<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>Agenda<br>======<br>Logistics<br>GitHub Migration<br>IPR reminder</div><div>Introduction<br>Conformance Testing<br>Issue #45: <a href="https://github.com/openid/OpenID4VP/issues/45">https://github.com/openid/OpenID4VP/issues/45</a> <br><br></div>(PRs for OID4VP: <a href="https://github.com/openid/OpenID4VP/pulls">https://github.com/openid/OpenID4VP/pulls</a> )<br>(PRs for OID4VC: <a href="https://github.com/openid/OpenID4VCI/pulls">https://github.com/openid/OpenID4VCI/pulls</a> )<br><br><br>
Logistics<br>======<br>See: <a href="https://lists.openid.net/pipermail/openid-specs-digital-credentials-protocols/Week-of-Mon-20230904/000001.html">https://lists.openid.net/pipermail/openid-specs-digital-credentials-protocols/Week-of-Mon-20230904/000001.html</a> <br><ul class="MailOutline"><li>Call details for the DCP WG + SIOP call (time and link) can be found in the OIDF calendar: <a href="https://openid.net/calendar/">https://openid.net/calendar/</a> </li><li>For APAC friendly time, provide your preferences in the doodle: <a href="https://doodle.com/meeting/participate/id/dN0qv82a">https://doodle.com/meeting/participate/id/dN0qv82a</a> </li></ul><div><br></div><br>GitHub Migration<br>======<br>See: <a href="https://lists.openid.net/pipermail/openid-specs-ab/2023-September/010059.html">https://lists.openid.net/pipermail/openid-specs-ab/2023-September/010059.html</a> <br><br>Each spec got its own repository. Issues were moved, some PRs reopened.<br><ul class="MailOutline"><li><a href="https://github.com/openid/OpenID4VC">https://github.com/openid/OpenID4VC</a> </li><li><a href="https://github.com/openid/OpenID4VP">https://github.com/openid/OpenID4VP</a> </li><li><a href="https://github.com/openid/SIOPv2">https://github.com/openid/SIOPv2</a> </li></ul> <div> <br>If your GitHub account was not added to the OpenID organization on GitHub yet, send a mail as instructed here: <a href="https://lists.openid.net/pipermail/openid-specs-ab/2023-September/010052.html">https://lists.openid.net/pipermail/openid-specs-ab/2023-September/010052.html</a> <br><br><br>IPR<br>=====<br>To participate sign the contribution agreement for BOTH the OpenID Connect A/B WG and Digital Credentials Protocol WG: <a href="https://openid.net/intellectual-property/openid-foundation-contribution-agreements/">https://openid.net/intellectual-property/openid-foundation-contribution-agreements/</a> <br><br><br><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">====</span><br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Introductions</span><br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Amir Sharif introduced himself. Amir recently joined the WG. He works as a researcher in the Security and Trust Research Unit of the Cybersecurity Center of </span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Fondazione Bruno Kessler</span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> </span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">(Italy). He has several years experience with OAuth 2.0 and OpenID Connect and has worked with Giuseppe De Marco.</span><br>Welcome Amir!</div><div><br><br>Events<br>=====<br>IIW 37 October 10 - 12, 2023: <a href="https://internetidentityworkshop.com/">https://internetidentityworkshop.com/</a> </div><div>The Internet Identity Workshop is a hybrid event. Participants can join remotely and contribute.<br>The OIDF Digital Credentials Protocol Working Group has a meeting prior to the workshop: <a href="https://www.eventbrite.com/e/oidf-digital-credentials-protocol-working-group-meeting-at-cisco-tickets-708486982637">https://www.eventbrite.com/e/oidf-digital-credentials-protocol-working-group-meeting-at-cisco-tickets-708486982637</a> <br><br>Conformance testing<br>=====<br>VC related tests focus on the latest implementer’s draft of OID4VP. Tests cover (so far)<br><br><ul class="MailOutline"><li>response_type=vp_token</li><li>client_id=redirect_uri</li><li>direct post</li><li>cross device and same device</li><li>Request_uri</li><li>SD-JWT</li><li>SD-JWT VC</li><li>HAIP</li><li>Presentation_definition</li></ul> <br>There are some limitations in the current tests, such as in the validation of SD-JWTs (e.g., exp is not yet checked) and the content of the presentation_submission is not verified.<br><br>Question remains whether to <br><ul class="MailOutline"><li>improve validation in current tests, </li><li>extend the test suite by </li><li>supporting ISO mdoc, </li><li>adding another client_id_scheme</li><li>add negative tests (response_uri != client_id)</li></ul> <br>Giuseppe would find it helpful to have client_id = entity_id for Italian use-cases.<br>Torsten will consult the OID4VC Due Diligence Task Force for help on the direction.<br><br><br>Issue #45 - Advanced Cross Device Flow for OpenID4VP<br>=====<br><a href="https://github.com/openid/OpenID4VP/issues/45">https://github.com/openid/OpenID4VP/issues/45</a><br><br>Problem: In the current cross device flow, the verifier needs to make assumptions about the wallet (like the scheme, universal link, app link or endpoint in general). Further, it does not support encryption.<br><br>Proposal: Extend OpenID4VP with an advertisement step where the verifier communicates its capabilities and endpoints to the wallet, that in turn posts its capabilities, endpoints and identifiers in a direct HTTPS POST request to the verifier. In that way, the verifier can craft a Authorization Request that fits the wallets.<br><br>Advantage: Supports an open eco system where the wallet is not known to the verifier<br><br>Challenges: Trust between wallet and verifier. <br> a) Verifier needs to trust wallet: When announcing its capabilities to the verifier, the wallet can make use of client attestation (e.g., add a client attestation JWT as specified in <a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/">https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/</a> )<br> b) Wallet needs to trust verifier: Sharing the wallet's capabilities with an untrusted verifier may leak information about the wallet, the device it is running on and similar data that can be misused for attacks if the verifier is a malicious actor. The wallet should authenticate the verifier before it sends any data. The verifier could sign the advertisement or include an assertion. But then, the verifier would need to know about a common trust domain that also the wallet supports. GAIN is meant to deal with verifier and wallet being in different trust domains.<br><br>The PR will have to take the challenges into account.<br><br><br>PRs<br>=====<br>Out of time. Please review<br><a href="https://github.com/openid/OpenID4VP/pulls">https://github.com/openid/OpenID4VP/pulls</a> <br><a href="https://github.com/openid/OpenID4VCI/pulls">https://github.com/openid/OpenID4VCI/pulls</a> <br><br><br>Attendees<br>========<br>Joseph Heenan<br>Giuseppe De Marco<br>Judith Kahrer<br>Amir Sharif<br>David Chadwick<br>Michael Jones<br>Andy Lim<br>Brian Campbell<br>David Luna<br>David Waite<br>Mattia Zago<br>Gabe<br>George Fletcher<br>Mark<br>Naohiro Fujie<br>Nick Burgess<br>Pedro Felix<br>Rajvardhan Deshmukh<br>Sudesh Shetty<br>Torsten Lodderstedt<br>Alexandra Ashpole<br>Bjorn Hjelm<br>Tom Jones<br>Oliver Terbu<br><br><div></div></div></body></html>