Subject: [Ace] draft-wahlstroem-oauth-cbor-web-token

From: "Jim Schaad" <[email-masked]>
Date: Fri, 11 Dec 2015 23:26:09 -0800

Not sure where the correct cc of this is, but I seem to remember it is going
to ACE not OAUTH.

1.  This is just a to be considered issue, I can easily see that there is
sufficient argument not to change the type for StringOrUIR from the string
type, however it might be useful to use the text string and the URI type
(tag 32) rather than the colon character to differentiate between strings
and URIs.

2.  I would strongly suggest consideration of the CBOR type of numeric date
rather than the string version (Major type 6, minor type 1).  This will lead
to a much more compact form of date encoding in most if not all cases.
After reading farther, it would appear that the text is assuming it is using
numeric version so the text is wrong.

3.  Is there a reason why you are not using integers for the labels in the
map rather than strings?

4.  There is no reason to continuously repeat the case-sensitive string,
that is implied by saying StringOrURI value.  Thus s/case-sensitive string
containing a StringOrURI value/a value of type StringOrURI/

5.  You should be consistent in language.  Either you should reject the CWT
or you should not accept it for processing.  Even better would probably be
to 1) state things positively and not negatively (testing compliance is
easier) and 2)  have a clearer statement on what the CWT is for.  Thus "The
"nbf" claim identifies the time the CWT expires.  The current time MUST be
after or equal to the "nbf" value for the CWT to be used in decision
processing."

6.  It would seem to be better to make cti be a binary value as it is a
denser range of values to choose from and thus not need as many bits to
ensure uniqueness.

7.  What is the purpose of the value column in figure 1?

8.  The example is incorrect.  It should be

{
     "iss": "coap://as.example.com",
     "aud": "coap://light.example.com",
     "exp": 1(1444064944),
     "iat": 1(1443944944)
   }

Nits:
Section 1 - s/re-used/used/

---

From: Erik Wahlström neXus <[email-masked]>
Date: Sat, 12 Dec 2015 07:56:30 +0000

Hi Jim,

Thanks for you review. It’s very much appreciated. There where a debate on where to post the CWT document (COSE, ACE or Oauth). It all ended up in the ACE WG. We published a revised and updated CWT document to ACE, you can find it here: https://tools.ietf.org/html/draft-wahlstroem-ace-cbor-web-token-00.

See comments below.

On 12 Dec 2015, at 08:26, Jim Schaad <[email-masked]<mailto:[email-masked]>> wrote:

Was actually on the same track there and even added a "FIXME: Use tag 32 for URIs?” in the new ACE version. I’m still on the fence there but leaning towards using string to keep it as opaque as possible for parsers.

Text is updated in new version and I will add the change of the type to numeric date to a issue tracker.

No. See new table in new ace version.

Fixed in new version.

processing.”

The new version reference the JWT spec in much more detail based on input from earlier reviews. Good input on general text about processing. New sections needs to be added on how to test compliance https://tools.ietf.org/html/rfc7519#section-7.

Good point. Will add that as issue.

{

There are new and much more detailed examples in new ace wg doc.

Nits:

+1

Thanks!

/ Erik