Subject: [COSE] A draft on CBOR Web Tokens (CWT)

From: Erik Wahlström neXus <[email-masked]>
Date: Thu, 12 Nov 2015 19:10:16 +0000

Hi,

In the ACE WG a straw man proposal of a CBOR Web Token (CWT) was defined in the draft "Authorization for the Internet of Things using OAuth 2.0” [1]. We just broke out the CBOR Web Token into a separate draft and the new draft is submitted to the OAUTH WG. It can be found here:

https://datatracker.ietf.org/doc/draft-wahlstroem-oauth-cbor-web-token/

Abstract:
"CBOR Web Token (CWT) is a compact means of representing claims to be transferred between two parties.  CWT is a profile of the JSON Web Token (JWT) that is optimized for constrained devices. The claims in a CWT are encoded in the Concise Binary Object Representation (CBOR) and CBOR Object Signing and Encryption (COSE) is used for added application layer security protection.  A claim is a piece of information asserted about a subject and is represented as a name/value pair consisting of a claim name and a claim value."

/ Erik

[1] https://tools.ietf.org/html/draft-seitz-ace-oauth-authz-00

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 12 Nov 2015 20:45:04 +0100

Hi Erik,

having this draft is a good thing.

One thing I'm still wondering is what WG is the best place to progress
this.  We probably don't need to spend too much time on this because,
regardless of the WG chosen, the people in another WG can look at it.
Still, getting this right might provide some efficiencies.

What is the technical content of this draft?  Is it a new token that
OAuth needs specifically for the new COSE-based applications of OAuth?
Is it a new token that is specifically there for addressing ACE needs?
Or is it essentially the same substance as JWT, but phrased in and
profiled for CBOR?

Depending on the answer, CWT should be done in OAuth, ACE, or COSE.
(I'd rather hear the answer from the authors than venture a guess myself.)

Grüße, Carsten

Erik Wahlström neXus wrote:
> Hi,
> 
> In the ACE WG a straw man proposal of a CBOR Web Token (CWT) was defined
> in the draft "Authorization for the Internet of Things using OAuth 2.0”
> [1]. We just broke out the CBOR Web Token into a separate draft and the
> new draft is submitted to the OAUTH WG. It can be found here: 
> 
> "CBOR Web Token (CWT) is a compact means of representing claims to be
> transferred between two parties.  CWT is a profile of the JSON Web Token
> (JWT) that is optimized for constrained devices. The claims in a CWT are
> encoded in the Concise Binary Object Representation (CBOR) and CBOR
> Object Signing and Encryption (COSE) is used for added application layer
> security protection.  A claim is a piece of information asserted about a
> subject and is represented as a name/value pair consisting of a claim
> name and a claim value."
> 
> / Erik
> 
> 
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose

---

From: Erik Wahlström neXus <[email-masked]>
Date: Thu, 12 Nov 2015 20:01:24 +0000

Hi Carsten,

Thanks, and I agree. I’ve heard arguments for all three work groups.

Borrowed some of your words to define the content of the draft :)
It’s it essentially a JWT, phrased in and profiled for CBOR to address ACE needs, where OAuth needs COSE functionality, for object security.

I’m open for letting the AD’s move it around, but having it right next to JWT seems right to me. Also open for the ACE WG. Feel it has less place in COSE for the same reasons JWT is not in the JOSE WG.

/ Erik

> On 12 Nov 2015, at 20:45, Carsten Bormann <[email-masked]> wrote:
> 
> Hi Erik,
>

---

From: Mike Jones <[email-masked]>
Date: Thu, 12 Nov 2015 20:43:57 +0000

This specification, when complete, should meet the need for a general cryptographically secured CBOR application payload format, obviating the urge to jam application fields into COSE headers.  For instance, the “creation time” value that was the subject of issue #13<https://github.com/cose-wg/cose-issues/issues/13> can be replaced by the “issued at” time in CWT.

Thanks to Erik and Hannes for helping to kick this off!

                                                            -- Mike

From: Mike Jones
Sent: Thursday, November 12, 2015 12:39 PM
To: 'Erik Wahlström neXus'; <[email-masked]>
Subject: RE: A draft on CBOR Web Tokens (CWT)

FYI - I also wrote about this at http://self-issued.info/?p=1476 and as @selfissued<https://twitter.com/selfissued>.

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of Erik Wahlström neXus
Sent: Thursday, November 12, 2015 11:26 AM
To: <[email-masked]<mailto:[email-masked]>>
Subject: [OAUTH-WG] A draft on CBOR Web Tokens (CWT)

Hi,

Abstract:

/ Erik

OAuth mailing list

[email-masked]<mailto:[email-masked]>

https://www.ietf.org/mailman/listinfo/oauth

---

From: Justin Richer <[email-masked]>
Date: Thu, 12 Nov 2015 16:02:05 -0500

Thanks very much, Eric.

As we promised in Yokohama, the chairs of the COSE working group are currently running a consensus call thread about this very topic, and I’d encourage others to join that discussion. The thread starts here:

http://www.ietf.org/mail-archive/web/cose/current/msg00747.html

 — Justin

> On Nov 12, 2015, at 2:10 PM, Erik Wahlström neXus <[email-masked]> wrote:
> 
> Hi,
> 
> https://datatracker.ietf.org/doc/draft-wahlstroem-oauth-cbor-web-token/ <https://datatracker.ietf.org/doc/draft-wahlstroem-oauth-cbor-web-token/>
> 
> Abstract: 
> [1] https://tools.ietf.org/html/draft-seitz-ace-oauth-authz-00 <https://tools.ietf.org/html/draft-seitz-ace-oauth-authz-00>
> 
>

---

From: William Denniss <[email-masked]>
Date: Thu, 12 Nov 2015 19:19:26 -0800

Regarding the draft itself, a few comments:

1.
Can we unify the claim registry with JWT? I'm worried about having the same
claims defined twice in CWT and JWT with possibly conflicting meanings (and
needless confusion even when they do match).

Comparing
https://tools.ietf.org/html/draft-wahlstroem-oauth-cbor-web-token-00#section-3.1.2
and https://tools.ietf.org/html/rfc7519#section-4.1.2 which are nearly
identical, I just don't see the value in re-defining it.

We may add new standard claims to JWT in the future (I proposed one
<https://mailarchive.ietf.org/arch/search/?email_list=id-event&gbt=1&index=7qNUnaE9lt2LyayMnmNyWpZSIEM>
in
Yokohama on the id-event list
<https://www.ietf.org/mailman/listinfo/id-event>), it would be good if this
didn't need a separate entry in CWT too, but could just apply directly
(separately, I think you should consider this claim, as it helps prevent
tokens from being re-used in the wrong context).

2.
Is Section 4 "Summary of CBOR major types used by defined claims" normative
(
https://tools.ietf.org/html/draft-wahlstroem-oauth-cbor-web-token-00#section-4)?
What is the intention of this section? I feel like it could probably be
fleshed out a bit.

3.
Add a xref to draft COSE spec in section 6
<https://tools.ietf.org/html/draft-wahlstroem-oauth-cbor-web-token-00#section-6>
Add xref to RFC7519

On Thu, Nov 12, 2015 at 12:01 PM, Erik Wahlström neXus <
[email-masked]> wrote:

> It’s it essentially a JWT, phrased in and profiled for CBOR to address ACE
> needs, where OAuth needs COSE functionality, for object security.
>
> I’m open for letting the AD’s move it around, but having it right next to
> JWT seems right to me. Also open for the ACE WG. Feel it has less place in
> COSE for the same reasons JWT is not in the JOSE WG.
>
> / Erik
>
>