Subject: Re: [OAUTH-WG] [Ace] Call for adoption for draft-wahlstroem-ace-cbor-web-token-00

From: "Kepeng Li" <[email-masked]>
Date: Mon, 09 May 2016 20:38:11 +0800

We got several supports and no objections, so it is concluded that the draft
is adopted as an ACE WG item, with the change that we remove the "web“ from
the name.

Authors: please resubmit the current draft as
draft-ietf-ace-cbor-token-00.txt; we will start processing further changes
in the WG process.(If you already know about technical issues, please use
the WG tracker for now; editorial issues might be tracked easier on github.)

We will also add this item in our ACE charter.

Kind Regards
Kepeng (ACE co-chair)

发件人:  Li Kepeng <[email-masked]>
日期:  Thursday, 7 April, 2016 9:34 am
至:  "[email-masked]" <[email-masked]>
抄送:  Kathleen Moriarty <[email-masked]>, Hannes
Tschofenig <[email-masked]>, <[email-masked]>, <[email-masked]>,
Stephen Farrell <[email-masked]>
主题:  [Ace] Call for adoption for draft-wahlstroem-ace-cbor-web-token-00

To: ACE WG
Cc: OAuth and COSE WG

Hello all,

This note begins a Call For Adoption for
draft-wahlstroem-ace-cbor-web-token-00 [1]
to be adopted as an ACE working group item, and added in the charter.
The call ends on April 22, 2016.

Keep in mind that adoption of a document does not mean the document
as-is is ready for publication. It is merely acceptance of the
document as a starting point for what will be the final product
of the ACE working group. The working group is free to make changes to
the document according to the normal consensus process.

Please reply on this thread with expressions of support or opposition,
preferably with comments, regarding accepting this as a work item.

Note that this email was also copied to OAuth and COSE WG, in order to
get input from wider audience.

Thanks,

Kind Regards
Kepeng (ACE co-chair)

[1] https://datatracker.ietf.org/doc/draft-wahlstroem-ace-cbor-web-token/

_______________________________________________ Ace mailing list
[email-masked] https://www.ietf.org/mailman/listinfo/ace

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 09 May 2016 16:31:34 +0200

> draft-ietf-ace-cbor-token-00.txt; 

For the record, I do not think that ACE has a claim on the term "CBOR
Token".  While the term token is not used in RFC 7049, there are many
tokens that could be expressed in CBOR or be used in applying CBOR to a
problem.

ACE CBOR Token is fine, though.
(Or, better, CBOR ACE Token, CAT.)

Grüße, Carsten

---

From: Justin Richer <[email-masked]>
Date: Mon, 9 May 2016 19:49:29 -0500

We can also call it the “COSE Token”. As a chair of the COSE working group, I’m fine with that amount of co-branding.

 — Justin

> On May 9, 2016, at 9:31 AM, Carsten Bormann <[email-masked]> wrote:
> 
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose

---

From: Erik Wahlström <[email-masked]>
Date: Tue, 10 May 2016 10:43:50 +0200

Or keep the CBOR Web Token (CWT) for two major reasons:
- To show the very close relationship to JWT. It relies heavily on JWT and
it's iana registry. It is essentially a JWT but in CBOR/COSE instead of
JSON/JOSE.
- I would not say that JWT is the only format that works for the web, and
it's even used in other, non-traditional, web protocols. That means I don't
have a problem with the W in CWT at all. Why would JSON be the only web
protocol?

Then we also have one smaller (a lot smaller) reason, it's the fact that it
can be called "cot" just like JWT is called a "jot" and I figured that our
"cozy chairs" would very much like that fact because then it's essentially
a "cozy cot" :)

/ Erik

On Tue, May 10, 2016 at 2:49 AM, Justin Richer <[email-masked]> wrote:

> We can also call it the “COSE Token”. As a chair of the COSE working
> group, I’m fine with that amount of co-branding.
>
>  — Justin
>
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace
>

---

From: Mike Jones <[email-masked]>
Date: Tue, 10 May 2016 08:50:38 +0000

I also feel strongly that the name should remain CBOR Web Token.  CWT is a beneficiary of the intellectual and deployment heritage from the Simple Web Token (SWT) and JSON Web Token (JWT).  CWT is intentionally parallel to JWT.  The name should stay parallel as well.

The “Web” part of the “CBOR Web Token” name can be taken as a reference to the Web of Things (see https://en.wikipedia.org/wiki/Web_of_Things).  As Erik correctly points out JSON is not the only data representation that makes things in the Web and the Web of Things.

                                                          -- Mike

From: Ace [mailto:[email-masked]] On Behalf Of Erik Wahlström
Sent: Tuesday, May 10, 2016 1:44 AM
To: Justin Richer <[email-masked]>
Cc: Kathleen Moriarty <[email-masked]>; Kepeng Li <[email-masked]>; [email-masked]; Carsten Bormann <[email-masked]>; Hannes Tschofenig <[email-masked]>; <[email-masked]> <[email-masked]>; cose <[email-masked]>
Subject: Re: [Ace] [COSE] Call for adoption for draft-wahlstroem-ace-cbor-web-token-00

Or keep the CBOR Web Token (CWT) for two major reasons:
- To show the very close relationship to JWT. It relies heavily on JWT and it's iana registry. It is essentially a JWT but in CBOR/COSE instead of JSON/JOSE.
- I would not say that JWT is the only format that works for the web, and it's even used in other, non-traditional, web protocols. That means I don't have a problem with the W in CWT at all. Why would JSON be the only web protocol?

Then we also have one smaller (a lot smaller) reason, it's the fact that it can be called "cot" just like JWT is called a "jot" and I figured that our "cozy chairs" would very much like that fact because then it's essentially a "cozy cot" :)

/ Erik

On Tue, May 10, 2016 at 2:49 AM, Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:
We can also call it the “COSE Token”. As a chair of the COSE working group, I’m fine with that amount of co-branding.

 — Justin

> On May 9, 2016, at 9:31 AM, Carsten Bormann <[email-masked]<mailto:[email-masked]>> wrote:
>
> [email-masked]<mailto:[email-masked]>

_______________________________________________
Ace mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ace

---

From: Justin Richer <[email-masked]>
Date: Tue, 10 May 2016 07:57:27 -0500

You’re missing my original complaint: Until this token can be directly encoded into web technologies, like HTTP headers and HTML pages, then it has no business being called a “Web” anything. As it is, it’s a binary encoding that would need an additional wrapper, like base64url perhaps, to be placed into web spaces. It can be used in CoAP and native CBOR structures as-is, which is what it’s designed to do. 

The “web” part of JWT is very important. A JWT can be used, as-is, in any part of an HTTP message: headers, query, form, etc. It can also be encoded as a string in other data structures in just about any language without any additional transformation, including HTML, XML, and JSON. This makes the JWT very “webby”, and this is a feature set that this new token doesn’t share. Ergo, it has no business being called a “web” token regardless of its heritage. 

Both CBOR Token and COSE Token are fine with me. 

 — Justin

> On May 10, 2016, at 3:50 AM, Mike Jones <[email-masked]> wrote:
> 
> The “Web” part of the “CBOR Web Token” name can be taken as a reference to the Web of Things (see https://en.wikipedia.org/wiki/Web_of_Things <https://en.wikipedia.org/wiki/Web_of_Things>).  As Erik correctly points out JSON is not the only data representation that makes things in the Web and the Web of Things.
>  
>                                                           -- Mike
>   <>
> On Tue, May 10, 2016 at 2:49 AM, Justin Richer <[email-masked] <mailto:[email-masked]>> wrote:
> > On May 9, 2016, at 9:31 AM, Carsten Bormann <[email-masked] <mailto:[email-masked]>> wrote:
> >
> > [email-masked] <mailto:[email-masked]>
> > https://www.ietf.org/mailman/listinfo/cose <https://www.ietf.org/mailman/listinfo/cose>
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/ace <https://www.ietf.org/mailman/listinfo/ace>

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Tue, 10 May 2016 08:14:22 -0700

I don't have this issue. I see your point, but I think the constrained branding makes it clear. 

IOW. When the specs say "constrained web" the use means to me that the tokens for the constrained set of binary protocols which all tend to be in parallel architecture with web apis anyway.  

Phil

> On May 10, 2016, at 05:57, Justin Richer <[email-masked]> wrote:
>

---

From: Justin Richer <[email-masked]>
Date: Tue, 10 May 2016 15:36:57 -0500

Then how about the ACE Constrained Token (ACT)?

 — Justin

> On May 10, 2016, at 10:14 AM, Phil Hunt (IDM) <[email-masked]> wrote:
> 
> On May 10, 2016, at 05:57, Justin Richer <[email-masked] <mailto:[email-masked]>> wrote:
> 
>>> On May 10, 2016, at 3:50 AM, Mike Jones <[email-masked] <mailto:[email-masked]>> wrote:
>>> 
>>> From: Ace [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Erik Wahlström
>>> To: Justin Richer <[email-masked] <mailto:[email-masked]>>
>>> Cc: Kathleen Moriarty <[email-masked] <mailto:[email-masked]>>; Kepeng Li <[email-masked] <mailto:[email-masked]>>; [email-masked] <mailto:[email-masked]>; Carsten Bormann <[email-masked] <mailto:[email-masked]>>; Hannes Tschofenig <[email-masked] <mailto:[email-masked]>>; <[email-masked] <mailto:[email-masked]>> <[email-masked] <mailto:[email-masked]>>; cose <[email-masked] <mailto:[email-masked]>>

---

From: Erik Wahlström <[email-masked]>
Date: Wed, 11 May 2016 13:42:17 +0200

That's a very value scenario actually. Even so that it should actually be
handled in the draft.
Scenario: In the continuum of large and small devices an unconstrained
client and AS goes through the hoops of issuing a token using standard
(HTTP/JSON). The Resource Server however is constrained and would very much
like a CWT when it communicates with the Client. That means that in the AS
to Client response from the token endpoint the binary token should actually
be wrapped by base64url.
I can definitely see that being added to the draft.
/ Erik

On Tue, May 10, 2016 at 2:57 PM, Justin Richer <[email-masked]> wrote:

> You’re missing my original complaint: Until this token can be directly
> encoded into web technologies, like HTTP headers and HTML pages, then it
> has no business being called a “Web” anything. As it is, it’s a binary
> encoding that would need an additional wrapper, like base64url perhaps, to
> be placed into web spaces. It can be used in CoAP and native CBOR
> structures as-is, which is what it’s designed to do.
>
> The “web” part of JWT is very important. A JWT can be used, as-is, in any
> part of an HTTP message: headers, query, form, etc. It can also be encoded
> as a string in other data structures in just about any language without any
> additional transformation, including HTML, XML, and JSON. This makes the
> JWT very “webby”, and this is a feature set that this new token doesn’t
> share. Ergo, it has no business being called a “web” token regardless of
> its heritage.
>
> I also feel strongly that the name should remain CBOR Web Token.  CWT is a
> beneficiary of the intellectual and deployment heritage from the Simple Web
> Token (SWT) and JSON Web Token (JWT).  CWT is intentionally parallel to
> JWT.  The name should stay parallel as well.
>
> The “Web” part of the “CBOR Web Token” name can be taken as a reference to
> the Web of Things (see https://en.wikipedia.org/wiki/Web_of_Things).  As
> Erik correctly points out JSON is not the only data representation that
> makes things in the Web and the Web of Things.
>
>                                                           -- Mike
>
> *From:* Ace [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Erik Wahlström
> *Sent:* Tuesday, May 10, 2016 1:44 AM
> *To:* Justin Richer <[email-masked]>
> *Cc:* Kathleen Moriarty <[email-masked]>; Kepeng Li <
> [email-masked]>; [email-masked]; Carsten Bormann <[email-masked]>;
> Hannes Tschofenig <[email-masked]>; <[email-masked]> <
> [email-masked]>; cose <[email-masked]>
> *Subject:* Re: [Ace] [COSE] Call for adoption for
> draft-wahlstroem-ace-cbor-web-token-00
>
> Then we also have one smaller (a lot smaller) reason, it's the fact that
> it can be called "cot" just like JWT is called a "jot" and I figured that
> our "cozy chairs" would very much like that fact because then it's
> essentially a "cozy cot" :)
>
> / Erik
>
>