transmute-industries / draft-ietf-spice-charter

0 stars 9 forks source link

Allowing or disallowing duplication of some claim names ? #9

Closed Denisthemalice closed 9 months ago

Denisthemalice commented 1 year ago

It should be noted that RFC 8392 (CWT) is rather different from RFC 7519 (JWT).

RFC 8392 (CWT) states:

The set of claims that a CWT must contain to be considered valid is context dependent and is outside the scope of this specification.

None of the claims defined below are intended to be mandatory to use or implement.
Rather, they provide a starting point for a set of useful, interoperable claims.
Applications using CWTs should define which specific claims they use and when they are required or optional.

RFC 7519 (JWT) states:

The Claim Names within a JWT Claims Set MUST be unique;

Such requirement does not exist in RFC 8392 (CWT).

When using selective disclosure, there are good reasons to allow duplication of some claim names, e.g. to handle claim names such as "nationality", "age_Over" or "age_Under".

hannestschofenig commented 1 year ago

Note that the meaning of claim name uniqueness refers to the fact that the "index" into the IANA registry at https://www.iana.org/assignments/jwt/jwt.xhtml is via the claim name. If there are two claims that have the same name then it would be difficult to find out which semantic was meant.

Your examples, "age_Over" and "age_Under" are different claim names. Hence, there is no problem.

Denisthemalice commented 1 year ago

If selective disclosure is being used, a digital credential might contain, for example, four claims
"age_Over"= "13" ,"age_Over"= "15", "age_Under"= "25" and "age_Under"= "30". Depending upon the request from a Verifier, one or two of these attributes would be disclosed. For such attributes names, duplication should be allowed.

However, RFC 7519 (JWT) states:

The Claim Names within a JWT Claims Set MUST be unique;

If JSON is being used (without using JWT), then this becomes possible.