[Openid-specs-digital-credentials-protocols] 30/04/2024 APAC DCP call meeting notes

[Tobias Looker]

Attendees

Joseph Heenan
Daniel Fett
Torsten Lodderstedt
Oliver Terbu
Christian Bormann
Tim Cappalli
Sudesha Shetty
Mike Jones
Brian Campbell
Victor
Gabe
Ryan Galluzo
David Waite

Events External Orgs

Potential LSP Interop Event Updates

Oliver: Matthais the CTO of this, asked me to come up with an update to the VCI metadata for track 1,

**Oliver walked through the following document as a proposal for the POTENTIAL LSP interop event https://hackmd.io/COCgf05rTfOsdnzfFId9zg**

Kristina: It looks like one question is how to request just the MSO vs the actual signed claim values

Torsten: My question is not what problem they are solving, but how they are solving it using OpenID4VCI

Oliver: I'll finish walking through the proposal and perhaps it will be clearer

Oliver: Suggestion is to have two profiles "lite" and "full", "lite" is much more like what we currently have in OpenID4VCI and "full" allows for more of the
specific partial returning of just the MSO, a more experimental feature the ISO WG want to test.

Kristina: I'm not opposed to testing this behaviour but I think a new credential format isn't the right approach

Tobias: I think I agree, we should explore whether an additional parameter in the credential request is used to control returning the MSO and or the Issuer Signed.

Sebastian: I just wanted to say clarifying ownership around where the credential request and response is defined for a concrete format is important currently its defined in ISO and in OpenID, it would be good to clarify

**Lots more discussion on the approach please review the recording**

Open PRs and Issues

Transaction Authorisation

Mike: I've been talking to some people at Visa about this issue, which they are enthusiastic about, however they have some questions about privacy

Mike: They pointed out the example, lets say the transaction involves a $1500 payment authorisation to an adult film site, as you can appreciate this becomes quite sensitive information.

Tobias: Who are we worried about might see this request here?

Mike: The modality of different presentation protocols could mean someone might intercept this request such as in cross device flows.

Torsten: **Walked through a concrete example for payment_confirmation in this document https://docs.google.com/document/d/1E_UlB3fh9zbWiPrzFThEnt69hYN60CWk/edit<https://docs.google.com/document/d/1E_UlB3fh9zbWiPrzFThEnt69hYN60CWk/edit**> **

Torsten: As a side we also now have the ability to encrypt the request thanks to the merging of PR 59

Mike: Finally in the document, Kristina, your speaking of a spec that uses OID, and base64 encoding rather than base64url encoding, what is that spec, it does things different
to how we usually do things

Kristina: It is aligned with CSS (cloud signature consortium) which is an SDO responsible for certain standards in the EU

Torsten: **Gave context about who CSS is and their role in eidas**

Mike: Thanks with that my questions are satisfied, thanks for the time

Mandatory to implement features (Issue 157)

Kristina: **Re-intro'd the issue and gave updated context following IIW**

Kristina: Please re-review issue 157 to ensure you agree with the requirements

Kristina: For the issues we didn't feel there was consensus on we have opened 5 new issues 158, 159 160, 161, 162, please review these

Kristina: We only have 7 mins left but it might be worth using the remaining time to discuss any questions with regard to the new issues

Mike: I've gone through and commented on each issue, on the back of that what I think might be worthwhile is updating some of the descriptions
of the issues as much of the confusion was around understanding what the issue actually is.

Issue 162

Joseph: I think enough implementers have said they want this feature

Tobias: I agree, but I want to explore appropriate implementation guidance to ensure RP are aware of the tradeoffs

Torsten: We also need to be clear that requesting multiple credentials is a useful feature and that it does offer a superior user experience.

Thanks,
[MATTR website]<https://mattr.global/>

Tobias Looker
MATTR
+64 273 780 461
tobias.looker at mattr.global<mailto:first.last at mattr.global>
[MATTR website]<https://mattr.global/>
[MATTR on LinkedIn]<https://www.linkedin.com/company/mattrglobal>
[MATTR on Twitter]<https://twitter.com/mattrglobal>
[MATTR on Github]<https://github.com/mattrglobal>

This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it – please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-digital-credentials-protocols/attachments/20240502/e065c42e/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 22001 bytes
Desc: image001.png
URL: <http://lists.openid.net/pipermail/openid-specs-digital-credentials-protocols/attachments/20240502/e065c42e/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 872 bytes
Desc: image002.png
URL: <http://lists.openid.net/pipermail/openid-specs-digital-credentials-protocols/attachments/20240502/e065c42e/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 528 bytes
Desc: image003.png
URL: <http://lists.openid.net/pipermail/openid-specs-digital-credentials-protocols/attachments/20240502/e065c42e/attachment-0007.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image004.png
Type: image/png
Size: 921 bytes
Desc: image004.png
URL: <http://lists.openid.net/pipermail/openid-specs-digital-credentials-protocols/attachments/20240502/e065c42e/attachment-0008.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image005.png
Type: image/png
Size: 1045 bytes
Desc: image005.png
URL: <http://lists.openid.net/pipermail/openid-specs-digital-credentials-protocols/attachments/20240502/e065c42e/attachment-0009.png>