<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
</head>
<body>
<div name="messageBodySection">
<div dir="auto">Hi,<br />
<br />
below are the meeting minutes from the working group call June 19th.</div>
</div>
<div name="messageSignatureSection"><br />
<div class="matchFont">best regards,
<div dir="auto">Torsten.</div>
<div dir="auto"><br /></div>
<div dir="auto">--- Attendees:<br />
<br />
<span id="docs-internal-guid-286df36a-7fff-fc39-b179-7f0c2a7dca64">
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;"><span style="font-size: 11pt; font-family: Arial, sans-serif; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-alternates: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; vertical-align: baseline; white-space: pre-wrap;">Daniel Fett</span></p>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;"><span style="font-size: 11pt; font-family: Arial, sans-serif; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-alternates: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; vertical-align: baseline; white-space: pre-wrap;">Andreea Prian</span></p>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;"><span style="font-size: 11pt; font-family: Arial, sans-serif; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-alternates: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; vertical-align: baseline; white-space: pre-wrap;">Andres Olave</span></p>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;"><span style="font-size: 11pt; font-family: Arial, sans-serif; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-alternates: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; vertical-align: baseline; white-space: pre-wrap;">Dima Postnikov</span></p>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;"><span style="font-size: 11pt; font-family: Arial, sans-serif; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-alternates: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; vertical-align: baseline; white-space: pre-wrap;">Stefan Charsley</span></p>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;"><span style="font-size: 11pt; font-family: Arial, sans-serif; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-alternates: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; vertical-align: baseline; white-space: pre-wrap;">Torsten Lodderstedt</span></p>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;"><span style="font-size: 11pt; font-family: Arial, sans-serif; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-alternates: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; vertical-align: baseline; white-space: pre-wrap;">Paul Bastian</span></p>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;"><span style="font-size: 11pt; font-family: Arial, sans-serif; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-alternates: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; vertical-align: baseline; white-space: pre-wrap;">Ajay Jadhav</span></p>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;"><span style="font-size: 11pt; font-family: Arial, sans-serif; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-alternates: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; vertical-align: baseline; white-space: pre-wrap;">Nat Sakimura</span></p>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;"><span style="font-size: 11pt; font-family: Arial, sans-serif; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-alternates: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; vertical-align: baseline; white-space: pre-wrap;"><br /></span></p>
</span>--- Issues/PRs:</div>
<div dir="auto"><br /></div>
<div dir="auto">
<div dir="auto">https://github.com/openid/OpenID4VCI/pull/509</div>
<div dir="auto"> Dima to review over night</div>
<div dir="auto"> Andres will also review</div>
<div dir="auto"><br /></div>
<div dir="auto">https://github.com/openid/OpenID4VCI/pull/520</div>
<div dir="auto"> <span style="caret-color: rgb(39, 39, 40);">Is the shift towards a new design (fully signed instead of signed attribute) needed?</span></div>
<div dir="auto"> What is mandatory to implement? </div>
<div dir="auto"> Asked attendees to state their opinion on the PR</div>
<div dir="auto"><br /></div>
<div dir="auto">https://github.com/openid/OpenID4VCI/pull/505 </div>
<div dir="auto"> Not relevant for the attendees, main focus to ensure the extension does not make the use of the credential endpoint more complex for implementers relying on TLS</div>
<div dir="auto"> Asked people to review</div>
<div dir="auto"><br /></div>
<div dir="auto">Nonce Endpoint Protection</div>
<div dir="auto"> https://github.com/openid/OpenID4VCI/issues/541</div>
<div dir="auto"> https://github.com/openid/OpenID4VCI/issues/461</div>
<div dir="auto"> It seems the access token would primarily be used to manage/shard nonces.</div>
<div dir="auto"> for c_nonces, self contained nonces are sufficient</div>
<div dir="auto"> there might be value in the issuer could signal its requirement for an access token</div>
<div dir="auto"> What about DPoP nonces? they must be fetched unprotected as they are required for the token request (issuing access tokens). Also, if the access token is DPoP bound, the nonce endpoint request itself would need to be DPoP protected.</div>
<div dir="auto"> General comment: Many security protocols provide a nonce in the first step of the process in an unprotected manner, doesn't seem to be a problem </div>
</div>
</div>
</div>
</body>
</html>