Subject: [COSE] Consensus Call: Adoption of the COSE Token

From: Justin Richer <[email-masked]>
Date: Sat, 7 Nov 2015 17:01:53 +0900

At the Yokohama meeting, the chairs agreed to do a consensus call regarding the adoption and placement of new work to define a COSE Token, analogous to the JWT from JOSE. In the room, there was a general sentiment of support for the work being done, with the wide adoption of JWT and its driving of JOSE being a common theme of precedent. What wasn’t clear is where the work should be done and to what end it should drive. The six positions we are asking the working group to consider and voice their support for are:

A) Define the COSE Token within the COSE working group along side the COSE Messages (and potentially COSE Auxiliary Algorithms) draft.
B) Define the COSE Token inside the OAuth working group.
C) Define the COSE Token inside the ACE working group.
D) Don’t define the COSE Token anywhere.
E) You need more information to decide.
F) You don’t give a flying rat about the COSE Token.*

The consensus call will remain open for two weeks from today, closing on November 21, 2015; at which time, hopefully we will have a clear answer and direction to point this work.

Thank you,
 — Justin & Kepeng, your COSE chairs

* I promised those in the room at Yokohama to offer a flying rat option, for which I am deeply sorry.

---

From: "Jim Schaad" <[email-masked]>
Date: Sat, 7 Nov 2015 10:47:53 -0800

Either B or C.

> -----Original Message-----
> From: COSE [mailto:[email-masked]] On Behalf Of Justin Richer
> Sent: Saturday, November 07, 2015 12:02 AM
> To: [email-masked]
> Subject: [COSE] Consensus Call: Adoption of the COSE Token
> 
> At the Yokohama meeting, the chairs agreed to do a consensus call regarding
> the adoption and placement of new work to define a COSE Token, analogous to
> the JWT from JOSE. In the room, there was a general sentiment of support for
> the work being done, with the wide adoption of JWT and its driving of JOSE
> being a common theme of precedent. What wasn’t clear is where the work
> should be done and to what end it should drive. The six positions we are asking
> the working group to consider and voice their support for are:
> 
> A) Define the COSE Token within the COSE working group along side the COSE
> Messages (and potentially COSE Auxiliary Algorithms) draft.
> The consensus call will remain open for two weeks from today, closing on
> November 21, 2015; at which time, hopefully we will have a clear answer and
> direction to point this work.
> 
> Thank you,
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose

---

From: Göran Selander <[email-masked]>
Date: Mon, 9 Nov 2015 09:20:00 +0000

I vote for C. It would be good if this work could be carried out where
there is both OAuth competence and constrained node network competence. I
believe ACE could be a match here since such competences will anyway be
required to evaluate

https://datatracker.ietf.org/doc/draft-seitz-ace-oauth-authz/

which is the preferred starting point for a solution according to the f2f
meeting. There is already some text on “CBOR Web Token" in appendix D.

Göran

On 2015-11-07 19:47, "Jim Schaad" <[email-masked]> wrote:

>> * I promised those in the room at Yokohama to offer a flying rat
>>option, for
>> which I am deeply sorry.

---

From: Ludwig Seitz <[email-masked]>
Date: Mon, 9 Nov 2015 10:24:24 +0100

> meeting. There is already some text on “CBOR Web Token" in appendix D.

+1

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 9 Nov 2015 10:37:52 +0100

Hi Justin, Hi Kepeng,

I believe the participants of the Yokohama IETF meeting already decided
against (D) with their agreement that this work is important.

In terms of expertise I believe COSE, OAuth, and ACE would be in a good
position. While OAuth is currently in a re-chartering process (as you
know) there is a lot of work on the plate already even though it is
distributed over a number of folks. Furthermore, there also seems to be
a strong overlap between the participants of the ACE and the COSE
working group whereby I believe that we have more participants in ACE
than in COSE since the scope is much broader.

Ultimately we are doing something very simple here: we are copying the
JSON encoded claims to CBOR encoded claims.

I believe that the AD should decide about where the work goes.

Ciao
Hannes

---

From: Mike Jones <[email-masked]>
Date: Fri, 13 Nov 2015 02:08:14 +0000

I personally believe that the core CBOR Web Token (CWT) spec should define equivalents of the same seven general-purpose claims that JSON Web Token (JWT) http://tools.ietf.org/html/rfc7519 defined (iss, sub, aud, exp, nbf, iat, and jti), define the CWT Claims Registry, and stop there.  Keeping the target simple in that manner means that this could get done VERY quickly.

Then applications, such as ACE protocols and applications, could define additional claims used by those applications and register them in the CWT Claims Registry.  Keeping the general-purpose and application-specific claim definitions in different specs is important to having CWT be a general-purpose spec, rather than being viewed as being slanted towards a particular application or application area.  It also means it will get done much faster.

IoT/ACE expertise is critical for defining the supplemental IoT/ACE claims.  It's unnecessary for developing the base CWT spec.  Whereas the expertise that created JWT, which we'd be doing a functional clone of, is in the OAuth working group.  Therefore, I believe the best answer is:

				-- Mike

P.S.  For those wanting to wrap their heads around what we're concretely talking about, Erik Wahlström was kind enough to write a first draft https://tools.ietf.org/html/draft-wahlstroem-oauth-cbor-web-token-00, with some input from Hannes and myself.

-----Original Message-----
From: COSE [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Monday, November 09, 2015 1:38 AM
To: Justin Richer; [email-masked]
Subject: Re: [COSE] Consensus Call: Adoption of the COSE Token

Hi Justin, Hi Kepeng,

I believe the participants of the Yokohama IETF meeting already decided against (D) with their agreement that this work is important.

In terms of expertise I believe COSE, OAuth, and ACE would be in a good position. While OAuth is currently in a re-chartering process (as you
know) there is a lot of work on the plate already even though it is distributed over a number of folks. Furthermore, there also seems to be a strong overlap between the participants of the ACE and the COSE working group whereby I believe that we have more participants in ACE than in COSE since the scope is much broader.

Ultimately we are doing something very simple here: we are copying the JSON encoded claims to CBOR encoded claims.

Ciao
Hannes

---

From: Ludwig Seitz <[email-masked]>
Date: Fri, 13 Nov 2015 08:39:33 +0100

On 2015-11-07 09:01, Justin Richer wrote:
> At the Yokohama meeting, the chairs agreed to do a consensus call
> regarding the adoption and placement of new work to define a COSE
> Token, analogous to the JWT from JOSE. In the room, there was a
> general sentiment of support for the work being done, with the wide
> adoption of JWT and its driving of JOSE being a common theme of
> precedent. What wasn’t clear is where the work should be done and to
> what end it should drive. The six positions we are asking the working
> group to consider and voice their support for are:

> F) You don’t give a flying rat about the COSE Token.*

C)

Both A) and B) would require rechartering, I believe we can get away 
with the CWT in C) without rechartering.

I think we need to have both ACE and OAuth expertise on this. 
Furthermore we need to integrate this with the other ACE work, which is 
why I think C) is the right choice.

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: "Kumar, Sandeep" <[email-masked]>
Date: Fri, 13 Nov 2015 08:46:04 +0000

+1

The core CWT should be in OAuth WG preferably reusing the same JWT Claims registry. Extensions specific for ACE should be done in ACE WG and preferably in a way that it can be used with both CWT and JWT.

Regards
Sandeep

> From: COSE [mailto:[email-masked]] On Behalf Of Mike Jones
> Sent: Friday, November 13, 2015 3:08 AM
> To: Hannes Tschofenig <[email-masked]>; Justin Richer
> <[email-masked]>; [email-masked]
> I personally believe that the core CBOR Web Token (CWT) spec should define
> equivalents of the same seven general-purpose claims that JSON Web Token
> (JWT) http://tools.ietf.org/html/rfc7519 defined (iss, sub, aud, exp, nbf, iat,
> and jti), define the CWT Claims Registry, and stop there.  Keeping the target
> simple in that manner means that this could get done VERY quickly.
>
> Then applications, such as ACE protocols and applications, could define
> additional claims used by those applications and register them in the CWT
> Claims Registry.  Keeping the general-purpose and application-specific claim
> definitions in different specs is important to having CWT be a general-
> purpose spec, rather than being viewed as being slanted towards a particular
> application or application area.  It also means it will get done much faster.
>
> IoT/ACE expertise is critical for defining the supplemental IoT/ACE claims.  It's
> unnecessary for developing the base CWT spec.  Whereas the expertise that
> created JWT, which we'd be doing a functional clone of, is in the OAuth
> working group.  Therefore, I believe the best answer is:
>
> P.S.  For those wanting to wrap their heads around what we're concretely
> talking about, Erik Wahlström was kind enough to write a first draft
> https://tools.ietf.org/html/draft-wahlstroem-oauth-cbor-web-token-00,
> with some input from Hannes and myself.
>
> know) there is a lot of work on the plate already even though it is distributed
> over a number of folks. Furthermore, there also seems to be a strong
> overlap between the participants of the ACE and the COSE working group
> whereby I believe that we have more participants in ACE than in COSE since
> the scope is much broader.
>
> regarding the adoption and placement of new work to define a COSE Token,
> analogous to the JWT from JOSE. In the room, there was a general sentiment
> of support for the work being done, with the wide adoption of JWT and its
> driving of JOSE being a common theme of precedent. What wasn’t clear is
> where the work should be done and to what end it should drive. The six
> positions we are asking the working group to consider and voice their
> support for are:
> >
> > A) Define the COSE Token within the COSE working group along side the
> COSE Messages (and potentially COSE Auxiliary Algorithms) draft.

________________________________
The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.

---

From: Justin Richer <[email-masked]>
Date: Fri, 13 Nov 2015 08:23:20 -0500

(non-chair opinion)

Either A or C, with a preference to A.

There's enough overlap in all the groups that I'm not worried about 
finding "the right expertise". Seriously, people, we all know each 
other, and many of us are in all three groups anyway. Saying there's a 
particular set of expertise in only one group is a red herring. Do you 
really think that there will be someone who will miss this conversation 
if it's done in the "wrong" place? Then make sure they get CC'd to a 
review. Of the three working groups, there are only four distinct chairs.

I think this can be a quick document that simply re-uses or re-defines 
the JWT claims structure for CBOR. Since it will have a direct 
dependency on COSE, I have a mild preference for doing the work here in 
COSE even if it needs a quick recharter to accept the document. That way 
the two of them can more easily go through the IETF process hand in hand.

I do think that doing it in the OAuth group would be a mistake, and I 
see no reason for it. This work has nothing to do with OAuth. A COSE 
token would need to have a non-binary encoding wrapper to be used inside 
of a plain OAuth protocol anyway, since OAuth is HTTP based. It's true 
that JWT was done in OAuth, but I think that was an arbitrary and 
ludicrous decision. It should have been done inside JOSE from the start, 
in my opinion, and I would rather we /learn /from the mistakes of the 
past rather than blindly repeat them.

There's enough drive in the ACE group, and flexibility in their charter, 
that the work could easily be done there as well. And again, there's 
enough overlap between ACE and COSE that we would have appropriate 
conversations in either. However, that does create an arbitrary 
cross-group dependency.

  -- Justin

On 11/13/2015 2:39 AM, Ludwig Seitz wrote:
> Furthermore we need to integrate this with the other ACE work, which 
> is why I think C) is the right choice.
>
> /Ludwig
>
>
>

---

From: Carsten Bormann <[email-masked]>
Date: Fri, 13 Nov 2015 15:09:11 +0100

Justin Richer wrote:
> Since it will have a direct dependency on COSE, I have a mild preference
> for doing the work here in COSE even if it needs a quick recharter to
> accept the document.

Looking at the current proposal, I also see more need for COSE expertise
to complete it than for ACE expertise.  Of course, we do need the
requirements for new labels from ACE if they are to be covered in the
initial CWT document (and probably want to use the registry OAuth
established).

So, for me, A it is.

Grüße, Carsten

---

From: John Bradley <[email-masked]>
Date: Sat, 14 Nov 2015 21:08:38 -0300

My preference is B then A.

We are rechartering OAuth anyway.   We did not do JOSE in the OAuth WG but were responsible for the security token format.

The core of CWT should be in OAuth using the existing JWT registry and extensions done in ACE.

John B.
> On Nov 7, 2015, at 5:01 AM, Justin Richer <[email-masked]> wrote:
>

---

From: Göran Selander <[email-masked]>
Date: Tue, 17 Nov 2015 17:34:12 +0000

I would like to withdraw my previous vote. With the assumption that CWT is
defined as a 1-1 mapping of JWT (which is not how it was defined in the
reference below) I don’t have a strong opinion about where it is defined.
But ACE-specific claims of a JWT/CWT (such as D.1.10) should be defined in
ACE. I believe the latter point of view aligns with that expressed by
others.

Göran

On 2015-11-09 10:20, "Göran Selander" <[email-masked]> wrote:

>>>regarding
>>>COSE

---

From: Erik Wahlström neXus <[email-masked]>
Date: Wed, 18 Nov 2015 09:35:36 +0000

+1
/ Erik

> On 17 Nov 2015, at 18:34, Göran Selander <[email-masked]> wrote:
>

---

From: "Kepeng Li" <[email-masked]>
Date: Wed, 18 Nov 2015 17:41:51 +0800

> ACE-specific claims of a JWT/CWT (such as D.1.10) should be defined in
>ACE. 

+1 for this. 

Kind Regards
Kepeng (as individual)

在 18/11/15 1:34 am， "Göran Selander" <[email-masked]> 写入:

>>>> November 21, 2015; at which time, hopefully we will have a clear
>>>>answer
>>>>and

---

From: Justin Richer <[email-masked]>
Date: Sat, 21 Nov 2015 12:39:00 -0500

Reading through the threads an opinions, there is no clear consensus as to where the work should be done. There is roughly equal support for doing this in any of the three offered working groups.

There is clear consensus that it should be done and that, as much as possible, it should be a direct map of the existing JWT payload object and common claims. 

In this light, someone needs to just start the work as an individual draft and push forward, and whichever working group most wants to can pick it up and publish it. I have no qualms on accepting this work within the COSE working group and I believe there is enough support to warrant that placement if an author submits a draft here (and this remains my preference as an individual), but I will not object to another group picking it up.

I believe, with all of the overlap between groups, that we will have no trouble getting the “right people” to look at it. Additionally, it is clear that it will be very beneficial to have formal reviews from all three groups once the draft has reached a mature status. 

Thankfully, Erik has already done this with his “COSE Web Token” draft. He’s initially targeted this at the OAuth working group, and the work started in ACE, so I call to the author to pick a location and run with it.

 — Justin, your COSE chair

> On Nov 7, 2015, at 3:01 AM, Justin Richer <[email-masked]> wrote:
>

---

From: Erik Wahlström neXus <[email-masked]>
Date: Sun, 22 Nov 2015 21:25:31 +0000

Hi,

Yes, we have a draft posted in the OAuth WG for a CBOR Web Token (CWT). https://tools.ietf.org/id/draft-wahlstroem-oauth-cbor-web-token-00.txt

We want to keep it there and reference the JWT claims (also defined in OAuth WG) and later add attributes needed for authentication and authorization for IoT to JWT/CWT in ACE WG.

Thanks
Erik

On 21 Nov 2015, at 18:39, Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:

On Nov 7, 2015, at 3:01 AM, Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:

Thank you,

* I promised those in the room at Yokohama to offer a flying rat option, for which I am deeply sorry.
_______________________________________________
COSE mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/cose

_______________________________________________
COSE mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/cose

---

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 22 Nov 2015 20:43:46 -0500

Hello,

Looking across the three WGs, there are good arguments for doing the work in each, but ACE would be the best WG for a few reasons.

COSE is supposed to be short-lived, let's keep it that way.

OAUTH has a full plate, although they tend to be very productive.

ACE has just become more focused and I think this could fit well once the OAUTH solution work is underway.

There's enough overlap for this to happen in any of the WGs.

Thanks for the discussion, I was waiting to chime in until it was hashed out a bit to see if there was any overwhelming consensus without influencing the outcome.  Now that it has quieted down, ACE is probably the best plan.

Thanks,
Kathleen 

Sent from my iPhone

> On Nov 22, 2015, at 4:25 PM, Erik Wahlström neXus <[email-masked]> wrote:
> 
> Hi,
> 
>> On 21 Nov 2015, at 18:39, Justin Richer <[email-masked]> wrote:
>>

---

From: Justin Richer <[email-masked]>
Date: Sun, 22 Nov 2015 21:49:22 -0500

Thanks, Kathleen, and thanks to everyone who contributed to the discussion.

The discussion and development of this work will continue in ACE. 

I also propose that we name this work the “COSE Token” instead of “COSE Web Token", because it has very little to do with the web. In fact, CBOR needs to be encoded somehow to fit into HTTP components anyway, and the COSE Token will not likely define such encodings.

Thanks,

> On Nov 22, 2015, at 8:43 PM, Kathleen Moriarty <[email-masked]> wrote:
> 
> Hello,
> 
> On Nov 22, 2015, at 4:25 PM, Erik Wahlström neXus <[email-masked] <mailto:[email-masked]>> wrote:
> 
>> Hi,
>> 
>> Yes, we have a draft posted in the OAuth WG for a CBOR Web Token (CWT). https://tools.ietf.org/id/draft-wahlstroem-oauth-cbor-web-token-00.txt <https://tools.ietf.org/id/draft-wahlstroem-oauth-cbor-web-token-00.txt> 
>> 
>>> On 21 Nov 2015, at 18:39, Justin Richer <[email-masked] <mailto:[email-masked]>> wrote:
>>> 
>>>> On Nov 7, 2015, at 3:01 AM, Justin Richer <[email-masked] <mailto:[email-masked]>> wrote:
>>>> 
>>>> [email-masked] <mailto:[email-masked]>
>>>> https://www.ietf.org/mailman/listinfo/cose <https://www.ietf.org/mailman/listinfo/cose>
>>> 
>>> [email-masked] <mailto:[email-masked]>
>>> https://www.ietf.org/mailman/listinfo/cose <https://www.ietf.org/mailman/listinfo/cose>
>> 
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/cose <https://www.ietf.org/mailman/listinfo/cose>