Is a data type mapping form JWT to CBOR sufficient then?
On Monday, November 16, 2015 11:26 PM, Hannes Tschofenig
wrote:
#yiv5390846737 #yiv5390846737 -- _filtered #yiv5390846737
{font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;} _filtered #yiv5390846737
{font-family:Tahoma;panose-1:2 11 6 4 3 5 4 4 2 4;}#yiv5390846737
#yiv5390846737 p.yiv5390846737MsoNormal, #yiv5390846737
li.yiv5390846737MsoNormal, #yiv5390846737 div.yiv5390846737MsoNormal
{margin:0cm;margin-bottom:.0001pt;font-size:12.0pt;}#yiv5390846737 a:link,
#yiv5390846737 span.yiv5390846737MsoHyperlink
{color:blue;text-decoration:underline;}#yiv5390846737 a:visited, #yiv5390846737
span.yiv5390846737MsoHyperlinkFollowed
{color:purple;text-decoration:underline;}#yiv5390846737
p.yiv5390846737MsoAcetate, #yiv5390846737 li.yiv5390846737MsoAcetate,
#yiv5390846737 div.yiv5390846737MsoAcetate
{margin:0cm;margin-bottom:.0001pt;font-size:8.0pt;}#yiv5390846737
span.yiv5390846737EmailStyle17 {color:#1F497D;}#yiv5390846737
span.yiv5390846737BalloonTextChar {}#yiv5390846737 .yiv5390846737MsoChpDefault
{} _filtered #yiv5390846737 {margin:72.0pt 72.0pt 72.0pt 72.0pt;}#yiv5390846737
div.yiv5390846737WordSection1 {}#yiv5390846737 Hi William, You are indeed
correct that the current document contains a list of one-by-one copies of
claims from the JWT. The only difference is the data type. Probably it would
have been better to just reference the semantic from the JWT spec and then
state the new data type. I fully understand the concern of defining CWT
claims that have the same name as JWT claims but then different semantic. This
would be terribly confusing. Ciao Hannes From: William Denniss
[mailto:wdenn...@google.com]
Sent: 16 November 2015 22:32
To: Hannes Tschofenig
Cc: Erik Wahlström neXus; Carsten Bormann; Mike Jones;
Subject: Re: [COSE] A draft on CBOR Web Tokens (CWT) You raise some good
points, and perhaps that is relevant to future claims. The spec as drafted, is
a one-for-one copy of the standard JWT claims, which is why I raised this
point. Is the goal a CBOR representation of a JWT? If so, can it be defined
in terms of a JWT? Would the CNF claim then inherit that representation
(treating the JWE and JWK as their CBOR equivalents)? Perhaps if you go the
separate registry route, those claims that *are* defined the same should at
least normatively reference JWT? I want to avoid the whole "on behalf of" /
"act as" fiasco where things can get re-defined, and muddled. On Mon, Nov
16, 2015 at 7:09 AM, Hannes Tschofenig wrote: Hi
William, I have been trying to do a document update to see how well a
combined registry works and I have been wondering whether it is really worth
the effort. To make a good judgment I looked at the CNF claim defined in
draft-ietf-oauth-proof-of-possession. The CNF claim may contain sub-elements,
such as a JWE or a JWK. If we translate the same mechanisms to the CWT (which
makes sense) then we need to point to the respective COSE structures instead.
Those do not only use a different encoding but also the functionality does not
match the JOSE structures 100%. So, there are potentially differences. I am
also not sure whether we really want to translate the full functionality of all
the claims from JWT over to the CWT equivalent. It basically puts the burden on
someone defining new claims (either in JWT or in CWT) to create the
corresponding structures in a format they may not necessarily be familiar with
or even care about. I have seen that happening in the RADIUS world protocol
designers had to also define the equivalent structures for use with Diameter
and, guess what, most of the definitions were wrong (since the authors did not
care about Diameter when working on RADIUS). Ciao
Hannes From: William Denniss [mailto:wdenn...@google.com]
Sent: 12 November 2015 19:19
To: Erik Wahlström neXus
Cc: Carsten Bormann; Hannes Tschofenig; Mike Jones; c...@ietf.org;
;a...@ietf.org
Subject: Re: [COSE] A draft on CBOR Web Tokens (CWT) Regarding the draft
itself, a few comments: 1. Can we unify the claim registry with JWT? I'm
worried about having the same claims defined twice in CWT and JWT with possibly
conflicting meanings (and needless confusion even when they do match).
Comparing
https://tools.ietf.org/html/draft-wahlstroem-oauth-cbor-web-token-00#section-3.1.2
and https://tools.ietf.org/html/rfc7519#section-4.1.2 which are nearly
identical, I just don't see the value in re-defining it. We may add new
standard claims to JWT in the future (I proposed one in Yokohama on the
id-event list), it would be good if this didn't need a separate entry in CWT
too, but could just apply directly (separately, I think you should consider
this claim, as it helps prevent tokens from being re-used in the wrong
context). 2. Is Section 4 "Summary of CBOR major types used by defined
claims" normative
(https://tools.ietf.org/html/draft-wahlstr
