Subject: [Ace] CBOR Web Token (CWT) spec for the ACE working group

From: Mike Jones <[email-masked]>
Date: Sat, 5 Dec 2015 03:46:54 +0000

After input from many interested people, IETF Security Area Director Kathleen Moriarty decided<http://www.ietf.org/mail-archive/web/cose/current/msg00810.html> that the right place for the CBOR Web Token (CWT) work is the ACE working group<http://datatracker.ietf.org/wg/ace/charter/>.  Today Erik Wahlström posted a new draft of the CBOR Web Token (CWT) specification that is intended for ACE.

This version of the spec references the JSON Web Token (JWT)<http://tools.ietf.org/html/rfc7519> claim definitions, rather than repeating them, and intentionally only includes equivalents of the claims defined by the JWT spec.  Other CWT claims, including those needed by ACE applications, will be defined by other specs and registered in the CWT claims registry.

The specification is available at:

·         http://tools.ietf.org/html/draft-wahlstroem-ace-cbor-web-token-00

An HTML-formatted version is also available at:

·         http://self-issued.info/docs/draft-wahlstroem-ace-cbor-web-token-00.html

                                                                -- Mike

P.S.  This note was also posted at http://self-issued.info/?p=1503 and as @selfissued<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftwitter.com%2fselfissued&data=01%7c01%7cMichael.Jones%40microsoft.com%7c90a27b03c3c6448e4c3608d2aa6ea07c%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=s853DPkED04jn0TfPCt08beP%2fb%2fj7JFatTC5enN7rBU%3d>.

---

From: Tim Moses <[email-masked]>
Date: Sat, 5 Dec 2015 17:56:23 +0000

Hi Mike. Can you help with this?

Clearly, CWT is a suitable basis for operationalizing authn and authz in the ACE context. And we should expect to see enhancements to CWT for the purpose.

But, what about key management for ACE (whether we are talking about bearer tokens, symmetric keys or asymmetric keys)?  It seems to me that CBOR Encoded Message Syntax has a head start in this regard.

Is this how people see the division of responsibilities?  CWT for operation and CEMS for management?

All the best. Tim.

On Dec 4, 2015, at 10:47 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:

                                                                -- Mike

P.S.  This note was also posted at http://self-issued.info/?p=1503 and as @selfissued<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftwitter.com%2fselfissued&data=01%7c01%7cMichael.Jones%40microsoft.com%7c90a27b03c3c6448e4c3608d2aa6ea07c%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=s853DPkED04jn0TfPCt08beP%2fb%2fj7JFatTC5enN7rBU%3d>.
_______________________________________________
Ace mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ace

---

From: Michael Richardson <[email-masked]>
Date: Wed, 30 Dec 2015 16:56:44 -0500

On 12/04/15 22:46, Mike Jones wrote:
> After input from many interested people, IETF Security Area Director
> Kathleen Moriarty decided
> <http://www.ietf.org/mail-archive/web/cose/current/msg00810.html> that
> the right place for the CBOR Web Token (CWT) work is the ACE working
> group <http://datatracker.ietf.org/wg/ace/charter/>.  Today Erik
> Wahlström posted a new draft of the CBOR Web Token (CWT) specification
> that is intended for ACE.

Thank you. I read the document today.  I hadn't read it before.
The appendix is appreciated, the lack of repetition will make be go and
dig into references, but that's okay.

I wonder if the result after "This is then packaged signed and encrypted
using COSE" could also be added to the appendix?

in figure 7, I don't think it's useful to show the \x expansion of
what is essentially a binary value:

bac5b11cad8f99f9c72b05cf4b9e26d244dc189f745228255a219a86d6a09eff #
"\xBA\xC5\xB1\x1C\xAD\x8F\x99\xF9\xC7+\x05\xCFK\x9E&\xD2D\xDC\x18\x9FtR(%Z!\x9A\x86\xD6\xA0\x9E\xFF"

(and it ruins the formatting...)
Perhaps this is automatically done by a tool.