auth: CAT4MOQ update to draft-01

[michalhosna]

AFAIK, we are currently supporting draft-00 which is incompatible with draft-01 at least at bin-match.

The c4m doesn't seem to have version indications anywhere currently, so we cannot support both at once.

[michalhosna]

cc @wilaw Is there a way to support multiple version of c4m?

It seems to me there's no good way to support both, given that there was change of semantics but not change of wire-encoding.

But I may be missing something?

[wilaw]

CTA-5007-B defines a dedicated catv claim ("Common Access Token Version") for communicating the version.

• Claim key 310, type unsigned integer, and it's a MUST-required claim in the base claim set.
• Currently the only defined value is 1 — the claim exists "to allow future specifications to extend or modify [the token] and maintain backward compatibility."
• If a token omits catv entirely, recipients assume it's version 1.
• A recipient MUST reject any token carrying an unsupported version number.
• It can only appear in a base claim

So CAT4MOQ could modify this version to indicate intermediate draft version of C4M

Alternatively we can implement a version key in the MOQT claim itself.

moqt-value = { ? 0 => moqt-version, 1 => moqt-scopes }
moqt-version = int
moqt-scopes = [ + moqt-scope ]

Recipients that don't see key 0 assume version 1, and you can mandate rejection of unrecognized version numbers, exactly like the base token's catv rule. The cost is that moqt-value's root type changes from array to map, which is a breaking change for anyone who's already implemented against the array form.

Or we could keep the root type as an array and put the version as the leading positional element

moqt-value = [ moqt-version, + moqt-scope ]
moqt-version = int

This is also a breaking change for existing parsers.

As a third option, we can consider relying on application data to communicate the C4M version (by adding a version prefix or suffix to the token name for example), as there are unlikely to be many substantive changes going forward (unlike MOQT which changes every two months).

@alficles for comment and opinion

[michalhosna]

Thanks @wilaw,

I think this discussion should go to https://github.com/moq-wg/CAT-4-MOQT.

I was just checking that I am not misreading the spec.
For moqx is probably fine to switch to draft-01, or does somebody need support for -00?

[wilaw]

Agree. I duplicated at moq-wg/CAT-4-MOQT#43 for broader exposure.

[afrind]

Newer is better. Let's move to -01.