Re: [EAT] [Rats] Attestation BoF charter updates? - Program of Work section

[Benjamin Kaduk <[e-mail]>]

On Fri, Oct 26, 2018 at 12:12:58PM +0700, Laurence Lundblade wrote:
> (This isn’t really charter bashing anymore; think we’re mostly done with that)
> 
> I’ll put this in the form of a proposal:
> 
> A set of claims about a device is aggregated into a 'token' (this is the term used in CWT/JWT) or ‘document'. That token/document will be signed.  We will support only two formats for the token/document.
> 
> CWT: Claims are mainly in CBOR format, but we can stuff other things like commonly used ASN.1, XML, JSON...  structures into an individual claim if necessary. Signing is COSE format, though COSE headers might carry X.509 certs to help identify and chain up to the verification key.
> 
> JWT: Claims are mainly in JSON format, but we can stuff other things like commonly used ASN.1, XML, CBOR… structures into an individual claim if necessary. Signing is JOSE format, though JOSE headers might carry X.509 certs to help identify and chain up to the verification key.

There is perhaps something of a philosophical question about stuffing
ASN.1, XML, etc. structures into individual claims, in that "can you really
trust the signer to vouch for what it's signing if the signed contents are
in a format unknown to the signer?"  There are certainly ways to delegate
or chain trust so that the answer to the question is "yes", but I do not
think we should ignore the question entirely.

-Ben