 

 

_______________________________________________

Cwt-reg-review mailing list

 <mailto:Cwt-reg-review@ietf.org> Cwt-reg-review@ietf.org

 <https://www.ietf.org/mailman/listinfo/cwt-reg-review> https://www.ietf.org/mailman/listinfo/cwt-reg-review