Re: [Jwt-reg-review] Request to register claim: sig_val_claims

[Brian Campbell <[e-mail]>]

It'd be a media type registration - the text in 3.11.  Use Explicit Typing
<https://datatracker.ietf.org/doc/html/rfc8725#section-3.11> of the JWT BCP
explains it a bit more and references RFC8417 that has
https://datatracker.ietf.org/doc/html/rfc8417#section-7.3 as an example of
such a registration request. Looking for +jwt in the registry
https://www.iana.org/assignments/media-types/media-types.xhtml will turn up
a few others too.

I believe you could define its use in SVT however makes sense given the
constraints you have with existing implementations or whatever. I.e. typ
has to be either jwt or svt+jwt. I suppose that waters it down a bit but is
possible.

Or maybe it's not worth doing at this point. It was just something that
jumped out at me when trying to do a quick review of the draft.

On Sat, Jan 15, 2022 at 7:01 AM Stefan Santesson <[e-mail]> wrote:

> Brian,
>
> Thank you for the suggestion. Our current implementations use the jwt type
> declaration as this technically is a JWT. This also works well with
> standard tools as long as we can define the claim as requested here.
>
> Having a specific type like svt+jwt might be a good idea. I'm not sure
> exactly what implications that brings to our current implementations. If we
> register a "svt+jwt" type, could it's user be optional? How would we go
> ahead and do the registration of this type?
>
> /Stefan
>
>
> Den 2022-01-14 kl. 22:24, skrev Brian Campbell:
>
> Honestly, I can't really wrap my head around this kind of signature
> indirection so I'll just say that I'm okay with the registration of the
> claim name "sig_val_claims".
>
> Because the document is defining this SVT, which is one particular kind of
> JWT, I wonder if it'd be worthwhile to consider explicitly typing it, as
> recommended in https://datatracker.ietf.org/doc/html/rfc8725#section-3.11,
> with something like a "typ":"svt+jwt" header rather than the general and
> kinda meaningless "typ":"jwt"?
>
>
> On Wed, Jan 12, 2022 at 7:44 PM Mike Jones <Michael.Jones=
> [e-mail]> wrote:
>
>> I approve of the registration of this claim.
>>
>>                                 -- Mike
>>
>> -----Original Message-----
>> From: Jwt-reg-review <[e-mail]> On Behalf Of
>> Stefan Santesson
>> Sent: Friday, September 3, 2021 8:33 AM
>> To: [e-mail]
>> Cc: Russ Housley <[e-mail]>
>> Subject: [EXTERNAL] [Jwt-reg-review] Request to register claim:
>> sig_val_claims
>>
>> Hi,
>>
>> The draft https://datatracker.ietf.org/doc/draft-santesson-svt/ is being
>> requested for publication as individual submission
>>
>> This draft includes the request to register the claim name
>> "sig_val_claims" as follows:
>>
>> 6.1.  Claim Names Registration
>>
>>
>>    This section registers the "sig_val_claims" claim name in the IANA
>>    "JSON Web Token Claims" registry established by Section 10.1 in
>>    [RFC7519].
>>
>> 6.1.1.  Registry Contents
>>
>>    *  Claim Name: "sig_val_claims"
>>    *  Claim Description: Signature Validation Token Claims
>>    *  Change Controller: IESG
>>    *  Specification Document(s): Section 3.2.3 of {this document}
>>
>>
>> The draft specifies a Token having the form of a JWT which includes this
>> defined claim.
>>
>> The rationale for this claim is described in the referenced document.
>>
>> The solution is deployed is real services and it is considered for
>> national government usage which is the main reason to publish the
>> specification as an informational RFC.
>>
>>
>>
>> /Stefan Santesson
>>
>>
>> _______________________________________________
>> Jwt-reg-review mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/jwt-reg-review
>> _______________________________________________
>> Jwt-reg-review mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/jwt-reg-review
>>
>
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited.
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*
>
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._