Re: [Rats] Interoperability ... RE: EAT Profiles

[Thomas Fossati <[e-mail]>]

hi Ned,

On Wed, Sep 21, 2022 at 5:51 PM Smith, Ned <[e-mail]> wrote:
> On 9/21/22, 1:55 AM, "RATS on behalf of Thomas Fossati" <[e-mail] on behalf of [e-mail]> wrote:
> > On Tue, Sep 20, 2022 at 8:55 PM Smith, Ned <[e-mail]> wrote:
> > > Profiles should extend standardized statements at a defined
> > > extension point; but existing seem to go beyond this in several
> > > ways.
> >
> > Can you point me to where that is happening?  Speaking for PSA,
> > we do not extend any standardised EAT statement.
>
> [nms]    aiss-token = {
>        aiss-nonce,
>        aiss-instance-id,
>        aiss-profile,
>        aiss-implementation-id,
>        aiss-lifecycle,
>        aiss-boot-odometer,
>        aiss-watermark,
>    }
>
> Aiss-token seems to be an extension of a CWT/JWT token (rather than an
> EAT token). However, this token does integrate with some claims found
> in the EAT draft such as nonce, profile, UEID, and hash-type. Hence,
> it is both a subset of EAT claims as well as a superset of an EAT
> token.

I am not sure I see a problem here.  An EAT can (and typically will)
be a CWT/JWT, so anything claiming to be an EAT "profile" can a)
inherit the CWT/JWT wrapping, b) extend the claims set using newly
registered CWT/JWT claims if the available EAT claims are not
sufficient.

> Philosophically, EAT claims could be incorporated into other container
> structures besides CWT/JWT tokens.

True, but.
In order to extend the top-level type one needs a "IETF standards
track document." (see §3), so it's not going to be cheap to do that.

> For example, an X.509 certificate
> could define an extension that contains UCCS expression of EAT claims

This X.509 extension would be wrapped in a UCCS which is a top-level
EAT (when it gets its RFC number), so this is not the right example of
"new bounding container", I think.

> or a protocol frame could do something similar.

If by "similar" you mean UCCS wrapping the EAT/CWT claims then there's
no need to define anything for the profile.  Just reference [UCCS].

> It seems reasonable that a profile could specify the bounding
> container for EAT defined claims.

yes, but in order to be called an EAT it needs to be defined in a STD
track document.

cheers,
-- 
Thomas