Subject: [Ace] question about wrong types

From: Jim Schaad <[email-masked]>
Date: Fri, 21 Oct 2016 21:05:43 -0700

What is the correct behavior if the type of a value is incorrect?  Is the
CWT to be rejected or is it optional for the application if it is rejected.
As an example, what happens if the "iat" claim name is associated with a
CBOR Type 0 instead of using the Tag #6.1 in front of the type 0 value.

Jim

---

From: Samuel Erdtman <[email-masked]>
Date: Mon, 24 Oct 2016 17:42:12 +0200

Hi,

I would opt for reject, and if the we think it is to narrow to require the
tag then we should explicitly change that.

//Samuel

On Sat, Oct 22, 2016 at 6:05 AM, Jim Schaad <[email-masked]> wrote:

> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace
>

---

From: Ludwig Seitz <[email-masked]>
Date: Tue, 25 Oct 2016 07:52:18 +0200

On 2016-10-24 17:42, Samuel Erdtman wrote:
> Hi,
>
> I would opt for reject, and if the we think it is to narrow to require
> the tag then we should explicitly change that.
>
> //Samuel
>

Reject sounds reasonable, otherwise we open up for potential data-format 
swapping attacks.

/Ludwig

-- 
Ludwig Seitz, PhD   SICS Swedish ICT AB
Ideon Science Park, Building Beta 2
Scheelevägen 17, SE-223 70 Lund
Phone +46(0)70-349 92 51

The RISE institutes SP, Swedish ICT and Innventia are merging in order 
to create a unified institute sector and become a stronger innovation 
partner for businesses and society. At the end of the year we will 
change our name to RISE. Read more at www.ri.se/en/about-rise