<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title></title>
</head>
<body>
<div name="messageBodySection">
<div dir="auto">Hi all,<br>
<br>
Below are the notes for Thursday's APAC call<br>
<br>
Cheers,<br>
Andres<br>
<br>
---------------------------------------<br>
<br>
# APAC Meeting Notes - July 10 2025<br>
<br>
## Attendees:<br>
<br>
Veaceslav Dimitroglo<br>
Nat Sakimura<br>
Andres Olave<br>
Kenichi Nakamura<br>
Joseph Heenan<br>
Stefan Charsley<br>
<br>
## Initial Discussion<br>
<br>
- Veaceslav asks about reference implementations of DCQL & Claims path pointer. <br>
- Joseph suggests the Open Wallet Typescript & Kotlin multiplatform implementations. Kotlin: https://github.com/openwallet-foundation-labs/identity-credential/tree/main<br>
<br>
## Upcoming Events:<br>
IETF Madrid 21 July - Relevant specs: Client attestation draft, Token list, Client Id Prefix + JOSE WG discussing HPKE<br>
DICE September is delayed to November<br>
<br>
## Notifications:<br>
- VP 1.0 Final has been published - https://openid.net/specs/openid-4-verifiable-presentations-1_0.html. There's another version that won't be updated with errata, but it shouldn't be used<br>
- VCI is under public review<br>
- VCI interop testing on July 16 using draft 16. <br>
<br>
### Conformance tests<br>
- VP Final conformance tests are already out! <br>
- VCI is being updated<br>
<br>
## PRs<br>
<br>
### Presentation during issuance https://github.com/openid/OpenID4VCI/pull/509<br>
<br>
- Interop testing of the proposal was done during German Funke meetup.<br>
- Daniel recently added improvements to assist in the detection of session fixation attacks. Waiting on Gareth's response<br>
- Joseph clarifies that this feature will be optional and that the AS shows support via metadata. It will be used for German PID presentation<br>
- Stefan raises the need to clarify what the wallet should do if the issuer uses a custom type that the wallet doesn't understand. Joseph clarifies that the wallet should send another request to the server, and this should be added to the spec.<br>
- Andres raised issues around wallets collaborating. Joseph believes that the spec is sufficient and that HAIP handles this using wallet attestations. Waiting for others to chime in.<br>
<br>
### Many Editorial PRs <br>
<br>
These need one or two more reviews: 556, 567, 560, 564, 565, 566<br>
<br>
### Change to the client identifier scheme to be x509_hash: https://github.com/openid/oid4vc-haip/pull/178<br>
<br>
It enables client ids without DNS names. <br>
Stefan questions how to keep a stable client id with x509_hash? Joseph says WG is waiting for feedback from Mirko<br>
<br>
### Signed Issuer Metadata https://github.com/openid/oid4vc-haip/pull/176<br>
<br>
Adds signed metadata and uses x5c header. Almost have enough approvals<br>
<br>
## HAIP Issues:<br>
<br>
There is a lot of work as there are 49 issues tagged for 1.0 Final<br>
<br>
### Mandating HPKE https://github.com/openid/oid4vc-haip/issues/199 <br>
<br>
- Kenichi notifies that its an input into ISO WG 10 <br>
- Joseph notes that resolving the issue depends on the outcome of JOSE HPKE at IETF. The meeting is in 2 weeks, and if it progresses & is approved, then HAIP will reference the draft. Otherwise, WG will need to make its own decisions.<br>
<br>
### Using HAIP outside of Root of Trust scenario https://github.com/openid/oid4vc-haip/pull/178<br>
<br>
- Stefan raised this issue for the NZ use case. Every issuer would need to hand out a cert chain to a wallet, and the wallet decides whether to trust or not.<br>
- Joseph: In the EU, this is on a per-country basis, as there is a trust list per country. Wallets decide which countries are trusted.<br>
- Stefan: Questions the removal of web resolution from SD-JWT, which enables the usage of WebPKI. In NZ, the accreditation received is a trustmark only. Additionally, he is concerned that WebPKI is moving towards limiting certificates to a lifetime of 47 days,
meaning Credentials would only be valid for 47 days. <br>
- Joseph: If you are in a trustless system, requiring the certificate chain means that root certificate acceptance is also required. OpenID Federation could be an option, but it also needs a root for the trust chain. Agrees that (currently) HAIP tends to be
EU-focused and they need more feedback from non-EU ecosystems. Discusses the same issue that appeared in open banking implementations in multiple jurisdictions, and that, for example, Brazil introduced a directory service to function as the root cert issuer.
Can't see that working exactly the same in wallets. <br>
<br>
The conclusion is that the language doesn't prevent solutions outside of the profile, but that will lead to interop issues, and that this needs to be looked at further<br>
<br>
### Meaning of High Assurance https://github.com/openid/oid4vc-haip/issues/189<br>
<br>
- Stefan: Thinks its about having a minimum level of trust and security. Target audience/usage sections could be further clarified.<br>
- Joseph: Wants something more quantitative and properties. Unlinkability between verifiers, Device binding, "higher level of security". <br>
<br>
## Final Discussions:<br>
<br>
### The APAC meeting slot: <br>
Should it be every week or every fortnight? Became weekly due to conference season, but should it stay that way?<br>
Participants note that attendance is not high. Joseph had been hoping for more European participation.<br>
The attendees appreciate the slot<br>
Andres/Stefan suggest keeping it weekly until the HAIP draft is published so that significant PRs aren't missed completely<br>
<br>
### VCI Vote Clarification<br>
Veaceslav requested clarification on the upcoming dates for VCI. It's available on the website. Voting will be August 29 - September 12. <br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
</div>
</div>
</body>
</html>