Subject: [Ace] CWT and PoP Tokens

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 21 Apr 2017 09:56:57 +0200

Hi all,

with the CWT in WGLC (see
https://www.ietf.org/mail-archive/web/ace/current/msg02190.html) a
question arises about the desired content of the spec.

In ACE we have been focused on the use of use of proof-of-possession
tokens. Currently, the worksplit between the the CWT and the ACE
framework spec is as follows:

 * the CWT spec maps some of the JWT claims to CBOR but does not contain
anything regarding PoP tokens.
 * the ACE framework provides the PoP-related components (see
https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-06#section-5.5.4.5).

Now, the question to the group is whether they are happy with this
split. Another option would be to include the cnf claims needed for the
PoP token functionality already in the CWT spec.

Thoughts?

Ciao
Hannes

---

From: Carsten Bormann <[email-masked]>
Date: Fri, 21 Apr 2017 10:33:14 +0200

> PoP token functionality already in the CWT spec.

Probably, the “cnf” claims attain their actual meaning through the framework.
It will be hard to do a framework-independent definition of those in the CWT spec.
So I am very happy with that split.

Grüße, Carsten

---

From: Mike Jones <[email-masked]>
Date: Fri, 21 Apr 2017 16:53:04 +0000

See the reply that I just sent to Ludwig.  I believe that we could get a straight RFC 7800 (“cnf” claim) port done as an RFC at the same time or soon after CWT becomes an RFC.  ACE needs PoP keys and other applications do too, and we should try to provide them expeditiously.  I invited Ludwig to be a co-editor on the straight port with me to help make sure we move it forward promptly.

draft-ietf-ace-oauth-authz could then profile the RFC 7800 port by saying how it uses the general confirmation syntax (this profiling text already exists).

Would that work for people?

                                                       Best wishes,

                                                       -- Mike

-----Original Message-----
From: Ace [mailto:[email-masked]] On Behalf Of Carsten Bormann
Sent: Friday, April 21, 2017 1:33 AM
To: Hannes Tschofenig <[email-masked]>
Cc: [email-masked]
Subject: Re: [Ace] CWT and PoP Tokens

On Apr 21, 2017, at 09:56, Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:

> * the CWT spec maps some of the JWT claims to CBOR but does not

> contain anything regarding PoP tokens.

> split. Another option would be to include the cnf claims needed for

> the PoP token functionality already in the CWT spec.

Grüße, Carsten