Re: [Rats] CWT and JWT are good enough?

[Michael Richardson <[e-mail]>]

Hannes Tschofenig <[e-mail]> wrote:
    >>> - All EAT claims are Specification Required. No EAT claims and be just
    >>> Expert Review.

    >> I can live with that.


    > I am not OK with that. For JWTs we have been using an expert review
    > approach and that served the committee well.

I think we are not discussing the same things!
EAT claims that are standards need to be Specification Required, because
that's the "bigger" of the JWT (Specification Required) and CWT requirements.

    > We would like to register vendor-specific claims for use within EAT
    > tokens and I can hardly see why anyone should have problems with it.

Please distinguish between vendor-proprietary claims (private-use) ones from
standards!  You are not talking about the same thing now.

rfc7519 section 4.2 allows for claims based upon Public Names, which means
using a Collision-Resistant Name:

  Collision-Resistant Name
        A name in a namespace that enables names to be allocated in a
        manner such that they are highly unlikely to collide with other
        names.  Examples of collision-resistant namespaces include: Domain
        Names, Object Identifiers (OIDs) as defined in the ITU-T X.660
        and X.670 Recommendation series, and Universally Unique IDentifiers
        (UUIDs) [RFC4122].  When using an administratively
        delegated namespace, the definer of a name needs to take reasonable
        precautions to ensure they are in control of the portion of the
        namespace they use to define the name.

So any vendor-specific claim can be created by any vendor possessing a domain
name, a PEN, or who can run "uuidgen" (on a development system)

RFC8392 provides for: Integer values less than -65536 are marked as Private Use.
But,  Integer values greater than 65535 and strings of length
      greater than 2 are designated as Expert Review.

So it shouldn't be hard for a vendor-specific claim to get a number for CWT.
And within the space of "strings of length greater than 2" would be the
identical string used for JWT, if you like.  Yes, shorter is better.

The point of this thread was that for Standards Track *RATS* WG claims, that
we will have to go with Specification Required, because that's the minimum
common process for CWT and JWT.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [



--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-