[Openid-specs-digital-credentials-protocols] [notes] DCP WG + SIOP call 14th Jan 2025

[Rajvardhan Deshmukh (rajvdesh)]

Hi folks,
Here are the notes of the call on 14th Jan 2025 call.


Participants:

Rajvardhan Deshmukh (Cisco)

Torsten Lodderstedt

Michael Jones

Akash Shah (Google)

Alan Wang (Anonyome Labs)

Andres Olave

Bjorn Hjelm

Christian Bormann

Daniel Fett

David Zeuthen (Google)

Edmund

Hicham Lozi (Apple)

Lukasz Jaromin (Radiam)

Oliver Terbu

Paul Bastian

Ryan Galluzzo, NIST ACD

Steve Venema

Tim Cappali (Okta)

Lee Campbell (Google)



Events:
Hybrid meeting prior to OSW 2025. Register if you want to attend in person https://www.eventbrite.co.uk/e/oidf-dcp-wg-hybrid-meeting-prior-to-osw-2025-tickets-1146184230889



Oliver: ISO interop event haip with mdocs and haip with vanilla oid4vc 4 th march. Qs email: InteropTest-NL25 at rdw.nl<mailto:InteropTest-NL25 at rdw.nl>

registration form: https://forms.gle/9qAgzzjmPjMRDC3Q6 (by 31 January 23:59:59 UTC, don't wait till the last minute since seats are limited. wg10 and iso members organize this.



Vitrual WG10 meeting follows the above interop. DMV of Netherlands. Discuss HAIP.



Steve: A little more detail on the meeting mentioned earlier by Hicham:

This the 103rd meeting of WG10. Its a 3-day virtual mtg on 28-30Jan 13:00-16:00 UTC.



Purpose: "The primary purpose of this meeting will be to confirm if the OID4VP + HAIP solution (of which a final text to review is expected by 14 January) addresses the requirements discussed in the June 2024 WG10 meeting.  Time allowing, a checkpoint may also be taken on other action points in preparation for the March 2025 WG10 meeting."



I'm also unclear on what is needed for non-WG10 members to attend



https://github.com/openid/OpenID4VP/pull/308

Don’t want a situation where RP tries multi client ids

Remove client_id from signature and just have origin.

Session transcript content and encrytion for it are seperate problems handle them seperately.

This extension is only for DC api.

Session Transcript bound to origin not RP cert. As multiple certs may exist and it is not easy to link them.



client_ids and the request have no relation.

Cannot determine client_id for which cred request

Torsten will document 2 options and their consequences



iso 18013-5 multiple signature support, no client ID.



Encryption:

Sign key with a trusted 3rd party and that party should be associated with a certain trust framework.

Encryption key in the request param

Expected origins



https://github.com/openid/OpenID4VP/pull/374/files

Oliver will change the name and then merge https://github.com/openid/OpenID4VP/pull/374/files#r1906034557

General Session transcript is more critical, so merging it first helps ISO. Later merge multi-RP PR



https://github.com/openid/OpenID4VP/pull/380

apu/apv not every encryption algos have them.
We can use the ones that do.

As client_id will be removed from the session transcript, we can replace it with the origin for this PR.

Multiple origins facility exists (array) for OID4VP, but in HAIP there is just one origin.



Torsten documents Q’s related to multiple RPS, encryption, and the consequence of these options. These might affect Brian’s PRs.



Regards,

Rajvardhan

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-digital-credentials-protocols/attachments/20250116/e40d5adf/attachment-0001.htm>