Re: [OAUTH-WG] [Ace] Potential uses of PoP keys in CBOR Web Tokens (CWTs)

I don’t have any deployments yet, but am changing companies in July and can see some future use cases for POP CWT around Web Authentication.

POP for JWT is taking off and Ping has implementations of that.

It would be beneficial if we could maintain the same confirmation “cnf” semantic between JWT and CWT.

I suspect that there are going to be gateways and mixed environments, so it will reduce confusion.

If you are asking about specific confirmation methods you need to give me a bit of time to swap some of this into my head.
The high level semantic of a confirmation element should be the same but even in JWT there are different methods and information that needs to be propagated depending on the application eg key hash vs DN vs encrypted symmetric key.

John B.

> On Jun 12, 2017, at 1:19 PM, Hannes Tschofenig <hannes.tschofenig@gmx.net> wrote:
> 
> Hi all,
> 
> RFC 7800 defines how to communicate Proof of Possession (PoP) keys for
> JSON Web Tokens (JWTs) [RFC 7519]. The CBOR Web Token (CWT)
> draft-ietf-ace-cbor-web-token spec defines the CBOR/COSE equivalent of
> the JSON/JOSE JWT spec.
> 
> The ACE working group is planning to also define a CBOR/COSE equivalent
> of RFC 7800 and is interested in knowing how you might use CBOR
> proof-of-possession keys for CWTs.
> 
> Please drop us a message if you are using CBOR PoP keys for CWTs. We
> would like to learn more about your usage.
> 
> Ciao
> Hannes & Kepeng
> 
> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace

Re: [OAUTH-WG] [Ace] Potential uses of PoP keys in CBOR Web Tokens (CWTs)

Attachment: smime.p7s