Seems like you'd want UCCS or UJCS EARs -- lots of B2B over TLS for attestation results I'd expect.

As written, there's no option for this because CWT/JWT is a requirement.

(As per Ned Smith's message of November 8, 2022)

I've mentioned this in email; thought it should be here for the record

EAT defines a socket where new token formats plug-in. This draft should provide the CDDL to hook UCCS into the socket.

Additionally, if UJCS is supported here, a type string for the JSON token selector needs to be defined.

Appendix A uses .feature for the JC<> generic. That is defined in RFC 9165, not RFC 8610 so a reference to it is needed.

UCCS-message = UCCS-tagged-message / UCCS-untagged-message

UCCS-tagged-message = #6.601(cwt-claims-set)

UCCS-untagged-message = cwt-claims-set

Then where is cwt-claims-set defined? Seems like it would be OK to define it in the UCCS draft. Right now I define eat-claims-set in EAT and that includes some of the CWT claims. However, I'm OK for all that to move to UCCS. EAT needs a normative reference to UCCS anyway and it would be better to avoid a circular reference between EAT and UCCS.

ietf-rats-wg/eat#130

Lest we forget: https://mailarchive.ietf.org/arch/msg/rats/sxmbwzg5nfyP8m7epGVk8dTUI7M/

Note: although this was a review for birkholz-02, I don't think the points raised have been addressed in birkholz-03 (which I guess it's equivalent to rats-00).

I've mentioned this in email; thought it should be here for the record

Like COSE, EAT and most CDDL message/token definitions, there should be a definition for tagged-uccs and untagged-uccs.

I've mentioned this in email; thought it should be here also for the record

This is a request to add support for UJCS (unsigned JSON tokens).

If UJCS support is not added, then the JSON definitions should either be removed or their presence explained in prose.

JWT has this null cipher construct for unsigned JSON claims-sets. It seems wasteful and ill conceived to me especially in light of UCCS.

EAT is successfully defining claims in both JSON and CBOR.

Why not make UCCS in to a CDDL definition of the basic claims in CWT and JWT and define simpler way to do unsigned claims in JSON format? You already have all the security considerations.