Re: [Rats] New RATS

[Henk Birkholz <[e-mail]>]

Hi Laurence,

I am not sure what to unpack from your reply to be honest.

What I think I am reading is:

a) "a top level ‘envelope’ object for a multi-token system" is not 
required, as EAT already solves that issue appropriately, and/or

b) "the top-level token could be a UCCS and include a CWT and JWT" can 
solve the problem you are trying to solve, or

c) something I might have missed.

To me, the symmetry between:
  > 
https://www.ietf.org/archive/id/draft-frost-rats-eat-collection-00.html#appendix-A

and

> https://www.ietf.org/archive/id/draft-lundblade-rats-eat-media-type-00.html#figure-2

is pretty striking. It seems to me that related problem statements are 
addressed here on different layers? Or am I mistaken? I think addressing 
the increasing ambiguity of "what is an EAT" / "where does EAT end" is 
needed. I also think that addressing it on more than one layer is fine.

Obviously, I like the solution proposed for layers that use media-types :-)

In this case, I am inclined pull in an aggregation structure that can 
differentiate the same types as the media-types on a lower layer, tbh. 
Is EAT really already solving that issue today?

Viele Grüße,

Henk


On 01.06.22 18:36, Laurence Lundblade wrote:
> 
>> On Jun 1, 2022, at 12:35 AM, Simon Frost <[e-mail] 
>> <mailto:[e-mail]>> wrote:
>>
>> > Should a $$EAT-CBOR-Tagged-Token or $$EAT-CBOR-Untagged-Token be signed for 
>> integrity protection – for example using COSE/JOSE?
>> I’m not sure I fully understand the question, but I don’t think that 
>> all tokens require a top level signer, for reasons expressed in this 
>> doc (and in UCCS).
> 
> We already have a means for signing a collection of tokens — it’s a 
> top-level token with a submod section that has signed tokens in it. The 
> top-level signing token can be very simple, perhaps one a nonce claim 
> and the submods section.
> 
> It is also has the correct and proper fan out to any type of token. For 
> example the top-level token could be JWT and sign a a CWT and UJCS. Or 
> the top-level token could be a UCCS and include a CWT and JWT, correctly 
> relying on the transport security that UCCS and UJCS were created to 
> take advantage of. (I think collections may not have a lot of these 
> features; still reviewing)
> 
> LL
> 
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats