Re: [Rats] [EXTERNAL] Re: EAT IANA registry

On Tue, Nov 26, 2019 at 11:39 PM Laurence Lundblade <lgl@island-resort.com>
wrote:

>
> On Nov 26, 2019, at 7:19 PM, Benjamin Kaduk <kaduk@mit.edu> wrote:
>
> ...but I'm not sure that "avoiding duplicates"
> would apply to a proposal that makes a single JWT/CWT claim for "EAT data"
> and puts the attestation claims in a map as the value for that "EAT data"
> claim.  What existing JWT/CWT claims would duplicate the potential contents
> of the EAT data fields?
>
>
> That is an interesting thought — put all of EAT into one JWT/CWT claim
> that is a map. Other’s have mentioned it to me. It would let EAT re use the
> most compact integer CBOR integer labels.
>
> Right now we re use the following claims from JWT or CWT by normative
> reference:
> - nonce
> - Token ID cti/jti
> - Time stamp (iat)
>
> Also these JWT or CWT seem either likely or possible use in EAT:
> - cnf (proof of possession of key)
> - iss Issuer
> - expiration
> - not before
>
> That’s a fairly large overlap which makes me disinclined to putting all of
> EAT into one map that is one JWT/CWT claim, separating EAT claims from
> CWT/JWT claims.
>
> I’m no OAuth expert, but I wonder if some of the EAT claims might be
> useful for other than EAT tokens, another reason not to keep them separate.
>
> I suspect we’re going to find at least one more use for a signed map of
> label-value pairs in the next few years that would be able to re use at
> least some of these claims — another reason to keep them in the same space.
>

One registry might become large, but it sounds like it will be easier and
reuse may happen on occassion.

To Yaron's earlier question, you can use claims that have not been
registered as the requirement to figure out vendor specific claims was
discussed and agreed as important at a previous interim for RATS.  If I
remember correctly, this was not done the same between JWT and CWT and that
was the issue to figure out.

Best regards,
Kathleen

>
> LL
>
>
>
>
>
>
> _______________________________________________
> RATS mailing list
> RATS@ietf.org
> https://www.ietf.org/mailman/listinfo/rats
>

-- 

Best regards,
Kathleen