Re: [Rats] Android comments on EAT draft

[Mathias Brossard <[e-mail]>]

On Thursday, May 16, 2019 at 6:16 AM Simon Frost <[e-mail]> wrote:
> I would be very interested in reading your set of claims necessary to describe a key as that use case has also been expressed for our usage.

On that topic, the "Proof-of-Possession Key Semantics for CBOR Web Tokens" (https://tools.ietf.org/html/draft-ietf-ace-cwt-proof-of-possession-06) is looking to add a CWT claim that contains key information. Once this is standardized it would be possible to include this claim, like all CWT claims, inside an EAT token.

But even for the relatively simple use-case of putting a public key in a token, which it technically supports, I am worried that the semantics might be too constraining. It focuses on proof-of-possession (PoP), where we are thinking about additional functions (signature, encryption, key agreement, etc.). I was wondering if others have an opinion w.r.t. draft-ietf-ace-cwt-proof-of-possession (engage to add language to allow "cnf" use for other things than PoP, create a "key" claim possibly based of "cnf" syntax, ...).

Sincerely,
-- Mathias Brossard

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.