Subject: [Rats] Jim's Jabber questions

From: Carsten Bormann <[email-masked]>
Date: Wed, 29 Apr 2020 10:25:57 +0200

Yesterday, in the jabber channel, Jim asked two questions that I didn't see and thus didn't answer.

(1) I think that maybe a better name might be unprotected rather than unsigned	

A: Indeed!  That is such a great idea that the title of draft-birkholz-rats-uccs-00 is:
»A CBOR Tag for Unprotected CWT Claims Sets«.

(2) I assume that a secure channel w/o authentication of both ends is not secure in this context?  Or do you only need to have authenticated the entity at the end that is providing the claims?

A: Also, the emitter of the claims may be interested in authenticating the receiver, so it knows who it is disclosing the claims to, and the receiver may not have a good way to authenticate the emitter before looking at the claims that it receives confidentially (the Web TLS scenario, in other words).

Grüße, Carsten