Subject: Re: [COSE] [Rats] Defining CWT, and JWT in UCCS in EAT

From: Michael Richardson <[email-masked]>
Date: Fri, 17 Dec 2021 16:46:51 -0500

Laurence Lundblade <[email-masked]> wrote:
    > So the question is: where should the CDDL for a CWT go? Here’s the main options I can think of:
    > - EAT
    > - UCCS
    > - CWTbis (a revision of CWT to include CDDL)
    > - Some other new standard
    > - no where, never create it

I'd say that it should go into RFC8152bis. (bis-bis. There is another german
term here).    It's still in AUTH48 right now.  Maybe an appeal to put it in
could occur in cose@

If it too late for that, then in an errata, or another document.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Carsten Bormann <[email-masked]>
Date: Fri, 17 Dec 2021 22:58:19 +0100

On 17. Dec 2021, at 22:46, Michael Richardson <[email-masked]> wrote:
> term here).    

??

> It's still in AUTH48 right now.  Maybe an appeal to put it in
> could occur in cose@
> 

There is no errata.

There is a missing feature — making it easy to interact with the COSE specification via CDDL.
Missing features are addressed in new documents, not in AUTH48.
Certainly not in AUTH48 if there is considerable leeway for designing it and nothing in the original document depends on it.

Grüße, Carsten

---

From: Michael Richardson <[email-masked]>
Date: Fri, 17 Dec 2021 17:54:21 -0500

Isn't there a word for "thrice", which rarely used?
I mean RFC8152bis-bis here.

    > Certainly not in AUTH48 if there is considerable leeway for designing
    > it and nothing in the original document depends on it.

I agree that it's probably too late.
Documents have been extracted out at AUTH48 before and returned to the WG
when the WG realized that events had overtaken.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Carsten Bormann <[email-masked]>
Date: Sat, 18 Dec 2021 02:07:53 +0100

> On 17. Dec 2021, at 23:54, Michael Richardson <[email-masked]> wrote:
> 
> 

ter.  But that’s more of a French thing than German.

> when the WG realized that events had overtaken.

Nothing in COSE is overtaken.
This missing feature (of the specification, not of what is specified) is irking us when we put specs on top of COSE, but the COSE standard works fine without it.

Grüße, Carsten

---

From: Laurence Lundblade <[email-masked]>
Date: Sat, 18 Dec 2021 10:53:58 -0800

On Dec 17, 2021, at 1:46 PM, Michael Richardson <[email-masked]> wrote:
> I'd say that it should go into RFC8152bis. 

Seems it would be as odd going into COSE as it would EAT. 

It would create a circular dependency between CWT and COSE. COSE payloads can be lots of different things. We don’t want to collect the CDDL for various the COSE payloads in COSE. The separation between COSE and its payloads is very clean right now.

What should go into COSE is modifications to the COSE CDDL that defines a template by which the type of the payload can be specified (that template would use a .cbor control; see it done in the replicated COSE CDDL in CoSWID section 7 and 8), but that is not what this thread is about.

Below is the CDDL that this thread is about.

If the below CDDL went into its own document, it would be short. Below is the bulk of the document.

What WG and what charter? It needs to be standards track.

LL

   ; This is the fundamental definition of a Claims-Set for both CBOR
   ; and JSON. It is a set of label-value pairs each of which is a
   ; claim.
   ;
   ; In CBOR the labels can be integers or strings with a strong
   ; preference for integers.  For JSON, the labels are always strings.
   ;
   ; The values can be anything, with some consideration for types that
   ; can work in both CBOR and JSON.

   Claims-Set = {
       * $$claims-set-claims,
       * Claim-Label .feature "extended-label" => any
   }

   Claim-Label = int / text

   string-or-uri = tstr
   time-int = #6.1(int)

   ; This is CDDL for the 7 individual claims that are defined in CWT
   ; and JWT.  This CDDL works for either CBOR format CWT or JSON format
   ; JWT.

   $$claims-set-claims //= (iss-label => string-or-uri)
   $$claims-set-claims //= (sub-label => string-or-uri)
   $$claims-set-claims //= (aud-label => string-or-uri)
   $$claims-set-claims //= (exp-label => ~time)
   $$claims-set-claims //= (nbf-label => ~time)
   $$claims-set-claims //= (iat-label => ~time)
   $$claims-set-claims //= (cti-label => bytes)

   iss-label = 1
   sub-label = 2
   aud-label = 3
   exp-label = 4
   nbf-label = 5
   iat-label = 6
   cti-label = 7