<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title></title>
</head>
<body>
<div name="messageBodySection">
<div dir="auto"><span style="font-family:Helvetica Neue;font-size: 13px">Apologies for the delay in sharing the notes</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Attendees:</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">--------------------</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Joseph Heenan</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Daniel Florescu</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Hiroyuki Sano</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Martijn Haring</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Nat Skimura</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Oliver Terbu</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Stefan Charsley</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Kenichi Nakamura</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Events</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">--------------------</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">OpenId4VCI is under public review. IAR has been added. Voting will start soon. </span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">General Updates</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">--------------------</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">HAIP has moved repo</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Maritijn: How much time till the PRs are in? Joseph: Aim is for them to be 1 week of stability</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">OID4VCI PRS</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">--------------------</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#605</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Nat: Advisable NOT to use capitalization to indicate normative language due to not all languages having capitalization like ISO</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#603</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Link to security analysis. Looking for 3 approvals to get non-normative changes in.</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#602</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">how to bind the IAE added for sd-jwts. needs to be added for other formats. Binding methods are during a the presentation. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Doesnt change anything normatively to SD-JWT, adds stuff for presentations of mdoc (via the mdoc) and w3c credential formats</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#601</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Adds more realism for wallet attestations for OAuth client auth</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#600</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Adds example for metadata wth IAE support</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#599</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">More editorial changes for IAE</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#596 </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Clarify use of scope and authorization details. If scope is absent then you must use authorization details.</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#594 </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">time-related information needs to be sanitized</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#589 </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Adds redirect_to_web to IAE. The normal thing where the website can ask the user questions. After the user completes it, the issuer can ask to go to IAE again. Discussion on whether to put into
1.0 or not. If the PR is ready it will be good to put it in. Normally an authoirzation `code` is returned but the non-traditional roles are a bit necessary. Normally the AS would return a code and the wallet would excahnge for access tokne. Currently the auth_session_id
is returned. it seems better that would be a new value, so that its not predictable and mirrors how the auth code works in existing OAuth flows which matches existing security analysis. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Oliver: Doesnt PKCE sort that out. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Joseph: Need to see if security analysis around it. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Stephan: Auth session parameter could be fresh.</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Oliver: Has a "feeling" that after wallets sends openid4vp, the iae could return another interaction. In those cases you'd need to generate a new auth session. And then added to specific interaction
request. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Joseph: Concerned about use of stale session values</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Stephan: If the auth session value differs then the IAE should be aborted. There is inconsistency and will raise an issue</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#583</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Merge the credential endpoint definitions. Stephan and Andres will take a look</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">OID4VCI Issues</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">--------------------</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">IAR Endpoint</span></div>
<ul>
<li style="font-size: 13px"><span style="font-family:Helvetica Neue;font-size: 13px">Security mixup attack that can be returned</span></li><li style="font-size: 13px"><span style="font-family:Helvetica Neue;font-size: 13px">Client auth required on IAR endpoint</span></li></ul>
<div dir="auto"><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Appendix E discussion</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">The wallet attestation text is not clear enough for the client to understand. A key that MUST be trusted by an issuer. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">For a server-based model, then this is ok, but for people wanting wallet applications on phones/watches. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Martijn: For HAIP client auth is profiled and required. then the above issue is a problem.</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Nat: should be fixed in VCI, attestations, then says nothing about the application. since its server based wallets.</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Stephan: Not sure it needs to be specified at all, and leave it to the ecosystem. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Joseph: An OAuth client should not choose its own one. We don't have a client_id schema mechanism, so you could end up with two wallets choosing the same thing. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Who can pick the client_id? It seems to assume the client_ids are prechosen. The issuer AS issues client_ids. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Stephan: Trust should be in the ecosystem</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Joseph: Wallets use the same client_id, but use their own keys, and my backend deals with it. HAIP says to use an X5C, which means that each issuer needs to recognise them.</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">This is only a problem if its mandated in HAIP. Sounds like an interop problem. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Martijn doesnt think its a huge issue probably needs to be adding details and then its a general structure.</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">HAIP PRs</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Need more approvals on "needs-reviews" tags</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">HAIP Issues</span><span style="font-size: 13px"><br>
</span></div>
</div>
<div name="messageSignatureSection"><br>
<div dir="auto"><font color=""><b>Andres Olave</b></font><font color=""><br>
</font><font color="">CTO</font><font color=""><br>
</font><font color="">Velocity Career Labs</font><br>
</div>
<div dir="auto"><font color=""><br>
</font></div>
<div dir="auto"><img src="cid:E6EF1F368B864767BD6EBB01D04A3E92"></div>
<font color=""><b>Building the Internet of Careers</b>™</font><font color=""><br>
</font><font color="#D5DADE"><a href="http://www.velocitynetwork.foundation/">velocitynetwork.foundation</a>|<a href="http://www.velocitycareerlabs.com/">velocitycareerlabs.com</a></font><font color="#000000"></font><font color=""><br>
</font><b>M</b>+61 436 350390|<a href="mailto:dror.gurevich@velocitycareerlabs.com">andres.olave@velocitycareerlabs.com</a><font color="#0000FF"></font><font color=""><br>
</font>(GMT+11) Monday - Friday
<div dir="auto">
<div dir="auto"><br>
</div>
<div dir="auto">
<div dir="auto">
<div dir="auto">
<div dir="auto">
<p class="MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<b><span lang="EN-US" xml:lang="EN-US" style="font-size: 10.5pt; color: rgb(32, 31, 30);">Download the Velocity Career Wallet App:</span></b><span style="color: rgb(32, 31, 30);"></span></p>
<p class="MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<b><span lang="EN-US" xml:lang="EN-US" style="font-size: 10.5pt; color: rgb(32, 31, 30);"><br>
</span></b></p>
<p class="MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="color: black;"><span lang="EN-US" xml:lang="EN-US" style="color: blue; font-size: 10.5pt; text-decoration: none;"><a href="https://apps.apple.com/us/app/velocity-career-wallet/id1587589679" style="color: blue;"><img border="0" width="209" height="64" id="Picture_x0020_7" src="cid:28F55E464CE74069B80A5B54FB3F2116" alt="Graphical user interface Description automatically generated with medium confidence" style="width: 2.175in; height: 0.6666in;"></a> </span></span><span lang="EN-US" xml:lang="EN-US" style="font-size: 10.5pt; color: blue; text-decoration: none;"><a href="https://play.google.com/store/apps/details?id=io.velocitycareerlabs.holderapp" style="font-size: 11pt; color: blue;"><img border="0" width="208" height="64" id="Picture_x0020_8" src="cid:65CB4C35C5DD45A5A67119ADD7DDB9F1" alt="A picture containing text Description automatically generated" style="width: 2.1666in; height: 0.6666in;"></a></span></p>
<p class="MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<br>
</p>
<p class="MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="color: rgb(32, 31, 30);"></span></p>
</div>
<div dir="auto">
<div class="WordSection1" style="page: WordSection1; caret-color: rgb(255, 255, 255); color: rgb(255, 255, 255); font-family: sans-serif; background-color: rgb(38, 38, 38);" dir="auto">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>