Subject: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

From: "Sabrina Tanamal via RT" <[email-masked]>
Date: Tue, 10 Mar 2020 21:34:29 +0000

Hi all, 

Have you had a chance to review Ludwig's response below? 

Thanks,
Sabrina 

> I strongly disagree with the assessment that the scope claim should be
> pushed into the two-byte range.
> 
> The reason we introduced the scope claim is that an ACE RS typically
> does not have a direct connection to the AS, and is therefore unable
> to
> retrieve the scope of an access token from other sources than the
> access
> token itself.  I therefore assert that ACE access tokens would often
> need to contain this claim in order to inform the RS.
> Since one of the major drivers of the ACE work has been to reduce the
> authorization overhead (otherwise we could just have used vanilla
> OAuth
> 2.0), I find it strange to needlessly add to the overhead by making
> the
> encoding of a frequently used claim longer than necessary.
> 
> I am willing to listen to the arguments that have lead the expert
> reviewer to denying a value in the one-byte range, and discuss the
> reasoning further on list.
> 
> Regards,
> 
> Ludwig
> 
> 
> > On Tue Feb 18 22:42:22 2020, [email-masked] wrote:
> >> I'm mostly OK with these registrations, however, DO NOT assign the
> >> value 9 to "scope".   Rather, please put it in the two-byte range
> >> - for instance, with the value 41.
> >>
> >> -- Mike
> >>
> >> -----Original Message----- From: Cwt-reg-review
> >> <[email-masked]> On Behalf Of Sabrina Tanamal via
> >> RT Sent: Tuesday, February 18, 2020 1:06 PM Cc:
> >> [email-masked] Subject: [EXTERNAL] [Cwt-reg-review] [IANA
> >> #1158953] Requested review for IANA registration in
> >> draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)
> >>
> >> Hi all,
> >>
> >> Resending this request for draft-ietf-ace-oauth-authz.
> >>
> >> Thanks,
> >>
> >> Sabrina Tanamal Senior IANA Services Specialist
> >>
> >>> On Sat Dec 21 11:37:11 2019, [email-masked] wrote:
> >>>> Hello CWT registry reviewers,
> >>>>
> >>>> the IESG-designated experts for the CWT claims registry have
> >>>> asked me to send a review request to you about the claims
> >>>> registered here:
> >>>>
> >>>> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fto
> >>>>
> >>>>
> ols.ietf.org%2Fhtml%2Fdraft-ietf-ace-oauth-authz-29%23section-
> >>>> 8.13&a
> >>>> mp;data=02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad74269c3
> >>>>
> >>>>
> c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63717656
> >>>> 7656665548&amp;sdata=r01W5Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk%3
> >>>>
> >>>>
> D&amp;reserved=0
> >>>>
> >>>> Thank you in advance for you review comments.
> >>>>
> >>>> Regards,
> >>>>
> >>>> Ludwig
> >>>>
> >>
> >> _______________________________________________ Cwt-reg-review
> >> mailing list [email-masked]
> >> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fcwt-
> >>
> >>
> reg-
> >> review&amp;data=02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad74269c3c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637176567656675543&amp;sdata=XxBhQmqxGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VUsHOsg%3D&amp;reserved=0
> >

---

From: Mike Jones <[email-masked]>
Date: Wed, 11 Mar 2020 23:39:00 +0000

[Adding correct e-mail addresses for Chuck, who recently joined Visa]

There are two reasons that I believe not using up one of the scarce one-byte claim identifiers for "scope" is appropriate:

  1.  The claim values for scopes are not short themselves.  They are sets of ASCII strings separated by spaces. So the percentage difference in the total claim representation from adding a single byte will typically be small.
  2.  The single-byte claim identifiers already registered at https://www.iana.org/assignments/cwt/cwt.xhtml are claims that are likely to be useful to diverse sets of applications, and therefore merit the short identifiers; whereas, the scope claim is specific to the ACE OAuth protocol and not applicable to diverse sets of applications.  It's reasonable to give protocol-specific claim identifiers 2-byte representations.

I'd be interested to hear from the two other designated experts on my assessment of the situation: Hannes and Chuck.

                                                       -- Mike

-----Original Message-----
From: Cwt-reg-review <[email-masked]> On Behalf Of Ludwig Seitz
Sent: Saturday, February 29, 2020 6:25 AM
To: [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

On 2020-02-26 00:58, Amanda Baber via RT wrote:

> Ludwig, Hannes,

> Can you confirm that you can make the CBOR Web Token Claim change

> requested below?

> We also have Chuck Mortimore listed as an expert for this registry,

> but our message to his Salesforce address bounced.

> Best regards,

> Amanda Baber Lead IANA Services Specialist

I strongly disagree with the assessment that the scope claim should be pushed into the two-byte range.

The reason we introduced the scope claim is that an ACE RS typically does not have a direct connection to the AS, and is therefore unable to retrieve the scope of an access token from other sources than the access token itself.  I therefore assert that ACE access tokens would often need to contain this claim in order to inform the RS.

Since one of the major drivers of the ACE work has been to reduce the authorization overhead (otherwise we could just have used vanilla OAuth 2.0), I find it strange to needlessly add to the overhead by making the encoding of a frequently used claim longer than necessary.

I am willing to listen to the arguments that have lead the expert reviewer to denying a value in the one-byte range, and discuss the reasoning further on list.

Regards,

Ludwig

> On Tue Feb 18 22:42:22 2020, [email-masked]<mailto:[email-masked]> wrote:

>> <[email-masked]<mailto:[email-masked]>> On Behalf Of Sabrina Tanamal via RT

>> Sent: Tuesday, February 18, 2020 1:06 PM Cc:

>> [email-masked]<mailto:[email-masked]> Subject: [EXTERNAL] [Cwt-reg-review] [IANA

>>> On Sat Dec 21 11:37:11 2019, [email-masked]<mailto:[email-masked]> wrote:

>>>> the IESG-designated experts for the CWT claims registry have asked

>>>> me to send a review request to you about the claims registered

>>>> here:

>>>> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft

>>>> o

>>>> mp;data=02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad74269c

>>>> 3

>>>> 7656665548&amp;sdata=r01W5Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk%

>>>> 3

D&amp;reserved=0

>> mailing list [email-masked]<mailto:[email-masked]>

>> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww

>> .ietf.org%2Fmailman%2Flistinfo%2Fcwt-

reg-

>> review&amp;data=02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad

>> 74269c3c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63

>> 7176567656675543&amp;sdata=XxBhQmqxGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VUsH

>> Osg%3D&amp;reserved=0

_______________________________________________

Cwt-reg-review mailing list

[email-masked]<mailto:[email-masked]>

https://www.ietf.org/mailman/listinfo/cwt-reg-review

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 11 Mar 2020 16:49:44 -0700

On Wed, Mar 11, 2020 at 11:39:00PM +0000, Mike Jones wrote:
>   1.  The claim values for scopes are not short themselves.  They are sets of ASCII strings separated by spaces. So the percentage difference in the total claim representation from adding a single byte will typically be small..

ACE allows the scope to be a binary value and to use a different convention
than space-separated for multi-value scopes.

>   2.  The single-byte claim identifiers already registered at https://www.iana.org/assignments/cwt/cwt.xhtml are claims that are likely to be useful to diverse sets of applications, and therefore m…

(This point I don't have a good response for.)

-Ben

> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace

---

From: Chuck Mortimore <[email-masked]>
Date: Wed, 11 Mar 2020 17:12:27 -0700

Agree with Mike's assessment.   (One caveat to that is that I'm not close
enough to CWT to understand how scare the single byte identifiers actually
are.)

On Wed, Mar 11, 2020 at 4:39 PM Mike Jones <[email-masked]>
wrote:

> There are two reasons that I believe not using up one of the scarce
> one-byte claim identifiers for "scope" is appropriate:
>
>    1. The claim values for scopes are not short themselves.  They are
>    sets of ASCII strings separated by spaces. So the percentage difference in
>    the total claim representation from adding a single byte will typically be
>    small.
>    2. The single-byte claim identifiers already registered at
>    https://www.iana.org/assignments/cwt/cwt.xhtml are claims that are
>    likely to be useful to diverse sets of applications, and therefore merit
>    the short identifiers; whereas, the scope claim is specific to the ACE
>    OAuth protocol and not applicable to diverse sets of applications.  It’s
>    reasonable to give protocol-specific claim identifiers 2-byte
>    representations.
>
>
>
> I’d be interested to hear from the two other designated experts on my
> assessment of the situation: Hannes and Chuck.
>
>
>
>                                                        -- Mike
>
>
>
> Subject: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review
> for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token
> Claims)
>
>
>
> The reason we introduced the scope claim is that an ACE RS typically does
> not have a direct connection to the AS, and is therefore unable to retrieve
> the scope of an access token from other sources than the access token
> itself.  I therefore assert that ACE access tokens would often need to
> contain this claim in order to inform the RS.
>
> authorization overhead (otherwise we could just have used vanilla OAuth
> 2.0), I find it strange to needlessly add to the overhead by making the
> I am willing to listen to the arguments that have lead the expert reviewer
> to denying a value in the one-byte range, and discuss the reasoning further
> on list.
>
>
>
> Regards,
>
>
>
> Ludwig
>
>
>
>
>
> >> <[email-masked]> On Behalf Of Sabrina Tanamal via RT
>
> [email-masked]