Subject: [Ace] Proof-of-Possession Key Semantics for CBOR Web Tokens (CWTs)

From: Mike Jones <[email-masked]>
Date: Thu, 20 Apr 2017 19:10:53 +0000

With the CBOR Web Token (CWT)<https://tools.ietf.org/html/draft-ietf-ace-cbor-web-token> specification nearing completion, which provides the CBOR equivalent of JWTs, I thought that it was also time to introduce the CBOR equivalent of RFC 7800<https://tools.ietf.org/html/rfc7800>, "Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)", so that applications using CWTs will have a standard representation for proof-of-possession keys.  I know that PoP keys are important to ACE<https://tools.ietf.org/wg/ace/> applications, for instance.  I therefore took RFC 7800 and produced the CBOR/CWT equivalent of it.

The specification is available at:

*         https://tools.ietf.org/html/draft-jones-ace-cwt-proof-of-possession-00

An HTML-formatted version is also available at:

*         http://self-issued.info/docs/draft-jones-ace-cwt-proof-of-possession-00.html

                                                                -- Mike

P.S.  This notice was also posted at http://self-issued.info/?p=1673 and as @selfissued<https://twitter.com/selfissued>.

---

From: Ludwig Seitz <[email-masked]>
Date: Fri, 21 Apr 2017 08:44:13 +0200

On 2017-04-20 21:10, Mike Jones wrote:
> With the CBOR Web Token (CWT)
> <https://tools.ietf.org/html/draft-ietf-ace-cbor-web-token>
> specification nearing completion, which provides the CBOR equivalent of
> JWTs, I thought that it was also time to introduce the CBOR equivalent
> of RFC 7800 <https://tools.ietf.org/html/rfc7800>, “Proof-of-Possession
> Key Semantics for JSON Web Tokens (JWTs)”, so that applications using
> CWTs will have a standard representation for proof-of-possession keys.
> I know that PoP keys are important to ACE
> <https://tools.ietf.org/wg/ace/> applications, for instance.  I
> therefore took RFC 7800 and produced the CBOR/CWT equivalent of it.
>

Hello Mike,

I like your idea, actually I like it so much that I already did the same 
thing in draft-ietf-ace-oauth-authz some time ago.

I have no strong opinion about separating that part out into a separate 
document, and I think our two texts look relatively similar. I do 
however have concerns if this means delaying the progress of 
draft-ietf-ace-oauth-authz by introducing a normative dependency on a 
"younger" draft.

What does the WG think?

/Ludwig

-- 
Ludwig Seitz, PhD
Security Lab, RISE SICS
Phone +46(0)70-349 92 51

---

From: Mike Jones <[email-masked]>
Date: Fri, 21 Apr 2017 16:46:10 +0000

Hi Ludwig.  Thanks for your note.

The background of me writing this draft is that I both knew of non-ACE CWT applications that need PoP keys as well as knowing that ACE needs them.  With CWT nearing completion, I wanted to make sure that we'd have the "cnf" claim ready to go both for ACE and other applications in a similar timeframe.  So I'd decided a few weeks ago to do a straight port of RFC 7800 into the CBOR/CWT world.

I'll say up front that Hannes mentioned that there was some "cnf" content in the ACE OAuth profile draft. If for no other reason than for the working group to have it as reference to compare to, I decided to proceed with the CWT version of RFC 7800, which is what I published.  I took almost all of the text straight from RFC 7800 and a few sentences in the IANA Considerations section from CWT.

Comparing the "cnf" content in https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-06 with the RFC 7800 port, I found that we independently made similar choices, which is great.  There are a few things missing in ace-oauth-authz, such as the registry language tying the claims to the equivalent JWT claims and the security considerations.  I believe those would be necessary to complete the work.  ace-oauth-authz also contains some restrictions on PoP key usage that I believe for the general "cnf" definition, we don't want to and can't make.

My sense is that we could get the straight RFC 7800 port adopted and approved as an RFC within this calendar year - likely in a similar timeframe to when CWT becomes an RFC.  I think we should make that a goal, both for ACE and for non-ACE CWT applications needing PoP.  I say that because the IESG has already approved exactly this document, modulo syntax changes from JSON to CBOR.  I think that we could adopt this, go straight to WGLC, and see it finished with or soon after CWT is.

I know that, per the minutes https://www.ietf.org/proceedings/98/minutes/minutes-98-ace-00, people didn't feel that the ace-oauth-authz was ready for WGLC.  My sense is that because it's diverged from OAuth in some important ways (which I understand the reasons for), the WGLC, IETF last call, and IESG processes to approve it will be a lot more involved than those that it would take to approve the RFC 7800 port.  I say that because we'll have to justify all the decisions in a new security protocol both to the working group and also to SECDIR, GENART, OPSDIR, the IETF reviewers, and the IESG.  From experience, I know that they're thorough. ;-)

I'll say up front, that I'd be glad to add you as a co-editor of the RFC 7800 port, Ludwig, both to acknowledge the good work you've already put in on the topic, and so you can help keep me honest in moving this forward expeditiously.  Would you be open to that possibility?

                                                       Best wishes,

                                                       -- Mike

-----Original Message-----
From: Ace [mailto:[email-masked]] On Behalf Of Ludwig Seitz
Sent: Thursday, April 20, 2017 11:44 PM
To: [email-masked]
Subject: Re: [Ace] Proof-of-Possession Key Semantics for CBOR Web Tokens (CWTs)

> specification nearing completion, which provides the CBOR equivalent

> of JWTs, I thought that it was also time to introduce the CBOR

> equivalent of RFC 7800 <https://tools.ietf.org/html/rfc7800>,

> "Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)", so

> that applications using CWTs will have a standard representation for proof-of-possession keys.

Hello Mike,

I like your idea, actually I like it so much that I already did the same thing in draft-ietf-ace-oauth-authz some time ago.

I have no strong opinion about separating that part out into a separate document, and I think our two texts look relatively similar. I do however have concerns if this means delaying the progress of draft-ietf-ace-oauth-authz by introducing a normative dependency on a "younger" draft.

What does the WG think?

/Ludwig

--

Ludwig Seitz, PhD

Security Lab, RISE SICS

Phone +46(0)70-349 92 51

_______________________________________________

Ace mailing list

[email-masked]<mailto:[email-masked]>

https://www.ietf.org/mailman/listinfo/ace

---

From: Ludwig Seitz <[email-masked]>
Date: Mon, 24 Apr 2017 08:33:07 +0200

> Hi Ludwig.  Thanks for your note.
~snip~
>
>
> I’ll say up front, that I’d be glad to add you as a co-editor of the RFC
> 7800 port, Ludwig, both to acknowledge the good work you’ve already put
> in on the topic, and so you can help keep me honest in moving this
> forward expeditiously.  Would you be open to that possibility?
>
>
>
>                                                        Best wishes,
>
>                                                        -- Mike

If the chairs agree with your assessment that this document can move 
forward fast (which I feel it could, but my experience is limited), I'm 
fine with such a solution.

How could I help progressing that document?

/Ludwig

-- 
Ludwig Seitz, PhD
Security Lab, RISE SICS
Phone +46(0)70-349 92 51