Re: [Rats] [EXTERNAL] Re: EAT IANA registry

[Mike Jones <[e-mail]>]

EAT should use the IANA JSON Web Token (JWT) Claims registry for JWT claims and the IANA CBOR Web Token (CWT) Claims registry for CWT claims.  It’s intended that claims from different use cases inhabit the same registry, to facilitate claim reuse across use cases, where appropriate.  If they aren’t reused, no harm is done.

It would be far more confusing to developers to create duplicate, EAT-specific registries.

                                                       -- Mike

From: RATS <[e-mail]> On Behalf Of Laurence Lundblade
Sent: Saturday, November 23, 2019 8:29 AM
To: Yaron Sheffer <[e-mail]>
Cc: [e-mail]; Hannes Tschofenig <[e-mail]>
Subject: [EXTERNAL] Re: [Rats] EAT IANA registry

One of our thoughts is that EAT profiles will help with this. For example, a special profile for toasters might list 5 claims that must be included in every attestation and 10 claims that are optional and maybe even prohibit all others.

LL



On Nov 22, 2019, at 6:57 AM, Yaron Sheffer <[e-mail]<mailto:[e-mail]>> wrote:

Hi Hannes,

Looking at the JWT claim IANA registry [1], it is already a terrible mess of several different standards, obviously with many more coming. I guess what’s done is done, and I’ll take back my objection.

Thanks,
                Yaron

[1] https://www.iana.org/assignments/jwt/jwt.xhtml#claims<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.iana.org%2Fassignments%2Fjwt%2Fjwt.xhtml%23claims&data=02%7C01%7CMichael.Jones%40microsoft.com%7C4dde883a52724dfeca7208d770325916%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637101233926912501&sdata=BdNuJhTcNNPSZwILWxum3RBISkNlmdS7QLiwO7xosxk%3D&reserved=0>

From: Hannes Tschofenig <[e-mail]<mailto:[e-mail]>>
Date: Friday, November 22, 2019 at 14:17
To: Yaron Sheffer <[e-mail]<mailto:[e-mail]>>, "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>
Subject: RE: EAT IANA registry

Yaron,
Could you explain why you think that this is a good idea?
Ciao
Hannes

From: RATS <[e-mail]<mailto:[e-mail]>> On Behalf Of Yaron Sheffer
Sent: Friday, November 22, 2019 2:05 PM
To: [e-mail]<mailto:[e-mail]>
Subject: [Rats] EAT IANA registry

Unrelated to my earlier mail, I would recommend to create a separate registry for EAT claims (I suppose that implies a nested object in the JWT/CWT) rather than to overload the CWT registry. Architecturally it just doesn’t jive to have all these claims as baseline CWT claims, and process-wise, it’s much more convenient for this group to control its own namespace.

Sorry if this has been raised before.

Thanks,
                Yaron
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
RATS mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/rats<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Frats&data=02%7C01%7CMichael.Jones%40microsoft.com%7C4dde883a52724dfeca7208d770325916%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637101233926912501&sdata=3ei85Yo%2BWgKEVsozHSJtDIO1s0oyzPbspJ2QH5mGV0M%3D&reserved=0>