<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>Attendees:</div><div><br></div><div>Joseph Heenan</div><div>Brian Campbell</div><div>John Bradley</div><div>Giuseppe De Marco</div><div>Takahiko Kawasaki</div><div>Mike Jones</div><div>George Fletcher</div><div>Kristina</div><div>David Chadwick</div><div>Pedro Felix</div><div><br></div><div><br></div><div><b><u>Federation</u></b></div><div><br></div><div><br></div><div><a href="https://bitbucket.org/openid/connect/pull-requests/405">https://bitbucket.org/openid/connect/pull-requests/405</a> - Text about the meaning of having a metadata claim in an Entity Statement.</div><div><br></div><div>Agreed to merge</div><div><br></div><div><br></div><div><br></div><div><a href="https://bitbucket.org/openid/connect/pull-requests/375">https://bitbucket.org/openid/connect/pull-requests/375</a> - Trust Mark endpoint - non normative example</div><div><br></div><div>Agreed to merge</div><div><br></div><div><br></div><div><br></div><div><a href="https://bitbucket.org/openid/connect/pull-requests/369">https://bitbucket.org/openid/connect/pull-requests/369</a> - examples of metadata_policy - something compatible with both OAuth2 and OIDC metadata</div><div><br></div><div>Agreed to merge</div><div><br></div><div><br></div><div><div><a href="https://bitbucket.org/openid/connect/pull-requests/380">https://bitbucket.org/openid/connect/pull-requests/380</a> - editorials on Federation Keys and usage of the term Entity</div><div><br></div><div>Agreed to merge</div><div><br></div><div><div><a href="https://bitbucket.org/openid/connect/pull-requests/414">https://bitbucket.org/openid/connect/pull-requests/414</a> - Entity Type is a defined term</div><div><br></div></div><div>Agreed to merge.</div><div><br></div><div><br></div><div><a href="https://bitbucket.org/openid/connect/pull-requests/407">https://bitbucket.org/openid/connect/pull-requests/407</a> - Fixes a draft 26 edit in the request_object usage section</div><div><br></div><div>Agreed to merge.</div><div><br></div><div><br></div><div><a href="https://bitbucket.org/openid/connect/pull-requests/406">https://bitbucket.org/openid/connect/pull-requests/406</a> - The 'essential' policy operator can be used in conjunction with one_of, subset_of, superset_of to make their presence optional (iss #1753)</div><div><br></div><div>Agreed to merge</div><div><br></div><div>All outstanding Federation PRs are now dealt with.</div><div><br></div><div><br></div><div><br></div><div><a href="https://bitbucket.org/openid/connect/issues/1757/historical-keys-should-show-validaty">https://bitbucket.org/openid/connect/issues/1757/historical-keys-should-show-validaty</a></div><div><br></div><div>Quite a bit of discussion on the issue. Giuseppe proposes to prepare a PR where there is a “revoked” claim that contains a JSON object.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><u><b>VCI / VP</b></u></div><div><br></div><div><br></div><div>Kristina merged various editorial PRs:</div><div><br></div><div><div>merging PR #395, editorial. Approvals from both editors.</div><div><br></div></div><div><div>merging PR #402 - purely editorial. Approvals from both editors.</div><div><br></div><div>merged PR #398 - purely editorial. Approvals from both editors.</div></div><div><br></div><div><div>merged PR #394, purely editorial. Approvals from both editors.</div><div><br></div></div><div><br></div><div><br></div><div><div>https://bitbucket.org/openid/connect/issues/1777/vc-issuance-is-vulnerable-to-unknown-key</div></div><div><br></div><div>Quite a bit of discussion as to how/whether the suggestion helps.</div><div><br></div><div>John: is the problem that the TLS connection isn’t considered secure? If so adding more things that can be read doesn’t seem to help.</div><div><br></div><div>George: What is the attacker/threat model? </div><div><br></div><div>John: Should find out Richard’s assumed attacker model before we move to solutions.</div><div><br></div><div>Kristina will document today’s discussion in issue.</div><div><br></div><div><br></div></div><div><br></div><div><br></div><div><a href="https://bitbucket.org/openid/connect/issues/1621/agree-on-direction-61-tls-requirements">https://bitbucket.org/openid/connect/issues/1621/agree-on-direction-61-tls-requirements</a></div><div><br></div><div>Agreed not to say anything very specific about TLS versions that would quickly get out of date. Could refer to BCP195 / <a href="https://datatracker.ietf.org/doc/rfc9325/">https://datatracker.ietf.org/doc/rfc9325/</a></div><div>Brian thinks he’s written some text about using https scheme before and will try to find it to share.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><a href="https://bitbucket.org/openid/connect/issues/1374/credential-issuance-oauth-20-token">https://bitbucket.org/openid/connect/issues/1374/credential-issuance-oauth-20-token</a></div><div><br></div><div>Kristina suggests this should be handled in a separate spec, not in the VP spec, and suggests closing the issue. No one objected.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div></div></body></html>