Subject: [Ace] draft-ietf-ace-cbor-web-token-08 - CWT CBOR Tag

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 19 Oct 2017 15:55:55 +0000

Hi all,

In Section 6 of draft-ietf-ace-cbor-web-token-08 we describe two ways to determine whether the CBOR data structure is a CWT.
I wonder whether it is better to settle on one approach only.

Do folks have practical experience with this feature?

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Jim Schaad <[email-masked]>
Date: Thu, 19 Oct 2017 09:41:17 -0700

I don't have any problems with what is here.  It boils down to 

1.	I already know that this is going to be a CWT so I save a byte.
2.	I don't know so I waste a tag byte in that case.

Most of the time it is going to be the first case, but my code is agnostic
about this and will remove the tag if it is the correct value.  In either
case it then makes sure that what follows is a map.

Jim

From: Ace [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Thursday, October 19, 2017 8:56 AM
To: [email-masked]
Subject: [Ace] draft-ietf-ace-cbor-web-token-08 - CWT CBOR Tag

Hi all, 

In Section 6 of draft-ietf-ace-cbor-web-token-08 we describe two ways to
determine whether the CBOR data structure is a CWT. 

Ciao

Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are
confidential and may also be privileged. If you are not the intended
recipient, please notify the sender immediately and do not disclose the
contents to any other person, use it for any purpose, or store or copy the
information in any medium. Thank you.

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 19 Oct 2017 19:05:03 +0200

On Oct 19, 2017, at 18:41, Jim Schaad <[email-masked]> wrote:
> 
> 	• I already know that this is going to be a CWT so I save a byte.
> 	• I don’t know so I waste a tag byte in that case.

Right.  In REST protocols, we usually have a media type, so we don’t need the CBOR Tag.
Within some other data structures, or in legacy protocols such as MQTT, we may not have that, so a tag is a good single standard way to indicate this.

(Does the latter case need to be a single byte [which is then preceded by 0xd8, by the way]?  Maybe that would not have been necessary(*), but then CWTs are going to be rather common.  
And 61 is a “=“, which is cool for our hexdump reading population :-)

Grüße, Carsten

(*) The number is already assigned, BTW.

---

From: Mike Jones <[email-masked]>
Date: Thu, 19 Oct 2017 19:28:57 +0000

I also agree that the spec already has this right.  Typically no tag will be needed because the application knows the data structure is a CWT from context.  The tag is available for any use cases where it's needed to resolve ambiguity that might otherwise be present.

				-- Mike

-----Original Message-----
From: Ace [mailto:[email-masked]] On Behalf Of Carsten Bormann
Sent: Thursday, October 19, 2017 10:05 AM
To: Jim Schaad <[email-masked]>
Cc: Hannes Tschofenig <[email-masked]>; [email-masked]
Subject: Re: [Ace] draft-ietf-ace-cbor-web-token-08 - CWT CBOR Tag

Grüße, Carsten

_______________________________________________
Ace mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ace

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 19 Oct 2017 19:30:09 +0000

For the cost  saving of one byte we are essentially introduction options here. I am wondering whether this byte is worth it.

-----Original Message-----
From: Mike Jones [mailto:[email-masked]]
Sent: 19 October 2017 21:29
To: Carsten Bormann; Jim Schaad
Cc: Hannes Tschofenig; [email-masked]
Subject: RE: [Ace] draft-ietf-ace-cbor-web-token-08 - CWT CBOR Tag

-- Mike

-----Original Message-----
From: Ace [mailto:[email-masked]] On Behalf Of Carsten Bormann
Sent: Thursday, October 19, 2017 10:05 AM
To: Jim Schaad <[email-masked]>
Cc: Hannes Tschofenig <[email-masked]>; [email-masked]
Subject: Re: [Ace] draft-ietf-ace-cbor-web-token-08 - CWT CBOR Tag

Grüße, Carsten

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 19 Oct 2017 22:32:08 +0200

> For the cost  saving of one byte we are essentially introduction options here. I am wondering whether this byte is worth it.

Two bytes.

It’s not really an option, as in every context there will be a single right way to do this.
But yes, there are naked and tagged CWTs now.

(If we only define the tagged version, very quickly there will be specs that define a “compressed CWT” that just leaves out those first two bytes…)

Grüße, Carsten

---

From: Jim Schaad <[email-masked]>
Date: Thu, 19 Oct 2017 14:14:21 -0700

The type of location where  it might show up is where one does a value that is placed in an array where it can be either an A or a B and you use the tag to distinguish between the two options.  This can be very useful in those cases.  

> From: Carsten Bormann [mailto:[email-masked]]
> Sent: Thursday, October 19, 2017 1:32 PM
> To: Hannes Tschofenig <[email-masked]>
> Cc: Mike Jones <[email-masked]>; Jim Schaad
> <[email-masked]>; [email-masked]
> > For the cost  saving of one byte we are essentially introduction options
> here. I am wondering whether this byte is worth it.
> 
> Two bytes.
> 
> (If we only define the tagged version, very quickly there will be specs that
> define a “compressed CWT” that just leaves out those first two bytes…)
> 
> Grüße, Carsten

---

From: Samuel Erdtman <[email-masked]>
Date: Fri, 20 Oct 2017 10:41:44 +0200

I think there are cases when it is use full to have the tag (maybe few) and
I think the draft is clear enough in discouraging the usage when not needed.

“Its use is optional, and is intended for use in cases in which this
information would not otherwise be known.”

To write code that supports unwrapping the tag is very easy.

Finally I personally think it is good to have the tag for completeness.

On Thu, Oct 19, 2017 at 11:14 PM, Jim Schaad <[email-masked]> wrote:

> The type of location where  it might show up is where one does a value
> that is placed in an array where it can be either an A or a B and you use
> the tag to distinguish between the two options.  This can be very useful in
> those cases.
>
>
>
> > It’s not really an option, as in every context there will be a single
> right way to
> > do this.

---

From: Jim Schaad <[email-masked]>
Date: Fri, 20 Oct 2017 13:56:06 -0700

Just to highlight this and make it concrete.

COSE did the same thing in defining optional tags that can be used.  Looking at the CWT document, the tags are being used because without the tag one cannot tell what the security operation is that is being used.  However the OAuth-Authz draft is using the COSE_Encrypt object without a tag because there are other indications (the name in the map) such that which COSE object is being used is clearly defined. 

I expect similar usages to occur with CWT in the future.

-----Original Message-----
From: Ace [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Thursday, October 19, 2017 2:14 PM
To: 'Carsten Bormann' <[email-masked]>; 'Hannes Tschofenig' <[email-masked]>
Cc: 'Mike Jones' <[email-masked]>; [email-masked]
Subject: Re: [Ace] draft-ietf-ace-cbor-web-token-08 - CWT CBOR Tag

> right way to do this.
> (If we only define the tagged version, very quickly there will be 
> specs that define a “compressed CWT” that just leaves out those first 
> two bytes…)
> 
> Grüße, Carsten