<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">SIOP Special Topic Call Notes 6-Oct-22<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">Brian Campbell<o:p></o:p></p>
<p class="MsoNormal">Joseph Heenan<o:p></o:p></p>
<p class="MsoNormal">Torsten Lodderstedt<o:p></o:p></p>
<p class="MsoNormal">Bjorn Hjelm<o:p></o:p></p>
<p class="MsoNormal">Kristina Yasuda<o:p></o:p></p>
<p class="MsoNormal">Oliver Terbu<o:p></o:p></p>
<p class="MsoNormal">David Waite (DW)<o:p></o:p></p>
<p class="MsoNormal">David Chadwick<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Pull Requests<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/openid/connect/pull-requests/">
https://bitbucket.org/openid/connect/pull-requests/</a><o:p></o:p></p>
<p class="MsoNormal"> PR #251: adding an example of presenting an LDP_VC signed using bbs<o:p></o:p></p>
<p class="MsoNormal"> Kristina requested that Torsten review<o:p></o:p></p>
<p class="MsoNormal"> PR #310: Clean up of SIOPv2<o:p></o:p></p>
<p class="MsoNormal"> Kristina addressed comments received<o:p></o:p></p>
<p class="MsoNormal"> Re-reviews requested<o:p></o:p></p>
<p class="MsoNormal"> PR #299: Add Error Codes<o:p></o:p></p>
<p class="MsoNormal"> David Chadwick made an updated proposal in issue #1631<o:p></o:p></p>
<p class="MsoNormal"> Torsten suggested that we not define new error codes, but give guidance to how to use existing ones<o:p></o:p></p>
<p class="MsoNormal"> Torsten said that we need a Credential Issuance Error Response section<o:p></o:p></p>
<p class="MsoNormal"> Torsten said that Daniel Fett is doing a security assessment of the error responses<o:p></o:p></p>
<p class="MsoNormal"> PR #285: Adding batch credential endpoint: fixes #1544<o:p></o:p></p>
<p class="MsoNormal"> Torsten and Oliver discussed the mechanisms<o:p></o:p></p>
<p class="MsoNormal"> Oliver plans to update the PR accordingly<o:p></o:p></p>
<p class="MsoNormal"> Torsten suggested adding a Batch Credential Issuance Error section<o:p></o:p></p>
<p class="MsoNormal"> Torsten doesn't understand why a c_nonce would be returned in the error response for every slot requested<o:p></o:p></p>
<p class="MsoNormal"> He suggested returning only one c_nonce from the batch issuance endpoint<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Rebooting the Web of Trust (RWoT)<o:p></o:p></p>
<p class="MsoNormal"> People shared points about the recent RWoT workshop<o:p></o:p></p>
<p class="MsoNormal"> Torsten had a discussion about higher-assurance issuance using OpenID4VCI<o:p></o:p></p>
<p class="MsoNormal"> Torsten said that Manu Sporny believes that CHAPI and OpenID4VCI can go together<o:p></o:p></p>
<p class="MsoNormal"> Manu plans to support OpenID4VCI in CHAPI<o:p></o:p></p>
<p class="MsoNormal"> Oliver recruited people to work on the holder binding proposal<o:p></o:p></p>
<p class="MsoNormal"> They wrote a paper about that<o:p></o:p></p>
<p class="MsoNormal"> It will be sent to the W3C VC working group<o:p></o:p></p>
<p class="MsoNormal"> Also, see the draft whitepaper <a href="https://github.com/WebOfTrustInfo/rwot11-the-hague/blob/master/draft-documents/credential-profile-comparison.md">
https://github.com/WebOfTrustInfo/rwot11-the-hague/blob/master/draft-documents/credential-profile-comparison.md</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Issues<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/openid/connect/issues?status=new&status=open">
https://bitbucket.org/openid/connect/issues?status=new&status=open</a><o:p></o:p></p>
<p class="MsoNormal"> #1577: [needs-PR] Cryptographic proof of possession nonce management<o:p></o:p></p>
<p class="MsoNormal"> Torsten described that AnonCreds wouldn't use the nonce mechanisms<o:p></o:p></p>
<p class="MsoNormal"> He said that the proposal is light weight for anyone using JWS or JWT proof formats<o:p></o:p></p>
<p class="MsoNormal"> He said that we will likely have profiles that are credential-format specific<o:p></o:p></p>
<p class="MsoNormal"> Oliver asked how c_nonce would work with a stateless issuer<o:p></o:p></p>
<p class="MsoNormal"> Kristina responded that the server would recognize a nonce that it created<o:p></o:p></p>
<p class="MsoNormal"> Torsten suggested we describe how to achieve replay protection<o:p></o:p></p>
<p class="MsoNormal"> Server-provided nonce or client-provided nonces are options<o:p></o:p></p>
<p class="MsoNormal"> Kristina is reluctant to remove the server-provided nonce, but wants to see more implementation experience<o:p></o:p></p>
<p class="MsoNormal"> Oliver asserted that stateless servers need c_nonce for replay protection<o:p></o:p></p>
<p class="MsoNormal"> Oliver and Torsten will write a PR together about c_nonce and replay<o:p></o:p></p>
<p class="MsoNormal"> Kristina requested that this happen soon so we can merge it in a couple of weeks<o:p></o:p></p>
<p class="MsoNormal"> #1651: [has-PR] Clarifying jwt_vp example in OIDC4VP<o:p></o:p></p>
<p class="MsoNormal"> Please review PR #314<o:p></o:p></p>
<p class="MsoNormal"> #1612: [has-PR] Define which object should be returned for `mdl_iso_cbor`<o:p></o:p></p>
<p class="MsoNormal"> Please review PR #315<o:p></o:p></p>
<p class="MsoNormal"> #1626: response_mode=post should define response format & add an example<o:p></o:p></p>
<p class="MsoNormal"> Kristina asked whether the response should be form-url-encoded<o:p></o:p></p>
<p class="MsoNormal"> Brian said that this seems pretty undefined<o:p></o:p></p>
<p class="MsoNormal"> Torsten said that the endpoint is determined by the redirect_uri parameter<o:p></o:p></p>
<p class="MsoNormal"> Brian asked if this was sort of a reverse PAR<o:p></o:p></p>
<p class="MsoNormal"> Mike asked where this is specified<o:p></o:p></p>
<p class="MsoNormal"> It isn't currently specified<o:p></o:p></p>
<p class="MsoNormal"> Brian said that the size doesn't matter because you're posting directly to the server<o:p></o:p></p>
<p class="MsoNormal"> Torsten said that this can work without the wallet exposing an endpoint<o:p></o:p></p>
<p class="MsoNormal"> The RP needs to expose an endpoint<o:p></o:p></p>
<p class="MsoNormal"> The requirement for the RP to expose an endpoint reachable from the wallet is an addition for the cross-device flow<o:p></o:p></p>
<p class="MsoNormal"> This is simpler than some other solutions available<o:p></o:p></p>
<p class="MsoNormal"> Torsten said that he will add the text that Joseph proposed about the encoding<o:p></o:p></p>
<p class="MsoNormal"> #1642: issuance initiation request options<o:p></o:p></p>
<p class="MsoNormal"> Joseph said that we need to define an error response in additional to a successful response<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Next Call<o:p></o:p></p>
<p class="MsoNormal"> The next call is at 4pm Pacific Time on Monday, October 10, 2022<o:p></o:p></p>
</div>
</body>
</html>