CWT CBOR Tag

[paulbastian]

From the mailing list:

Dear Authors,

https://datatracker.ietf.org/doc/draft-ietf-oauth-status-list/13/ clause 5.2 gives requirements and an example of a Status List Token in CWT format.

The non-normative example from clause 5.2 clearly uses a tagged structure.

When checking RFC8392 clause 7.1 step 6:

“ 6. If needed by the application, prepend the COSE object with the

   appropriate COSE CBOR tag to indicate the type of the COSE

   object.  If needed by the application, prepend the COSE object

   with the CWT CBOR tag to indicate that the COSE object is a CWT.

”

Tagging is optional, could you please indicate in the normative part of clause 5.2 whether tagging is required, and if so which tag to use?

[paulbastian]

We are likely talking about the Tag(18), which stems from RFC9052:

The structure can be encoded as either tagged or untagged depending on the context it will be used in. A tagged COSE_Sign1 structure is identified by the CBOR tag 18.

So if we don't make any further statements, implementations should support both the tag being present and not

[tplooker]

We could follow the precedent of ISO 18013-5 which is to only support the untagged variant to reduce options?

[paulbastian]

I like this, either option improves interop

[tplooker]

Actually given the examples are tagged, implementations to date are likely to have based around this so perhaps this is the better default to settle on.