Re: [Rats] CWT and JWT are good enough?

[Laurence Lundblade <[e-mail]>]

Hi Kathleen

> On Sep 16, 2019, at 8:44 AM, Kathleen Moriarty <[e-mail]> wrote:
> 
> 
> 
> On Mon, Sep 16, 2019 at 11:30 AM Laurence Lundblade <[e-mail] <mailto:[e-mail]>> wrote:
> I’ve been trying to take the position to avoid even minor divergences from CWT and JWT in EAT. I wish there wasn’t inconsistency between the two, particularly in how the claims registry is handled. That inconsistency has already consumed many hours, even days, of this WG. There’s been some really long email threads about it.
> 
> Fixing it only for EAT seems half-baked. Fixing it for all of CWT and JWT would have to go through those WGs. Seems like a lot of work. We have enough to do, so I’m inclined to live with it.
> 
> The COSE WG is the one the decided to diverge from lessons learned. 

The divergence I’m referring to is for the claims registry. That is definitely a CWT / JWT thing. COSE doesn’t have claims.

> That WG is open again, so if you'd like to pose this problem somewhere, that would be the place to do it.  I'm guessing people thought one or the other would be used, but not both resulting in this issue of inconsistency we are seeing.

My personal chosen path is NOT to raise the issue and live with the issue. Particularly:
 - The way to do vendor specific non-registered claims is different between CWT and JWT
 - All EAT claims are Specification Required. No EAT claims and be just Expert Review.

LL