Subject: [Rats] Including public keys and such in EAT

From: Laurence Lundblade <[email-masked]>
Date: Tue, 10 Nov 2020 12:26:15 -0800

I’m hoping for a lot of discussion and input on this PR <https://github.com/ietf-rats-wg/eat/pull/71> about the inclusion of keys in claims.

Seems to me there are lots of use cases for key inclusion and they have semantics that vary too much to fit into  one claim. I’ve chosen primarily to write guidelines rather than define claims.

One use case is a CSR. However, RFC 8747 doesn’t define a CSR, so referencing it isn’t sufficient.

Attestations from the Android key store include things like security level and user authentication requirements for use. Going into all that is too much for EAT, but might be good in another document.

FIDO goes one step beyond Android and binds a relying party/user/device tuple with the key.

It is a little tempting to define a security level for the storage and operation of keys since EAT has a security level definition.

LL