Re: [Rats] CWT and JWT are good enough?

[Laurence Lundblade <[e-mail]>]

> On Sep 16, 2019, at 11:59 AM, Hannes Tschofenig <[e-mail]> wrote:
> 
>>> - All EAT claims are Specification Required. No EAT claims and be just
>>> Expert Review.
> 
>> I can live with that.
> 
> 
> I am not OK with that. For JWTs we have been using an expert review approach and that served the committee well.
> We would like to register vendor-specific claims for use within EAT tokens and I can hardly see why anyone should have problems with it.
> Furthermore, attestation is such a special field that there is no reason to be worried about companies flooding IANA with requests.

JWT doesn’t allow Expert Review. It only allows Specification Required.

Even with that there’s plenty of stuff in the JWT registry. Some have even called it questionable.


Also, the reason I say all EAT claims must be Specification Required is to avoid the divergence between CWT and JWT. I want to avoid “well, if you were using CWT then you could use that claim, but since you are using JWT, you can’t because it is not defined” and vice versa.

Unless we go out of our way anyone can register a CWT claim under Expert Review only. They just can’t register it under JWT until publish a Specification so they can get to the Specification Required level.

LL