Subject: [Ace] CoAP Content-Format

From: Samuel Erdtman <[email-masked]>
Date: Sat, 23 Jan 2016 14:23:29 +0100

Hi,

I´m writing on the draft-ietf-ace-oauth-authz and came to the point where I
need a Content-Format for conveying the PoP token from the Client to the
Resource Server as content of a CoAP POST.

draft-ietf-ace-oauth-authz does not mandate use of COSE encoded tokens but
it seems reasonable, I could use application/cbor but
application/cose, application/cose+cwt
or application/cwt seems more appropriate.
Are there plans to register any of these Content-Format either from the
COSE specification or the CWT specification or should I do something from
 draft-ietf-ace-oauth-authz?

Best Regards
//Samuel

---

From: Carsten Bormann <[email-masked]>
Date: Sat, 23 Jan 2016 18:10:10 +0100

> I´m writing on the draft-ietf-ace-oauth-authz and came to the point
> where I need a Content-Format for conveying the PoP token from the
> Client to the Resource Server as content of a CoAP POST.
> 
> draft-ietf-ace-oauth-authz does not mandate use of COSE encoded tokens
> but it seems reasonable, I could use application/cbor
> but application/cose, application/cose+cwt or application/cwt seems
> more appropriate.

Once a COSE-based OAuth token is defined, that should get a media type
and a do a CoAP content-format registration right with that.

There is a bit of structure behind the +xyz names, so here this would be:

application/cwt+cbor

(but then, because of the signing, there is little point in having
anything but a cbor version of that, so the +cbor is a bit redundant).

> COSE specification or the CWT specification or should I do something
> from  draft-ietf-ace-oauth-authz?

Whoever gets to define the media type (format, contents, processing
rules) gets to register it.  Is this a CWT?  Are we done with deciding
which WG does CWT?

Grüße, Carsten

---

From: "Jim Schaad" <[email-masked]>
Date: Sat, 23 Jan 2016 13:33:35 -0800

The COSE document registers application/cose but not application/cose+cbor.  I don’t know the status of CWT.

Jim

From: Samuel Erdtman [mailto:[email-masked]] 
Sent: Saturday, January 23, 2016 5:23 AM
To: cose <[email-masked]>; Jim Schaad <[email-masked]>; [email-masked]; Erik Wahlström <[email-masked]>
Subject: CoAP Content-Format

Hi,

I´m writing on the draft-ietf-ace-oauth-authz and came to the point where I need a Content-Format for conveying the PoP token from the Client to the Resource Server as content of a CoAP POST.

draft-ietf-ace-oauth-authz does not mandate use of COSE encoded tokens but it seems reasonable, I could use application/cbor but application/cose, application/cose+cwt or application/cwt seems more appropriate.

Are there plans to register any of these Content-Format either from the COSE specification or the CWT specification or should I do something from  draft-ietf-ace-oauth-authz?

Best Regards

//Samuel

---

From: "Kepeng Li" <[email-masked]>
Date: Mon, 25 Jan 2016 08:52:36 +0800

> Are we done with deciding which WG does CWT?

Yes, it should be done in ACE WG.

Please refer to the discussions in COSE mailing list:
http://www.ietf.org/mail-archive/web/cose/current/msg00810.html

Kind Regards
Kepeng

在 24/1/16 1:10 am， "Carsten Bormann" <[email-masked]> 写入:

>_______________________________________________
>COSE mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/cose

---

From: Erik Wahlström <[email-masked]>
Date: Mon, 25 Jan 2016 11:52:34 +0100

Hi,

Latest version can be found here (in ace):
https://datatracker.ietf.org/doc/draft-wahlstroem-ace-cbor-web-token/ <https://datatracker.ietf.org/doc/draft-wahlstroem-ace-cbor-web-token/>

The earlier document in oauth2 is archived and also replaced by above version.

I added a potential Content-Format as a new issue in an issue tracker for CWT.
https://github.com/erwah/ietf/issues/7 <https://github.com/erwah/ietf/issues/7>

/ Erik

> On 25 Jan 2016, at 01:52, Kepeng Li <[email-masked]> wrote:
>