Re: [Rats] Call for Adoption: EAT draft

["Eric Voit (evoit)" <[e-mail]>]

From: Laurence Lundblade, June 2, 2019 6:33 AM

I think it makes sense to separate into two:

1) New rules and advice for registering CWT/JWT claims
2) A basic set of attestation-related claims this WG will define

To go on about 1), it seems we are expanding CWT/JWT from just being auth tokens to also being attestation tokens and also identity certs (draft-birkholz-core-coid-01) and maybe X.509 replacements. This seems like mostly a good idea to me. It will be super cool that code can be shared by all of these for example. Lots of claims will overlap which is good too.

So I don’t think it makes sense to talk about "expert review of EAT claims". Rather we should talk about "expert review of CWT/JWT claims" and how it should be different than it is now.

<eric> One thing to consider is that claims from hardware are perceived as more trustworthy, with definitions changing less frequently than from software. (Whether this is true is of course debatable.)

If nothing else, if hardware and software generated claims are to be consolidated into common list(s), then a revised expert review process will need to reconcile the varying timescales and flexibilities of different implementers.

Eric

Also, if you haven’t looked at the register JWT claims, it’s worth checking out: https://www.iana.org/assignments/jwt/jwt.xhtml. Am also curious what people think of bringing them into CWT and especially how we avoid conflicting duplication between CWT and JWT.


To say more about 2), it seems we should really work to come up with a nice, well-thought-out, medium-sized, coherent set of claims for attestation and put them in an RFC. This is roughly what the EAT draft is.

LL