Subject: Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

From: Mike Jones <[email-masked]>
Date: Sat, 29 Dec 2012 01:11:49 +0000

I found the X.1252 definition.  It is:

6.18 claim [b-OED]: To state as being the case, without being able to give proof.

That seems both a bit vague, and actually incorrect, as the JWT may include proof of the veracity of the claim.  Please see the updated JWT draft for a hopefully more useful “Claim” definition.

                                                            Best wishes,
                                                            -- Mike

From: Mike Jones
Sent: Sunday, December 23, 2012 1:03 PM
To: Jeff Hodges; Nat Sakimura
Cc: IETF oauth WG
Subject: RE: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

What is the X.1252 definition?

-- Mike

From: Nat Sakimura
Sent: ‎December‎ ‎23‎, ‎2012 ‎10‎:‎09‎ ‎AM
To: =JeffH
CC: Mike Jones, IETF oauth WG
Subject: Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

Re definition of 'claim', as JWT is supposed to be generic, it may be
better to go with the definition of X.1252 rather than OIDC.

=nat via iPhone

Dec 24, 2012 2:42、=JeffH <[email-masked]<mailto:[email-masked]>> のメッセージ:

>
> > Thanks for the replies, Jeff.  They make sense.  Particularly, thanks for
> > the "JSON Text Object" suggestion.
>
> welcome, glad they made some sense.
>
> similarly, if one employs JSON arrays, I'd define a "JSON text array".
>
>
> > For the "claims" definition, I'm actually prone to go with definitions based
> > on those in
> > http://openid.net/specs/openid-connect-messages-1_0-13.html#terminology -
> > specifically:
> >
> > Claim
> > A piece of information about an Entity that a Claims Provider asserts about
> > that Entity.
> > Claims Provider
> > A system or service that can return Claims about an Entity.
> > End-User
> > A human user of a system or service.
> > Entity
> > Something that has a separate and distinct existence and that can be
> > identified in context. An End-User is one example of an Entity.
>
> well, it seems to me, given the manner in which the JWT spec is written, one can make the case that JWT claims in general aren't necessarily about an Entity (as the latter term is used in the context of the OpenID Connect specs), rather they're in general simply assertions about something(s). this is because all pre-defined JWT claim types are optional and all JWT semantics are left up to specs that profile (aka re-use) the JWT spec.
>
> HTH,
>
> =JeffH
>
> _______________________________________________
> OAuth mailing list
> [email-masked]<mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/oauth

---

From: David Chadwick <[email-masked]>
Date: Sat, 29 Dec 2012 09:42:12 +0000

If a claim provides proof then I would call it a credential not a claim

David

On 29/12/2012 01:11, Mike Jones wrote:
> *6.18 claim *[b-OED]: To state as being the case, without being able to
> give proof.
>
> That seems both a bit vague, and actually incorrect, as the JWT may
> include proof of the veracity of the claim.  Please see the updated JWT
> draft for a hopefully more useful “Claim” definition.
>
>                                                              Best wishes,
>
>                                                              -- Mike
>
> *From:*Mike Jones
> *Sent:* Sunday, December 23, 2012 1:03 PM
> *To:* Jeff Hodges; Nat Sakimura
> *Cc:* IETF oauth WG
> *Subject:* RE: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05
>
> *From:* Nat Sakimura
> *Sent:* ‎December‎ ‎23‎, ‎2012 ‎10‎:‎09‎ ‎AM
> *To:* =JeffH
> *CC:* Mike Jones, IETF oauth WG
> *Subject:* Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05
>
> Dec 24, 2012 2:42、=JeffH <[email-masked]
> <mailto:[email-masked]>> のメッセージ:
>
>>
>> >http://openid.net/specs/openid-connect-messages-1_0-13.html#terminology-
>> > specifically:
>> >
>> > Claim
>> well, it seems to me, given the manner in which the JWT spec is written, one can make the case that JWT claims in general aren't necessarily about an Entity (as the latter term is used in the context of the OpenID Connect specs), rather they're in general  simply assertions about something(s). this is because all pre-defined
> JWT claim types are optional and all JWT semantics are left up to specs
> that profile (aka re-use) the JWT spec.
>>
>> HTH,
>>
>> =JeffH
>>
>>[email-masked] <mailto:[email-masked]>
> [email-masked]

---

From: Anthony Nadalin <[email-masked]>
Date: Sun, 30 Dec 2012 00:28:25 +0000

By definition a claim is always in doubt thus it would not call it a credential until it is verified

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of David Chadwick
Sent: Saturday, December 29, 2012 1:42 AM
To: Mike Jones
Cc: IETF oauth WG
Subject: Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

David

On 29/12/2012 01:11, Mike Jones wrote:
> *6.18 claim *[b-OED]: To state as being the case, without being able 
> to give proof.
>
> include proof of the veracity of the claim.  Please see the updated 
> JWT draft for a hopefully more useful “Claim” definition.
>
>                                                              Best 
> wishes,
>
>                                                              -- Mike
>
> *From:*Mike Jones
>> > Thanks for the replies, Jeff.  They make sense.  Particularly, 
>> > thanks for the "JSON Text Object" suggestion.
>>
>> > For the "claims" definition, I'm actually prone to go with 
>> >definitions based  on those in
>> > A piece of information about an Entity that a Claims Provider 
>> > asserts about that Entity.
>> > Claims Provider
>> > Something that has a separate and distinct existence and that can 
>> > be identified in context. An End-User is one example of an Entity.
>>
>> well, it seems to me, given the manner in which the JWT spec is 
>> written, one can make the case that JWT claims in general aren't 
>> necessarily about an Entity (as the latter term is used in the 
>> context of the OpenID Connect specs), rather they're in general  
>> simply assertions about something(s). this is because all pre-defined
> JWT claim types are optional and all JWT semantics are left up to 
> specs that profile (aka re-use) the JWT spec.
>>
>> HTH,
>>
>> =JeffH
>>

---

From: Nat Sakimura <[email-masked]>
Date: Sun, 30 Dec 2012 13:03:45 +0900

Tony,

So do you agree with the following definition in -06? Or prefer X.1252
definition?

Claim  A piece of information asserted about a subject.  Here, Claims
      are represented name/value pairs, consisting of a Claim Name and a
      Claim Value.

Mike:

Regarding the ordering of the terms in terminology, you should either use
the dependency chain or alphabetic order. (Former is more desirable in my
point of view.) However, as it stands, it is none of those. For example,
the term "claim" appears in the definition of JWT, which is the first term
in the terminology, without having been defined. If you do not mind, I will
reorder them and send it to you.

Nat

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: Anthony Nadalin <[email-masked]>
Date: Sun, 30 Dec 2012 05:35:27 +0000

1252 s it has a section that explains the usage

A.2       Claim/assertion
The meaning of the terms claim and assertion are generally agreed to be somewhat similar but with slightly different meanings. In some cases, an assertion is considered to be a "stronger" statement than a claim. For example, the Oxford English Dictionary defines claim as:

a)          to state as being the case, without being able to give proof;

b)          a statement that something is the case,
and assertion as: a confident and forceful statement. However, in a digital context, the terms "confident" and "forceful" are not really meaningful.
In open networks, there will be a more complex and ambivalent relationship between the party making a statement (i.e., presenting identity information) and the party that relies on it. Therefore, any statement is assumed to be in doubt and, as such, is subject to verification or request for further evidence. Neither claims nor assertions can be assumed to be made with any authority whatever. It will always be up to the relying party to decide whether or not to accept the claim or assertion based on verification by the relying party (or by a verifier acting at the request of the relying party).

From: Nat Sakimura [mailto:[email-masked]]
Sent: Saturday, December 29, 2012 8:04 PM
To: Anthony Nadalin
Cc: David Chadwick; Mike Jones; IETF oauth WG
Subject: Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

Tony,

So do you agree with the following definition in -06? Or prefer X.1252 definition?

      Claim Value.

Mike:

Regarding the ordering of the terms in terminology, you should either use the dependency chain or alphabetic order. (Former is more desirable in my point of view.) However, as it stands, it is none of those. For example, the term "claim" appears in the definition of JWT, which is the first term in the terminology, without having been defined. If you do not mind, I will reorder them and send it to you.

Nat

On Sun, Dec 30, 2012 at 9:28 AM, Anthony Nadalin <[email-masked]<mailto:[email-masked]>> wrote:
By definition a claim is always in doubt thus it would not call it a credential until it is verified

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of David Chadwick
Sent: Saturday, December 29, 2012 1:42 AM
To: Mike Jones
Cc: IETF oauth WG
Subject: Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

David

On 29/12/2012 01:11, Mike Jones wrote:
> Dec 24, 2012 2:42、=JeffH <[email-masked]<mailto:[email-masked]>
> <mailto:[email-masked]<mailto:[email-masked]>>> のメッセージ:
>
>>
>>[email-masked]<mailto:[email-masked]> <mailto:[email-masked]<mailto:[email-masked]>>

---

From: Mike Jones <[email-masked]>
Date: Sun, 30 Dec 2012 07:54:10 +0000

The problem with the X.1252 definition is it unnecessarily adds the “without being able to give proof” comment.  That will distract the reader immediately.  The current “a piece of information asserted about a subject” definition is just as accurate as the X.1252 and doesn’t send readers down a mental rathole.

We can add an informative reference to X.1252 if you like, but I really think readability and simplicity are more important in this kind of a spec than reusing overly technical and off-putting ISO definitions.

About the terminology ordering, the current order is intended to be what I think you would call a reverse dependency chain – what I would call a top-down ordering.  It’s that way so that the JSON Web Token definition is first.  Then, as that definition needs other definitions, they immediately follow.  This is intended increase readability, by presenting concepts in a top-down manner.  By comparison, bottom-up ordering makes readers wade through a sea of other terms before getting to the one they really cared about.

If you want to reorder the terms to make sure they’re in the best top-down order possible, that would be useful.  (If you decide to do that, I’d also look at the terminology ordering in JWS, JWE, and JWK, as we should be as consistent as possible across the specifications.

                                                            -- Mike

Tony,

      Claim Value.

Mike:

Nat

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of David Chadwick
Sent: Saturday, December 29, 2012 1:42 AM
To: Mike Jones
Cc: IETF oauth WG
Subject: Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

David

---

From: Mike Jones <[email-masked]>
Date: Sun, 30 Dec 2012 08:07:22 +0000

I sure hope we don’t plan/need to go into that level of technical detail in the JWT spec.  It’s intended to be readable and accessible to developers – not a treatise on the meanings of words. ☺

                                                            -- Mike

From: Anthony Nadalin
Sent: Saturday, December 29, 2012 9:35 PM
To: Nat Sakimura
Cc: David Chadwick; Mike Jones; IETF oauth WG
Subject: RE: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

A.2       Claim/assertion

Tony,

      Claim Value.

Mike:

Nat

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of David Chadwick
Sent: Saturday, December 29, 2012 1:42 AM
To: Mike Jones
Cc: IETF oauth WG
Subject: Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

David

---

From: David Chadwick <[email-masked]>
Date: Sun, 30 Dec 2012 08:20:15 +0000

> By definition a claim is always in doubt thus it would not call it a credential until it is verified

No this is not correct, since you can have valid and invalid 
credentials. You present your credentials to the RP, and the RP verifies 
them based on the proof they contain.

If you present a claim without any proof then it is not a credential and 
it cannot be verified (since it contains no proof) without the RP 
obtaining some proof information from elsewhere (such as showing it to 
the issuer and asking them if it is genuine or not).

So I would say that in Oauth you can present a claim or a credential.

regards

David

---

From: Anthony Nadalin <[email-masked]>
Date: Sun, 30 Dec 2012 16:32:47 +0000

Mike, claims are in doubt thus they have to be verified thus they don’t carry the proof

From: Mike Jones
Sent: Saturday, December 29, 2012 11:54 PM
To: Nat Sakimura; Anthony Nadalin
Cc: David Chadwick; IETF oauth WG
Subject: RE: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

                                                            -- Mike

Tony,

      Claim Value.

Mike:

Nat

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of David Chadwick
Sent: Saturday, December 29, 2012 1:42 AM
To: Mike Jones
Cc: IETF oauth WG
Subject: Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

David

---

From: Anthony Nadalin <[email-masked]>
Date: Sun, 30 Dec 2012 16:35:23 +0000

Nope, disagree as a claim is always in doubt thus it has no proof, the proof comes in the verification

-----Original Message-----
From: David Chadwick [mailto:[email-masked]] 
Sent: Sunday, December 30, 2012 12:20 AM
To: Anthony Nadalin
Cc: Mike Jones; IETF oauth WG
Subject: Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

> credential until it is verified

No this is not correct, since you can have valid and invalid credentials. You present your credentials to the RP, and the RP verifies them based on the proof they contain.

If you present a claim without any proof then it is not a credential and it cannot be verified (since it contains no proof) without the RP obtaining some proof information from elsewhere (such as showing it to the issuer and asking them if it is genuine or not).

regards

David

>>>> http://openid.net/specs/openid-connect-messages-1_0-13.html#termino
>>>> l
>>>> ogy-
>>>> specifically:
>>>>
>>>> Claim

---

From: David Chadwick <[email-masked]>
Date: Mon, 31 Dec 2012 10:11:49 +0000

I think you must have misread my email, since your reply seems to agree 
with mine, that the claim is always in doubt. My comment was about a 
credential

regards

David