<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Anthony Nadalin</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Giuseppe De Marco</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Justin Richer</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Adam Lemmon</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Joseph Heenan</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Stephane Durand</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Axel Nennker</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">David Chadwick</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Mike Jones</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Torsten Lodderstedt</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Giuseppe De Marco</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Bjorn Hjelm</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">David Waite</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Dmitri Zagidulin</span></div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Kristina Yasuda</span></div>
<div id="appendonsend"><br>
</div>
<div id="appendonsend"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Regrets: Jeremie Miller, Daniel Fett</span></div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div lang="JA" style="word-wrap:break-word">
<p class="x_x_x_x_x_x_x_x_x_x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin:0mm; font-size:12pt; font-family:SimSun; background:white">
<span lang="EN-US" style="font-family:Calibri,sans-serif; color:black; background:white; font-size:12pt"><br>
</span></p>
<p class="x_x_x_x_x_x_x_x_x_x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin:0mm; font-size:12pt; font-family:SimSun; background:white">
<span lang="EN-US" style="font-size: 12pt; color: black; font-family: Calibri, Helvetica, sans-serif;">- </span><span lang="EN-US" style="font-size: 12pt; color: black; font-family: Calibri, sans-serif;"><span class="x_x_x_x_x_x_x_x_x_x_x_marka6v39w0tx" style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Agenda</span></span><span lang="EN-US" style="font-size: 12pt; color: black; font-family: Calibri, Helvetica, sans-serif;"> adopted</span><br>
</p>
<p class="x_x_x_x_x_x_x_x_x_x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin:0mm; font-size:12pt; font-family:SimSun; background:white">
<span lang="EN-US" style="font-family: Calibri, Helvetica, sans-serif; color: black; font-size: 12pt;">- Events/External orgs</span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin:0mm; background-image:initial; background-position:initial; background-size:initial; background-repeat:initial; background-attachment:initial; background-origin:initial; background-clip:initial">
</p>
<ul style="">
<li style=""><span lang="EN-US" style=""></span><span style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">ISO 18013-5 mDL spec published: </span><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"><a href="https://www.iso.org/standard/69084.html" id="LPlnk"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">https://www.iso.org/standard/69084.html</span></a></span></li><ul>
<li style=""><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Kristina asked comments on the option discussed in ISO 18013-7 (an updated version of part 5 that focuses on online use-cases) to do a direct HTTP POST of a VP from the
app to the RP </span></li><li style=""><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Torsten asked about the request syntax in such case. Kristina to report back</span></li></ul>
<li style="display:block">
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_1"></div>
</li><li style=""><span style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">DCMS UK Trust Framework comment period: </span><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"><a href="https://github.com/Alastairtreharne1/Digital_Identity/blob/main/DRAFT_Technical%20Guidance%20-%20W3C_Verifiable%20Credentials__20210730%20(2).pdf" id="LPlnk"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">https://github.com/Alastairtreharne1/Digital_Identity/blob/main/DRAFT_Technical%20Guidance%20-%20W3C_Verifiable%20Credentials__20210730%20(2).pdf</span></a></span></li><ul>
<li style=""><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Includes </span><span style="font-family: Calibri, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important; font-size: 12pt;">Digital high
level guidance for use of Verifiable Credentials</span></li></ul>
<li style=""><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">DIF special calls discussing how to integrate PE in OIDC4VP were merged with "Credential Manifest + Presentation Exchange Weekly calls in C&C WG" @10-11AM PST on Thursdays</span></li><ul>
<li style=""><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">you can add a google calendar by decentralized.identity@gmail.com OR outlook calendar invite is attached</span></li></ul>
</ul>
<p style="margin-top: 0px; margin-bottom: 0px;"></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px">
</p>
<div></div>
<div><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">- PRs </span></div>
<div>
<ul>
<li><a href="https://bitbucket.org/openid/connect/pull-requests/" id="LPlnk576968" style="font-size:12pt; font-family:Calibri,sans-serif"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">https://bitbucket.org/openid/connect/pull-requests/</span></a></li><ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">PR #50 response-as-push has been updated</span></li><ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Mike asked how SIOP would do a direct POST to the RP when majority of the RPs are behind the firewall and agreed to file an issue on this topic</span></li><li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Torsten said that direct POST only works if SIOP and RP are in the same Network direct POST works, if on separate networks, an architecture such as cloud agents relaying or modifying
the response so that RP can poll it, might be needed</span></li><li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Justin agreed with Mike that direct POST will not work with RPs that are not Web servers, such as applications, SPAs, etc. He also said that IdP initiated login where RP is sitting
and waiting for the connection from IdP is dangerous as Golden SAML attack proved last year. </span></li><li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">DW pointed out that in SIOP, form_post has the same firewall problem as direct POST and PARM (Pushed Authorization Response Mode) since it will be coming from SIOP in the user agent,
and not a separate hosted infra to be able to do send in the web context, and you can only send data in URLs</span></li><li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Can send cross-ups with Universal links, but not custom URL schemes or open redirects, but than will hit Platform URI size limitation, seems to handle up to 1MB these days</span></li><ul>
<li><a href="https://bitbucket.org/openid/connect/issues/1342/reevaluate-uri-length-restriction" id="LPlnk"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">https://bitbucket.org/openid/connect/issues/1342/reevaluate-uri-length-restriction</span></a></li></ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Torsten suggested to spend some time to think about it/design solutions and discuss in future calls again</span></li><li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">RP without any hosted infrastructure, even in DPoP, trust in the keys is solved by having a higher authority</span></li><ul>
<li style="display:block">
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview_1 _EReadonly_1"></div>
</li><li style="display:block"><br>
</li></ul>
</ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">new PR #51 Resolvable entity identifiers ie resolvable client_id </span></li><ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">DW filed an issue based on the discussion: </span><a href="https://bitbucket.org/openid/connect/issues/1345/relying-party-instances-and-metadata-in" id="LPlnk"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">https://bitbucket.org/openid/connect/issues/1345/relying-party-instances-and-metadata-in</span></a></li><ul>
<li><span style="font-family: Calibri, Helvetica, sans-serif;">Two big topis were </span><span style="font-family:Calibri, Helvetica, sans-serif;background-color:rgb(255, 255, 255);display:inline !important">1/ implications of
</span><span style="margin:0px;font-family:Calibri, Helvetica, sans-serif;background-color:rgb(255, 255, 255);display:inline !important">trusting the keys you have never seen before; and 2/ when RP cannot have a hosted infrastructure</span></li></ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">DW said his PR has consequences to the registration/registration_uri parameter inside the request, allowing it to be included only when RP has a preexisting relationship with SIOP,
because they are problematic - for example when RP signign keys are communicated in the request that is signed itself</span></li><li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Dmitri said he believes you need both capabilies - resolvable entity identifiers and registration parameter for mobile apps or SPAs, that cannot have a <span style="background-color:rgb(255, 255, 255);display:inline !important">hosted
infrastructure<span> with </span></span>ephemeral keys per instance</span></li><ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;"><span style="margin:0px;font-size:12pt;font-family:Calibri, Helvetica, sans-serif">We discussed that domain validated certificate from the RP cannot be used because many RPs do
not have that certificate.</span><br>
</span></li></ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Justin said you can trust the keys you have never seen before by associating them with any subsequent requests, sessions, releases, etc. </span></li><ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">This might work in SIOP only if client_id was unique per RP instance, which is currently not realistic because there is no affordances to authenticate the client by anything other
than the redirect_uri. Dmitri said this is why the RP cannot "change" registration metadats since every registration is "one-time".</span></li></ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Justin pointed out that RP trusts SIOP's signing keys that it has never seen before. David C pointed out that for SIOP, it is possible to add trusted third party signed claims,
and suggested we use VCs to add trust to RPs. </span></li><ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">"Self-Issued RP" term has been mentioned several times</span></li><li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Justin agreed with the notion of application attestation set to the server, and pointed out that the issue becomes where to include such attestaiton information in the request </span></li></ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">We did not agree if usage of registration parameter in SIOP is functionally similar to Dynamic Client Registration (DCR)'s trust model </span></li><li><font face="Calibri, Helvetica, sans-serif">We agreed that the goal is to have a mechanism that allows for the equivalent of DCR without hosted infra for persistent clients, as opposed to have ephemeral clients/requests without persistence, and discussed
an mechanism close to a DCR with a SW statement for RPs without hosted infra while being able to maintain relationship with different parties</font></li></ul>
</ul>
</ul>
<ul>
<ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">PR #45 additional OIDC4VP security considerations waiting for few more approvals to be merged</span><br>
</li><ul>
<li><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">Adam agreed to review. Torsten said he also asked Daniel Fett</span></li></ul>
</ul>
</ul>
<div><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">- Issues</span><span style="color: black; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;"> (</span><a href="https://bitbucket.org/openid/connect/issues?status=new&status=open&component=SIOP&component=Verifiable%20Presentation" title="https://bitbucket.org/openid/connect/issues?status=new&status=open&component=SIOP&component=Verifiable%20Presentation" style="font-family: Calibri, sans-serif; font-size: 12pt;"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">https://bitbucket.org/openid/connect/issues?status=new&status=open&component=SIOP</span><span style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;">&component=Verifiable%20Presentation</span></a><span style="color: black; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;">)</span></div>
</div>
</div>
<div lang="JA" style="word-wrap:break-word">
<ul type="disc" style="margin-bottom:0mm">
<li style="margin:0mm; background-image:initial; background-position:initial; background-size:initial; background-repeat:initial; background-attachment:initial; background-origin:initial; background-clip:initial">
<a href="https://bitbucket.org/openid/connect/issues/1273/mitigating-security-risk-by-using-webauthn" id="LPlnk" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;"><span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">https://bitbucket.org/openid/connect/issues/1273/mitigating-security-risk-by-using-webauthn</span></a><br>
</li><ul>
<li style="margin:0mm; background-image:initial; background-position:initial; background-size:initial; background-repeat:initial; background-attachment:initial; background-origin:initial; background-clip:initial">
<span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">we discussed that caBLE is very promising to mitigate cross-device security, but is few years away from being ready</span></li><li style="margin:0mm; background-image:initial; background-position:initial; background-size:initial; background-repeat:initial; background-attachment:initial; background-origin:initial; background-clip:initial">
<span style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;">and considered adding a general non-normative language on using proximity between RP and SIOP as a cross-device security enhancement</span></li></ul>
<li style="display:block">
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview_2 _EReadonly_1"></div>
</li><li style="display:block"><span style="color: rgb(68, 114, 196); font-family: "Noto Sans CJK JP Medium", sans-serif; font-size: 12pt;"><br>
</span></li></ul>
<div><span style="color: rgb(68, 114, 196); font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;">Thank you everyone for a great discussion! </span><br>
</div>
<p class="x_x_x_x_x_x_x_x_x_x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin:0mm; font-size:12pt; font-family:SimSun">
<span lang="EN-US" style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif; color: rgb(68, 114, 196);"> </span><span lang="EN-US" style="font-size:11.0pt; font-family:"Noto Sans CJK JP Medium",sans-serif; color:#4472C4"><br>
<br>
</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>