Re: [Rats] CWT and JWT are good enough?

On 2019-09-16 20:28, Giridhar Mandyam wrote:
>> I would not base a major design decision on a single and rather unusual solution which BTW already is defined.
> 
> I understand the sentiment, and we have had this discussion on the mailing list before (e.g. https://mailarchive.ietf.org/arch/msg/rats/T1OmyXyprQ5ItvBm_9PxZ7LRrmA).  But I don't agree that CBOR should be our sole focus.

I got that.

> I think if we have the opportunity to define interoperable attestation formats for CBOR and JSON,

To solve what problem?  Attestations are not comparable to word processors that typically need to read and write a plethora of document formats.

> it would be a mistake not to take it. 

It is IMO rather a mistake confusing future implementers with technically redundant choices.  Note: for protocols like TEEP it is no big deal using Base64Url encoded attestations either.

> If solutions such as the SafetyNet Attestation follow our lead and evolve to supporting EAT then I think that would be a positive.

Yes, but for application developers, attestations are presumably exposed as APIs and objects making the CBOR/JSON issue limited to implementors.

I leave this thread now and let you continue doing TWO things of everything :-)

Anders

> 
> -Giri
> 
> 
> -----Original Message-----
> From: Anders Rundgren <anders.rundgren.net@gmail.com>
> Sent: Monday, September 16, 2019 11:14 AM
> To: Giridhar Mandyam <mandyam@qti.qualcomm.com>; Laurence Lundblade <lgl@island-resort.com>
> Cc: rats@ietf.org
> Subject: Re: [Rats] CWT and JWT are good enough?
> 
> -------------------------------------------------------------------------
> CAUTION: This email originated from outside of the organization.
> -------------------------------------------------------------------------
> 
> On 2019-09-16 19:42, Giridhar Mandyam wrote:
>> Yes, but that does not mean that JSON support is not required by Webauthn.
>>
>> Webauthn allows for the Android SafetyNet attestation format - see https://www.w3.org/TR/webauthn/#android-safetynet-attestation.  And SafetyNet comes in the form of a JSON object:  https://developer.android.com/training/safetynet/attestation#compat-check-response.
> 
> I would not base a major design decision on a single and rather unusual solution which BTW already is defined.
> 
> Anders
> 
>>
>> In other words, a Webauthn RP cannot just support CBOR and hope to cover all of the deployed implementations.
>>
>> -Giri Mandyam
>>
>> -----Original Message-----
>> From: RATS <rats-bounces@ietf.org> On Behalf Of Anders Rundgren
>> Sent: Monday, September 16, 2019 10:33 AM
>> To: Laurence Lundblade <lgl@island-resort.com>
>> Cc: rats@ietf.org
>> Subject: Re: [Rats] CWT and JWT are good enough?
>>
>> -------------------------------------------------------------------------
>> CAUTION: This email originated from outside of the organization.
>> -------------------------------------------------------------------------
>>
>> The W3C apparently came to another conclusion although they target the most JSON-friendly place there is, the Web:
>> https://www.w3.org/TR/webauthn/#sctn-extension-request-parameters
>> That is, WebAuthn requires CBOR.
>>
>>
>> On 2019-09-16 18:35, Anders Rundgren wrote:
>>> On 2019-09-16 18:29, Laurence Lundblade wrote:
>>>>
>>>>
>>>>> On Sep 16, 2019, at 8:46 AM, Anders Rundgren <anders.rundgren.net@gmail.com> wrote:
>>>>>
>>>>> On 2019-09-16 17:30, Laurence Lundblade wrote:
>>>>>> I’ve been trying to take the position to avoid even minor divergences from CWT and JWT in EAT. I wish there wasn’t inconsistency between the two, particularly in how the claims registry is handled. That inconsistency has already consumed many hours, even days, of this WG. There’s been some really long email threads about it.
>>>>>> Fixing it only for EAT seems half-baked. Fixing it for all of CWT and JWT would have to go through those WGs. Seems like a lot of work. We have enough to do, so I’m inclined to live with it.
>>>>>
>>>>> Since everything crypto-wise in the JOSE stack anyway is covered in Base64Url, I don't see why one would bother with JWTs (or JSON at all for that matter) in EAT.
>>>>
>>>> Pretty sure lots of people want to be able to express claims in JSON. It is far more prevalent (so I understand) on the server side than CBOR.
>>>
>>> Yes, but EAT is (IMO) not comparable to "normal" applications.
>>>
>>>> I think there is consensus in this WG that we will support JSON and CBOR (and thus COSE and JOSE) for claims.
>>>
>>> Right and it will effectively force server-side software vendors creating TWO versions of everything.
>>> That's the hallmark of design by committee :-)
>>>
>>> Anders
>>>
>>>>
>>>> LL
>>>>
>>>
>>
>> _______________________________________________
>> RATS mailing list
>> RATS@ietf.org
>> https://www.ietf.org/mailman/listinfo/rats
>>
> 