Re: [Rats] Interoperability ... RE: EAT Profiles

[Laurence Lundblade <[e-mail]>]

> On Sep 22, 2022, at 4:33 PM, Smith, Ned <[e-mail]> wrote:
> ...
> Some clarification might be needed about profiles that answers these questions.
> Does inclusion of EAT claims in a token make the profile an "EAT profile" even when there are non-EAT claims included? 
> Is EAT considered a profile of a CWT/JWT? Or can it be relevant elsewhere?
> Can a CWT/JWT profile exist that is used for attestation that doesn't contain 'Claims-Set' defined claims?

So far I don’t see any of these questions as particularly of issue.

CWT and JWT will continue to exist as the standards they are. It’s fine for someone to put a claim defined in the EAT document in a CWT or JWT and that doesn’t make the CWT/JWT an EAT because CWT/JWT allow claims defined anywhere to be included.

If someone says a token is an EAT, then it needs to follow the rules defined in EAT, but it doesn’t have to have any claims defined in the EAT document because none are mandatory.

CWT/JWT doesn’t have a profile mechanism so EAT can’t be a profile of CWT/JWT.

Someone can invent a profile mechanism for CWT/JWT that is different from the EAT profile mechanism, though maybe some IETF/IESG people might say that is a bad idea and duplication of effort.

There’s not really anything mandatory about an EAT profile except that it has an eat profile identifier when it occurs in an EAT, but you can apply EAT profile without putting the identifier in. I think this is good and fine.

To me all this is clearly implied by the wording in CWT, JWT and EAT so there’s nothing to be done.

LL