Subject: Re: [Rats] EAT as a JWT/CWT

From: Laurence Lundblade <[email-masked]>
Date: Wed, 12 Jun 2019 10:28:12 -0700

+ Mike for CWT-related comments

I’m planning to put tokenType in the next EAT draft. I will definitely not define the “Cert” and “CoID” types. That will be up to those standards.  I will define “EAT” for certain. I’m not sure what to do about “OAuth” and/or other traditional uses of CWT/JWT. Comments?

Note that this is going inside the token so it is signed rather than outside as a content type or a CBOR tag.

LL

> On May 26, 2019, at 12:38 PM, Laurence Lundblade <[email-masked]> wrote:
> 
> Seems like we would  want an option claim that indicates the purpose of the token. To write my first CDDL:
> 
> tokenType = “EAT" / “OAuth" / “Cert” / “CoID"
> 
> I suspect it will be hard to tell which it is by the make up of the claims and it will matter for some use cases. I’m not sure “OAuth”, “Cert” and “CoID” are right.  The writing does seem to be on the wall that we will eventually replace X.509 cert hierarchies with CWT/JWT hierarchies and I’m not sure if that is a “CoID” or “Cert”.