search

ucan-wg / spec

User Controlled Authorization Network (UCAN) Specification
https://ucan.xyz
Other
190 stars 18 forks source link

Support for CWT #30

Open pdxjohnny opened 2 years ago

pdxjohnny commented 2 years ago

It would be great if ucan could support CWT as well as JWT for embedded us cases.

This would also pave the way for interoperatbility with attesttation frameworks such as DICE

References:

expede commented 2 years ago

Hey @pdxjohnny; thanks for the idea! There's some related discussion here: https://github.com/ucan-wg/spec/discussions/18

expede commented 2 years ago

The TL;DR on current thinking (and we can be convinced otherwise!) is that this spec is the one for interoperability between systems. If we introduce many other encodings, then we either run into token incompatibilities, or larger implementations that support multiple codecs. If folks want to adapt the spec to an internal use case that uses a different encoding, that's a great idea and we're happy to help, but that we can't expect it to interop with other systems and so shouldn't be in the spec directly.

THAT SAID, please do comment in that discussion, and especially with any concrete tradeoffs that you'd like to solve for 😄

pdxjohnny commented 2 years ago

Thanks @expede! Just commented: https://github.com/ucan-wg/spec/discussions/18#discussioncomment-2283702

Also, credit where credit is due, this idea came from @nedmsmith :)

expede commented 2 years ago

Awesome; thanks both of you! Also, always super interested to hear about new use cases. If not something that can be public in text, I'm always happy to hop on a call sometime 😃

expede commented 1 year ago

Hey @pdxjohnny 👋 In principle, if you're willing to deterministically encode the CWT, then you should be able to use the canonicalization spec and/or ucan-ipld to convert to/from CWT.

Does that meet your CWT needs?