[Openid-dcp] [DCP WG] Meeting Minutes - November 20, 2025

Thu Nov 20 20:39:16 UTC 2025

Subject:

OpenID Digital Credentials Protocols Working Group
Meeting Minutes - November 20, 2025

Attendees:
Jin Wen, Kristina Yasuda (Co-host), Joseph Heenan (Co-host), Christian Bormann, Daniel Fett, Filip Skokan, Frederik Krogsdal Jacobsen, Hakan Yildiz, Jan Vereecken, Joe DeCock, Michael Jones, Oliver Terbu, Valentine Mazurov, Łukasz Jaromin, and Brian Campbell.

Note Taker: Jin Wen

===============================================================================

1. Administrative

The meeting began with acknowledgment of the Code of Conduct, Antitrust
Policy, and IPR Policy.
https://openid.net/wp-content/uploads/2025/06/OIDF_Groups-Activities-Events-Note-Well_Final_2025-06-12.pdf

===============================================================================

2. Events

- ISO Working Group 10, focused on mobile driving licenses, passed a
  resolution to collaborate more closely with the DCP Working Group. The
  working group will revisit this topic in two weeks to determine if a
  similar statement from the DCP WG is appropriate.
- OpenID4VP & OpenID4VCI related in-person ISO Interop event in New
  Zealand, November 16-18 (pre-NZ ISO mDL WG meeting). Results from the
  pre-ISO OpenID Foundation interop testing are available on the mailing
  list, but ISO testing results were not yet available at the time of the
  call.
- OpenID4VCI/OpenID4VP + OpenID4VC-HAIP 1.0 remote interop event status update
- SD-JWT VC has been published as RFC 9901
  (https://datatracker.ietf.org/doc/rfc9901/), representing a significant
  milestone. Specifications can now reference the final version.

===============================================================================

3. General Updates

- OpenID4VC-HAIP public review concludes December 8, 2025; voting
  scheduled December 9-23, 2025
- Working group call time slots poll:
  https://doodle.com/group-poll/participate/eEQkzpWe (please respond ASAP,
  poll closes in 1 week). Members urged to respond promptly to help
  determine call schedule reductions and server-to-server discussion slots.
  Thursday calls are designated for server-to-server topics going forward.
- Next week's calls (week of November 25, 2025) are cancelled for Thanksgiving

===============================================================================

4. OpenID4VC-HAIP 1.0 Pull Requests and Issues

Repository: https://github.com/openid/OpenID4VC-HAIP

Pull Requests Reviewed and Merged:

PR: Add A128GCM and A256GCM encryption algorithms
- Added both A128GCM and A256GCM encryption algorithms. Four approvals
  received. Merged with working group consensus despite being open less
  than one week.

PR: Make clear the digital signature requirements
- Editorial fix making requirements more explicit. Three approvals
  received. Change makes implicit requirements more explicit to prevent
  confusion. Approved for merge.

PR: Terminology Update (singular to plural)
- Purely editorial change replacing singular with plural terminology. Four
  approvals received. Approved for merge.

PR: Ecosystem Capitalization
- Editorial change to uppercase Ecosystem throughout the document consistent
  with terminology definitions. Approved for merge, though noted this may
  cause merge conflicts with other pull requests.

PR: Add multi-signed option for C API
- Added multi-signed variant to C API in OpenID4VP. The C API now
  mandates wallet support for all three options: unsigned, signed, and
  multi-signed. Text updated from verifier may support to verifier must
  support at least one of these options to clarify requirements. Five
  approvals received. Merged with working group consensus.

Open Issues:

GitHub Issues:
https://github.com/openid/OpenID4VC-HAIP/issues?q=is%3Aissue%20state%3Aopen%20-label%3Aafter-wglc%20-label%3Ahas-PR%20-label%3Aready-for-PR%20milestone%3A%221.0%20Final%22

SD-JWT VC Version Alignment:
- Discussion on aligning referenced specification versions between OpenID4VP
  and OpenID4VCI. Working group agreed to adopt Option 2: HAIP will
  reference the later versions used in VCI specifications. This applies to
  both SD-JWT VC and status list specifications. Joseph Heenan noted APAC
  call also favored option 2.

New Issue from Stefan - Certificate Signature Schemes:
- One new issue received from Stefan regarding certificate signature
  schemes. Current suggested resolution would be editorial in nature. Issue
  notes that while HAIP doesn't specify which signature scheme must be used
  for certificates, guidance exists that ecosystems should define
  certificate profiles including mandatory-to-implement algorithms.
  Suggestion to add clarifying sentence to make this more explicit. Christian
  Bormann suggested adding a sentence to make requirements clear, which
  would be editorial in nature. Joseph Heenan agreed with Christian's
  suggestion.

Resolution:
- Working group provided verbal approval to proceed with using updated
  dash-06 version for approval. This version will be published after
  today's call incorporating all merged pull requests.
- Editorial changes to clarify requirements are acceptable and do not
  require substantive changes.
- Official notice given that on December 4, 2025 (EU call), the working
  group will conduct a formal vote to approve the updated HAIP version
  (dash-06) for final voting. This constitutes the required two-week notice
  for an official working group decision. Working group agreed with the
  plan to proceed with formal vote.

Action Items:
- Chairs: Publish HAIP dash-06 after resolving merge conflicts
- Chairs: Call formal vote at December 4, 2025 EU call on updating
  OpenID4VC-HAIP version for public review/voting

===============================================================================

5. OpenID for Verifiable Credential Issuance (OpenID4VCI) Pull Requests and Issues

PR #602 (IAE): add credential format specific sections for Interactive
Authorization Request (IAR) endpoint binding in Verifiable Presentations
(VPs)
https://github.com/openid/OpenID4VCI/pull/602
- Needs one more approval. Updates VCI 1.0 to be ready for adding errata.
  Previous request for changes from Kristina was primarily formatting-related.
  Joseph Heenan's force push to move content to 1.1 folder may have
  overwritten old change requests. Requires additional review, particularly
  for session transcript implementation for the new endpoint. Timo did
  review it since the rebase.

PR #615: add require_interactive_authorization_requests to Authorization
Server (AS) metadata
https://github.com/openid/OpenID4VCI/pull/615
- Has pending review request. Paul Bastian submitted request for changes
  with two comments. First comment should be turned into a separate issue
  for broader discussion. Second comment deemed acceptable as-is.

Issue #620: Interactive Authorization Endpoint (IAE) URL is not compatible
with Origin/expected_origin
https://github.com/openid/OpenID4VCI/issues/620

PR #629: fix: just do derived origin binding
https://github.com/openid/OpenID4VCI/pull/629
- Can be closed

PR #645: Introduce Proven Key term
https://github.com/openid/OpenID4VCI/pull/645
- Related to #640 (the proven key proposal)

PR #662: Update draft number for 1.0, add errata to title, add history section
https://github.com/openid/OpenID4VCI/pull/662
- An extra approval would be good

PR #678: Rephrase conditions to provide nonce in proof types based on
presence of Nonce endpoint
https://github.com/openid/OpenID4VCI/pull/678
- Oliver Terbu requested additional review. Christian Bormann agreed with
  the changes. Joseph Heenan commented that changes need to be applied to
  both 1.0 and 1.1 versions. Oliver committed to making the changes.

Action Items:
- Kristina Yasuda/Chairs: Ping Zusan, Garris, Martin, and Hisham to review
  PR #602
- Christian Bormann: Create separate issue for Paul's first comment on PR #615
- Oliver Terbu: Apply changes to both VCI 1.0 and 1.1 for PR #678
- Working group members: Provide additional approval on PR #662
- Working group members: Review PR #615, issue #620, PR #645

===============================================================================

6. OpenID for Verifiable Presentations (OpenID4VP) Pull Requests and Issues

Repository: https://github.com/openid/OpenID4VP

PR #663: Consistently use given_name and family_name in examples
https://github.com/openid/OpenID4VP/pull/663
- Pull request to change examples from last name to family name for
  consistency. Christian noted additional pieces needing fixes beyond the
  examples. Discussion on whether to apply changes to both credential
  formats or just specific ones. Need to verify alignment with ISO and PID
  claim definitions. Approved to proceed.

Action Items:
- Christian Bormann: Comment on given name/family name PR with specific
  line changes needed
- Working group members: Review PR #663

===============================================================================

7. HPKE Decision

Issue #676: 'pure' HPKE container approach using new response_mode
https://github.com/openid/OpenID4VP/issues/676

Discussion:
Kristina Yasuda shared this issue. Discussion regarding HPKE (Hybrid
Public Key Encryption) implementation direction. Discussion deferred to
post-Thanksgiving. ISO working group appears to favor Google's vanilla HPKE
proposal over WSA HPKE. Reasoning relates to similarity with Annex C.
Joseph Heenan requested multiple times that Kenichi and Hisham document the
rationale. Brian Campbell questioned the reasoning. ISO favored the session
transcript option for info too.

Resolution:
No decision made at this meeting. Discussion to continue with more input
from working group members.

Action Items:
- ISO participants (Kenichi and Hisham): Document rationale for vanilla
  HPKE preference in issue #676
- Working group members: Provide opinions on HPKE issue

===============================================================================

8. OpenID4VP Errata Preparation

Discussion:
Joseph Heenan noted that we need to do the same changes to OpenID for
Verifiable Presentations (OpenID4VP) to prepare for a 1.0 errata and create
a 1.1 version of the spec. Work expected to begin after the week following
Thanksgiving.

Resolution:
Work to be done after Thanksgiving week.

Action Items:
- Joseph Heenan: Prepare OpenID4VP changes for 1.0 errata and create 1.1
  version (after Thanksgiving week)

===============================================================================

9. Other Topics

DC API for VCI:
- DC spec now includes dot create function. Need to add corresponding
  functionality to VCI 1.1 draft. Existing issue and closed pull request
  #476 in VCI repository. Work expected to resume after ISO meeting
  concludes.

Server-to-Server Discussion:
- Most active participants not present on today's call. Recent activity in
  Google Drive with comments from Martine and suggestions from Jan.
  Significant content additions by Gareth. Discussion to continue in
  future calls.

===============================================================================

Summary of Action Items:

Chairs:
- Publish HAIP dash-06 after resolving merge conflicts
- Call formal vote at December 4, 2025 EU call on updating OpenID4VC-HAIP
  version for public review/voting

Kristina Yasuda/Chairs:
- Ping Zusan, Garris, Martin, and Hisham to review PR #602

Christian Bormann:
- Create separate issue for Paul's first comment on PR #615
- Comment on given name/family name PR with specific line changes needed

Joseph Heenan:
- Prepare OpenID4VP changes for 1.0 errata and create 1.1 version (after
  Thanksgiving week)

Oliver Terbu:
- Apply changes to both VCI 1.0 and 1.1 for PR #678

ISO Participants (Kenichi and Hisham):
- Document rationale for vanilla HPKE preference in issue #676

Working Group Members:
- Complete doodle poll for new working group call times within one week
- Provide additional approval on PR #662
- Review PR #615, issue #620, PR #645
- Review PR #663
- Provide opinions on HPKE issue (issue #676)

===============================================================================

Next Meetings:
- No calls week of November 25, 2025 (Thanksgiving week)
- Next meeting: Tuesday, December 2, 2025
- Formal vote on HAIP version: Wednesday, December 4, 2025 (EU call)

Meeting adjourned.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-digital-credentials-protocols/attachments/20251120/4d85ccf0/attachment-0001.htm>