Re: [Rats] [EXTERNAL] Re: EAT IANA registry

[Benjamin Kaduk <[e-mail]>]

On Sun, Nov 24, 2019 at 10:14:30PM +0000, Mike Jones wrote:
> EAT should use the IANA JSON Web Token (JWT) Claims registry for JWT claims and the IANA CBOR Web Token (CWT) Claims registry for CWT claims.  It’s intended that claims from different use cases inhabit the same registry, to facilitate claim reuse across use cases, where appropriate.  If they aren’t reused, no harm is done.
> 
> It would be far more confusing to developers to create duplicate, EAT-specific registries.

I think the concern here is basically analogous to the difficulty we had
with draft-ietf-oauth-jwsreq, where the protocol mechanics forced us to
treat various field identifiers as both OAuth Parmeters and JWT Claims,
with potentially conflicting registries involved.

Here for EAT we do not have a separate registry already and so can avoid
the worst of the conflicts, but I'm not sure that "avoiding duplicates"
would apply to a proposal that makes a single JWT/CWT claim for "EAT data"
and puts the attestation claims in a map as the value for that "EAT data"
claim.  What existing JWT/CWT claims would duplicate the potential contents
of the EAT data fields?

-Ben