Subject: [Rats] EAT sections 3.1 and 3.2 purpose

From: "Smith, Ned" <[email-masked]>
Date: Mon, 22 Jul 2019 19:36:01 +0000

It seems sections 3.1 and 3.2 are essentially pointing to already defined tokens and endorsing them as RATS ‘claims’. What is the purpose in including them here if they are taken as is from existing drafts?

Given EAT claims are all optional, would it be problematic for EAT to simply state that any existing CWT/JWT token could be supplied as an EAT claim?

It seems there is value in including a token that is defined elsewhere (JWT/CWT) only if the semantics differ when used in the context of RATS/EAT.

I also wonder if RATS/EAT use of claims/tokens shouldn’t be restricted further to include only those tokens that are within the security boundary or controlled by a trusted environment in which the attestation key is also resident / protected. See Issue #24.