Subject: Re: [Ace] [Technical Errata Reported] RFC8392 (5710)

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 29 Apr 2019 11:00:38 -0500

On Mon, Apr 29, 2019 at 08:55:53AM -0700, RFC Errata System wrote:
> The following errata report has been submitted for RFC8392,
> "CBOR Web Token (CWT)".
> 
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata/eid5710
> 
> --------------------------------------
> Type: Technical
> Reported by: Felipe Gasper <[email-masked]>
> 
> Section: 1.1
> 
> Original Text
> -------------
> In JSON, maps are called objects and only have one kind of map key: a
>    string.  CBOR uses strings, negative integers, and unsigned integers
>    as map keys.
> 
> Corrected Text
> --------------
> In JSON, maps are called objects and only have one kind of map key:
> a string.  CBOR allows other data types, such as strings, negative
> integers, and unsigned integers, as map keys.
> 
> Notes
> -----
> The text as it stands risks an interpretation that CBOR limits map keys to integers and strings; per discussion on the CBOR mailing list, this is not the case.

I see the CBOR list traffic in the archive (e.g.,
https://mailarchive.ietf.org/arch/msg/cbor/LyndIfQipxUfx0cu6nlOwi6ceOY) and
agree with the sentiment that the CWT spec should not inadvertently
over-specify the behavior of CBOR

The proposed new text is itself flawed, though, as it claims that strings
are an "other data type" with respect to strings.

-Ben

---

From: Felipe Gasper <[email-masked]>
Date: Mon, 29 Apr 2019 12:03:57 -0400

> On Apr 29, 2019, at 12:00 PM, Benjamin Kaduk <[email-masked]> wrote:
> 

Ah, agreed. Is there a way I can update my proposed phrase? The editor only seems to allow submission of a new erratum.

It may be worth disambiguating between binary and UTF-8 strings, too; JSON only allows UTF-8 strings, while CBOR also allows binary.

-F

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 29 Apr 2019 11:05:45 -0500

> Ah, agreed. Is there a way I can update my proposed phrase? The editor only seems to allow submission of a new erratum.

I can edit the "corrected text" field during the verification process...

> It may be worth disambiguating between binary and UTF-8 strings, too; JSON only allows UTF-8 strings, while CBOR also allows binary.

...so we can figure out the right phrasing here on the list, and then I'll
fix things up in the system.

-Ben

---

From: Felipe Gasper <[email-masked]>
Date: Mon, 29 Apr 2019 12:15:32 -0400

> On Apr 29, 2019, at 12:05 PM, Benjamin Kaduk <[email-masked]> wrote:
> 

So maybe something like:

-----
In JSON, maps are called objects and only have one kind of key:
a UTF-8 string. In CBOR, any valid CBOR item can be a map key.
CWT uses signed and unsigned integers, in addition to UTF-8 strings,
as map keys.
-----

-F

---

From: Jim Schaad <[email-masked]>
Date: Mon, 29 Apr 2019 09:21:14 -0700

> -----Original Message-----
> From: Felipe Gasper <[email-masked]>
> Sent: Monday, April 29, 2019 9:04 AM
> To: Benjamin Kaduk <[email-masked]>
> Cc: [email-masked]; [email-masked]; [email-masked];
> [email-masked]; [email-masked]; [email-masked];
> [email-masked]; [email-masked]
> Subject: Re: [Technical Errata Reported] RFC8392 (5710)
> 
> 
> >> The following errata report has been submitted for RFC8392, "CBOR Web
> >> Token (CWT)".
> >>
> >> The text as it stands risks an interpretation that CBOR limits map keys
to
> integers and strings; per discussion on the CBOR mailing list, this is not
the
> case.
> > https://mailarchive.ietf.org/arch/msg/cbor/LyndIfQipxUfx0cu6nlOwi6ceOY
> > ) and agree with the sentiment that the CWT spec should not
> > inadvertently over-specify the behavior of CBOR
> >
> > The proposed new text is itself flawed, though, as it claims that
> > strings are an "other data type" with respect to strings.
> 
> Ah, agreed. Is there a way I can update my proposed phrase? The editor
only
> seems to allow submission of a new erratum.
> 
> It may be worth disambiguating between binary and UTF-8 strings, too; JSON
> only allows UTF-8 strings, while CBOR also allows binary.

I would agree that it would make sense to say that.  However CBOR uses the
term "byte string" not "binary string" so use the right term.

Jim

---

From: RFC Errata System <[email-masked]>
Date: Mon, 29 Apr 2019 08:55:53 -0700 (PDT)

Section: 1.1

Original Text
-------------

Corrected Text
--------------

Notes
-----

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC8392 (draft-ietf-ace-cbor-web-token-15)
--------------------------------------
Title               : CBOR Web Token (CWT)
Publication Date    : May 2018
Author(s)           : M. Jones, E. Wahlstroem, S. Erdtman, H. Tschofenig
Category            : PROPOSED STANDARD
Source              : Authentication and Authorization for Constrained Environments
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 29 Apr 2019 18:45:44 +0200

(Resending to ACE list with recipient list trimmed.)

> On Apr 29, 2019, at 18:40, Carsten Bormann <[email-masked]> wrote:
> 
> On Apr 29, 2019, at 18:15, Felipe Gasper <[email-masked]> wrote:
>> 
> s/CBOR item/CBOR data item/ (this is the term we use in 7049)
> 
> Also, I think
> s/UTF-8 string/text string/g
> The fact that this is encoded in UTF-8 is somewhat on a different level of detail.
> 
> Finally, s/signed/negative/ if you want to follow the CBOR terminology here.
> (Otherwise, all unsigned integers are also signed integers :-)
> 
> Grüße, Carsten
> 
> 
>

---

From: Felipe Gasper <[email-masked]>
Date: Mon, 29 Apr 2019 12:48:10 -0400

> On Apr 29, 2019, at 12:40 PM, Carsten Bormann <[email-masked]> wrote:
> 

Iteration #3:

-----
In JSON, maps are called objects and only have one kind of key:
a text string. CBOR allows any data item to be a map key.
CWT thus uses integers, in addition to text strings, as map keys.
-----

-FG

---

From: Jim Schaad <[email-masked]>
Date: Mon, 29 Apr 2019 09:53:01 -0700

> From: Carsten Bormann <[email-masked]>
> Sent: Monday, April 29, 2019 9:41 AM
> To: Felipe Gasper <[email-masked]>
> Cc: Benjamin Kaduk <[email-masked]>; Roman Danyliw <[email-masked]>;
> Daniel Migault <[email-masked]>; [email-masked];
> [email-masked]; [email-masked]; [email-masked];
> [email-masked]; [email-masked]
> Subject: Re: [Ace] [Technical Errata Reported] RFC8392 (5710)
> 

+1 on this.  There is not really a restriction that UTF-8 strings be the key in JSON.  If you encoded the JSON as UTF-16 then it would be a UTF-16 string.

Jim

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 29 Apr 2019 11:57:00 -0500

> +1 on this.  There is not really a restriction that UTF-8 strings be the key in JSON.  If you encoded the JSON as UTF-16 then it would be a UTF-16 string.

I think I'm also +1 on that, but do recall that RFC 8529 mandates UTF-8 for
exchange among a non-closed ecosystem (i.e., all internet usage).

-Ben