Comments (7)
Added 'wontfix' label for now, but please take this to the WG to ensure consensus before making this a MUST requirement.
from eat.
When using the FIDO model for Relying Party (as an example), the verifier is within the boundary of the RP and can process top-level claims, yet may still be relayed as is within the RP context. It is up to the implementation, as FIDO certification programs place no such requirement on existing attestation formats. However, making this a "MUST NOT" requirement (at least without considerably more explanation than what has been proposed in this issue) may mislead developers in the FIDO context - if the claim is passed as is within the RP security boundary from an integrated verifier then it does not appear to have any drawback. Since EAT is meant to target different standards and associated ecosystems (e.g. FIDO, GlobalPlatform, etc.), the SHOULD requirement appears to be sufficient.
from eat.
Thanks for articulating the FIDO use case.
What about:
MUST NOT unless:
* [FIDO-like situations]
* [evidence claims are segregated and therefore cannot clash with AR claims]
* [AR is not in EAT format and therefore there is no clash risk]
What is missing is a rationale for allowing exceptions, which should be present (or self-evident) when a SHOULD is used.
from eat.
Four ways forward have been discussed:
- Change SHOULD NOT to MUST NOT
- Augment SHOULD NOT to require a profile to describe why SHOULD NOT is ignored
- No change
- Remove 2119 language from 4.3
from eat.
Four ways forward have been discussed:
- Augment SHOULD NOT to require a profile to describe why SHOULD NOT is ignored
☝️
from eat.
I've proposed removing the sentence entirely and relying on 1.3.1 in #360. Read the PR for more justification.
from eat.
Fixed with #360
from eat.
Related Issues (20)
- can SUEID and UEID be identical? HOT 3
- please get Google Android team review of Location Claim HOT 3
- measurement results claim --- seems too general purpose to be useful HOT 2
- what is purpose of tolerating jti/cti claims HOT 6
- how to find/label Endorsement and Verification Keys HOT 5
- IANA considerations, expert review guidance needs clarity HOT 3
- some advice on freshness would be good HOT 8
- Should spoofed or corrupted location be addressed in the specification? HOT 3
- readers must be familiar with CDDL and CBOR diagnostic format
- add ref to EAT media types
- What are "attestations" HOT 5
- inconsistency in `iat` definition HOT 10
- IANA Considerations HOT 3
- The value of eat_nonce used in the examples HOT 7
- Security AD Review: clarify sec cons discussion on nonces HOT 1
- Security AD review: address SBOM comments HOT 2
- Security AD review: clarify intuse claim HOT 1
- How far to go with manifest and measurement sub types HOT 1
- use rfc2648 for profile identification HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from eat.