Re: [Rats] CWT and JWT are good enough?

[Anders Rundgren <[e-mail]>]

On 2019-09-16 18:29, Laurence Lundblade wrote:
> 
> 
>> On Sep 16, 2019, at 8:46 AM, Anders Rundgren <[e-mail]> wrote:
>>
>> On 2019-09-16 17:30, Laurence Lundblade wrote:
>>> I’ve been trying to take the position to avoid even minor divergences from CWT and JWT in EAT. I wish there wasn’t inconsistency between the two, particularly in how the claims registry is handled. That inconsistency has already consumed many hours, even days, of this WG. There’s been some really long email threads about it.
>>> Fixing it only for EAT seems half-baked. Fixing it for all of CWT and JWT would have to go through those WGs. Seems like a lot of work. We have enough to do, so I’m inclined to live with it.
>>
>> Since everything crypto-wise in the JOSE stack anyway is covered in Base64Url, I don't see why one would bother with JWTs (or JSON at all for that matter) in EAT.
> 
> Pretty sure lots of people want to be able to express claims in JSON. It is far more prevalent (so I understand) on the server side than CBOR.

Yes, but EAT is (IMO) not comparable to "normal" applications.

> I think there is consensus in this WG that we will support JSON and CBOR (and thus COSE and JOSE) for claims.

Right and it will effectively force server-side software vendors creating TWO versions of everything.
That's the hallmark of design by committee :-)

Anders

> 
> LL
>