Subject: [Ace] CWT - Audience

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 31 Oct 2017 09:27:29 +0000

Hi all,

in https://datatracker.ietf.org/doc/rfc7519/?include_text=1 (section 4.1.3), "aud" is defined for JWT as being an array of case-sensitive strings, or a single string.

In https://datatracker.ietf.org/doc/draft-ietf-ace-cbor-web-token/?include_text=1 (section 3.1.3), "aud" is defined for CWT as being like in JWT, but "the value is of type StringOrURI".

I was wondering how we arrived at this point where the CWT and the JWT differ in this regard.

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Samuel Erdtman <[email-masked]>
Date: Tue, 31 Oct 2017 10:42:20 +0100

My guess is that this is an early mistake that has not been noticed, it has
been like this from the first draft.

I think the correct thing would be to change it so that CWT reflects JWT.

//Samuel

On Tue, Oct 31, 2017 at 10:27 AM, Hannes Tschofenig <
[email-masked]> wrote:

> Hi all,
>
>
>
> in https://datatracker.ietf.org/doc/rfc7519/?include_text=1 (section
> 4.1.3), “aud” is defined for JWT as being an array of case-sensitive
> strings, or a single string.
>
>
>
> In https://datatracker.ietf.org/doc/draft-ietf-ace-cbor-web-
> token/?include_text=1 (section 3.1.3), “aud” is defined for CWT as being
> like in JWT, but “the value is of type StringOrURI”.
>
>
>
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
>
> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace
>
>

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 31 Oct 2017 11:55:33 +0100

On Oct 31, 2017, at 10:42, Samuel Erdtman <[email-masked]> wrote:
> 
> My guess is that this is an early mistake that has not been noticed, it has been like this from the first draft.

I sure noticed the difference, but thought that this was an intended simplification: simply not allowing audiences with multiple strings.

> I think the correct thing would be to change it so that CWT reflects JWT.

So we get a choice between a text string and an array of text strings.

Grüße, Carsten

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 31 Oct 2017 09:23:38 -0400

> I sure noticed the difference, but thought that this was an intended simplification: simply not allowing audiences with multiple strings.

I believe it was an intentional change, but am sure Jim and others can clarify.

Best,
Kathleen

-- 

Best regards,
Kathleen

---

From: Jim Schaad <[email-masked]>
Date: Tue, 31 Oct 2017 07:32:45 -0700

This was done because, in CBOR, there is a way to distinguish between a string and a URL.  This is lacking in JSON.  I believe that the ability to not have to determine this heuristically is a good thing.

Jim

From: Ace [mailto:[email-masked]] On Behalf Of Samuel Erdtman
Sent: Tuesday, October 31, 2017 2:42 AM
To: Hannes Tschofenig <[email-masked]>
Cc: [email-masked]
Subject: Re: [Ace] CWT - Audience

//Samuel

On Tue, Oct 31, 2017 at 10:27 AM, Hannes Tschofenig <[email-masked] <mailto:[email-masked]> > wrote:

Hi all, 

in https://datatracker.ietf.org/doc/rfc7519/?include_text=1 (section 4.1.3), “aud” is defined for JWT as being an array of case-sensitive strings, or a single string.

In https://datatracker.ietf.org/doc/draft-ietf-ace-cbor-web-token/?include_text=1 (section 3.1.3), “aud” is defined for CWT as being like in JWT, but “the value is of type StringOrURI”. 

Ciao

Hannes

_______________________________________________
Ace mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/ace

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 31 Oct 2017 15:50:16 +0000

> I believe it was an intentional change, but am sure Jim and others can clarify.

The downside of that change is the following:
 * Misalignment with the JWT, and
 * If you want to use the CWT token with multiple audiences then you have to request&create a new token for each audience.

Ciao
Hannes

---

From: Mike Jones <[email-masked]>
Date: Tue, 31 Oct 2017 17:28:16 +0000

Not having support for multiple audiences is semantically a non-starter.  There are some differences in CWT from JWT that are intentional (such as binary key IDs) to better align CWT with COSE, but this particular divergence is unacceptable.

My conclusion is that I will need read CWT line-by-line before Singapore and compile a list of such problems that have somehow made it into the spec.  I was (apparently naively) assuming it was aligned, but apparently that's not the case.

Thanks for catching this, Hannes!

				-- Mike

-----Original Message-----
From: Ace [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Tuesday, October 31, 2017 8:50 AM
To: Kathleen Moriarty <[email-masked]>; Carsten Bormann <[email-masked]>
Cc: Samuel Erdtman <[email-masked]>; [email-masked]
Subject: Re: [Ace] CWT - Audience

Ciao
Hannes