Hi Chris and COSE WG, Please find my review comments on draft-lemmons-cose-composite-claims-03: "Composite Token Claims" <https://www.ietf.org/archive/id/draft-lemmons-cose-composite-claims-03.html#name-and-and-claim> below. Overall I think the draft looks fine, but I myself have no particular use case for it at the moment.
Section 3.1.2. nor (Nor) Claim: 'If any claim set in a "nor" claim is acceptable, the claim set containing the "nor" claim is also unacceptable.' It seems to me like this would read better as '[...] the claim set containing the "nor" claim is also unacceptable' (without the "also"). Section 3.1.3. and (And) Claim: 'If any claim set in an "and" claim is not acceptable, the claim set containing the "and" claim is also unacceptable.' This too might read better as 'If any claim set in an "and" claim is unacceptable, [...]' 'The "and" claim is often unnecessary' Perhaps include an example of the "and" claim being useful even though it's often unnecessary? There is one example in the next section, but it rather undercuts itself by admitting that "and" is not actually necessary for the "aud" criterion. References: [RFC9711] should be normative? (Since this document extends $$Claims-Set-Claims defined by it) Cheers, Emil Lundberg Staff Engineer | Yubico <http://www.yubico.com/>
_______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
