<div dir="auto">I would like to make my position very clear. Credentials in the normal course of business are never released from the user's wallet. They are not under user control after release.<br><br><div data-smartmail="gmail_signature">thx ..Tom (mobile)</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Apr 19, 2021, 5:25 PM Mike Jones via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="m_5090686948502687522WordSection1">
<p class="MsoNormal">Spec Call Notes 19-Apr-21<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Mike Jones<u></u><u></u></p>
<p class="MsoNormal">Tom Jones<u></u><u></u></p>
<p class="MsoNormal">Nat Sakimura<u></u><u></u></p>
<p class="MsoNormal">Vittorio Bertocci<u></u><u></u></p>
<p class="MsoNormal">Dmitri Zagidulin<u></u><u></u></p>
<p class="MsoNormal">Kristina Yasuda<u></u><u></u></p>
<p class="MsoNormal">Tim Cappalli<u></u><u></u></p>
<p class="MsoNormal">Adam Lemmon<u></u><u></u></p>
<p class="MsoNormal">Edmund Jay<u></u><u></u></p>
<p class="MsoNormal">John Bradley<u></u><u></u></p>
<p class="MsoNormal">Tobias Looker<u></u><u></u></p>
<p class="MsoNormal">Tony Nadalin<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Internet Identity Workshop (IIW)<u></u><u></u></p>
<p class="MsoNormal"> IIW is the next three days. Here's some possible sessions to look for...<u></u><u></u></p>
<p class="MsoNormal"> Introduction to OpenID Connect - Mike Jones, Session 1<u></u><u></u></p>
<p class="MsoNormal"> Options for including W3C VC objects in OpenID Connect flows (Kristina)<u></u><u></u></p>
<p class="MsoNormal"> SIOP Use Cases - Kristina<u></u><u></u></p>
<p class="MsoNormal"> Credential Provider draft - Tobias and Adam<u></u><u></u></p>
<p class="MsoNormal"> SIOP Chooser - Jeremy and DW and Tom<u></u><u></u></p>
<p class="MsoNormal"> Using BB+ with JOSE and JWTs - Jeremy and DW<u></u><u></u></p>
<p class="MsoNormal"> Claims Aggregation draft - Nat and Edmund<u></u><u></u></p>
<p class="MsoNormal"> Logout Options in the face of Browser Changes - John suggested asking DW to do it<u></u><u></u></p>
<p class="MsoNormal"> Tim asked whether to also talk about what users understand about Web logout<u></u><u></u></p>
<p class="MsoNormal"> Authentic Data Economy series - David Huseby and Mike Lodder<u></u><u></u></p>
<p class="MsoNormal"> <a href="https://dwhuseby.medium.com/dont-use-dids-58759823378c" target="_blank" rel="noreferrer">
https://dwhuseby.medium.com/dont-use-dids-58759823378c</a><u></u><u></u></p>
<p class="MsoNormal"> <a href="https://github.com/TrustFrame/authentic-data-specifications" target="_blank" rel="noreferrer">
https://github.com/TrustFrame/authentic-data-specifications</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Mobile Driver's License<u></u><u></u></p>
<p class="MsoNormal"> mDL is ISO/IEC 18013-5 in SC17 WG10<u></u><u></u></p>
<p class="MsoNormal"> Tom told us about a request for comments by DHS on Mobile Driver's Licenses<u></u><u></u></p>
<p class="MsoNormal"> <a href="https://www.govinfo.gov/content/pkg/FR-2021-04-19/pdf/2021-07957.pdf" target="_blank" rel="noreferrer">
https://www.govinfo.gov/content/pkg/FR-2021-04-19/pdf/2021-07957.pdf</a><u></u><u></u></p>
<p class="MsoNormal"> [Docket No. DHS–2020–0028]<u></u><u></u></p>
<p class="MsoNormal"> Minimum Standards for Driver’s Licenses and Identification Cards Acceptable by Federal Agencies for Official Purposes; Mobile Driver’s Licenses<u></u><u></u></p>
<p class="MsoNormal"> Kristina said that the ISO specs don't use VCs or DIDs<u></u><u></u></p>
<p class="MsoNormal"> John talked about needing not only standards, but also regulations and issuers to get a working ecosystem<u></u><u></u></p>
<p class="MsoNormal"> Tony reported that Nat is working on a liaison agreement between SC17 WG4 and WG10 and the OpenID Foundation<u></u><u></u></p>
<p class="MsoNormal"> Nat said that this would be a Category 3 liaison<u></u><u></u></p>
<p class="MsoNormal"> Tony suggested that we comment supporting use of the SIOP protocol for Mobile Driver's Licenses<u></u><u></u></p>
<p class="MsoNormal"> Tobias asked if there is an issuance protocol<u></u><u></u></p>
<p class="MsoNormal"> Tony said that there is a protocol for retrieval but not issuance<u></u><u></u></p>
<p class="MsoNormal"> Tony suggested that he and Kristina take ownership of drafting a response to DHS<u></u><u></u></p>
<p class="MsoNormal"> Tom said that Kantara will be drafting a response mostly about privacy<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Modified SIOP Special Call Schedule<u></u><u></u></p>
<p class="MsoNormal"> We will be alternating Pacific-friendly and Europe-friendly calls every two weeks<u></u><u></u></p>
<p class="MsoNormal"> The next Europe-Friendly call will be Tuesday, April 27 at 7am Pacific Time<u></u><u></u></p>
<p class="MsoNormal"> The next Pacific-Friendly call will be Tuesday, May 11th at 3pm Pacific Time<u></u><u></u></p>
<p class="MsoNormal"> Kristina will work with Mike Leszcz on updating the Foundation calendar<u></u><u></u></p>
<p class="MsoNormal"> We'll reconfirm the preferred call schedule during the next special call<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Claims Aggregation Draft<u></u><u></u></p>
<p class="MsoNormal"> Nat asked Tobias and Adam about their progress on the Claims Aggregation Draft<u></u><u></u></p>
<p class="MsoNormal"> Tobias reported that they're working on addressing issues on their Credential Provider draft<u></u><u></u></p>
<p class="MsoNormal"> Tobias said that they've defined a new endpoint for indirect presentation of end-user claims<u></u><u></u></p>
<p class="MsoNormal"> It can use different claims formats, including VCs, MDL, JWTs<u></u><u></u></p>
<p class="MsoNormal"> Tobias reported that Mike suggested using access tokens with single audiences<u></u><u></u></p>
<p class="MsoNormal"> He said that both Edmund's draft and theirs use new endpoints<u></u><u></u></p>
<p class="MsoNormal"> Edmund said that the UserInfo Endpoint doesn't support request parameters to request subsets of claims<u></u><u></u></p>
<p class="MsoNormal"> Nat told Tom that we're talking about claims issuance and aggregation - not claims presentation<u></u><u></u></p>
<p class="MsoNormal"> Mike asserted that Edmund's and Nat's draft is an interface between the OP and Claims Providers<u></u><u></u></p>
<p class="MsoNormal"> He asked whether the Credential Provider draft describes a different kind of interface<u></u><u></u></p>
<p class="MsoNormal"> Tobias said that the intent of the two is similar<u></u><u></u></p>
<p class="MsoNormal"> Tobias said that their credential notion is suitable for indirect presentation<u></u><u></u></p>
<p class="MsoNormal"> There was a digression about the confusion caused by having multiple meanings for the work "credential"<u></u><u></u></p>
<p class="MsoNormal"> To many, credentials are things like passwords, OTPs, biometrics, etc.<u></u><u></u></p>
<p class="MsoNormal"> To others, they're things like medical degrees, law degrees, proof of vaccination, etc.<u></u><u></u></p>
<p class="MsoNormal"> Hence the confusion<u></u><u></u></p>
<p class="MsoNormal"> Nat said that his primary interest was when Tobias and Adam could bring their work into the working group<u></u><u></u></p>
<p class="MsoNormal"> They said they want to address a few more issues before sending a draft for public review<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Open Issues<u></u><u></u></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/openid/connect/issues?status=new&status=open" target="_blank" rel="noreferrer">
https://bitbucket.org/openid/connect/issues?status=new&status=open</a><u></u><u></u></p>
<p class="MsoNormal"> We ran out of time to get to this<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Next Calls<u></u><u></u></p>
<p class="MsoNormal"> The next regular Connect call is scheduled for Thursday, April 22nd, 2021 at 7am Pacific Time<u></u><u></u></p>
<p class="MsoNormal"> However this conflicts with IIW Day 3 agenda creation<u></u><u></u></p>
<p class="MsoNormal"> I'll send a separate note asking if we should cancel for this week<u></u><u></u></p>
</div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank" rel="noreferrer">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div>