<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Hi Folks,</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Below are the minutes from today's meeting.</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">##
<b>Attendees</b></div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Rajvardhan Deshmukh</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Kristina Yasuda</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Joseph Heenan</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Oliver Terbu</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Tobias</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Ryan Galluzzo</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Christian Bormann</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Brian</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Gareth</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Gail Hodges</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Tim Cappalli</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">##
<b>Announcements and general updates</b>:</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">https://www.eventbrite.co.uk/e/oidf-dcp-wg-mtg-prior-to-iiw-mon-20-oct-2025-cisco-san-jose-ca-tickets-1661413736209?aff=oddtdtcreator</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Need help with the Friday venue.</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Please vote on VCI if you haven’t yet & are an OIDF member - we didn’t reach quorum yet: https://openid.net/foundation/members/polls/376 https://openid.net/notice-of-vote-openid-for-verifiable-credential-issuance-1-0-final-specification/
Deadline Sep 15th</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Western Balkan states (Albania, Bosnia and H, Kosovo, Montenegro, North Macedonia, Serbia) are working towards full participation in EUDIW by Dec 2027.</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">OIDF is looking at options to support this sub-region, do any WG members have personal or professional expertise in this region? If so let Gail know gail@oidf.org</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">##
<b>Discussions</b>:</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">https://github.com/openid/OpenID4VCI/pull/648 will merge as part of the preparation for the final 1.0 publication, given more than 3 approvals</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">https://github.com/openid/OpenID4VCI/pull/649 will merge as part of the preparation for the final 1.0 publication, given more than 3 approvals</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">https://github.com/openid/OpenID4VC-HAIP/issues/240</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">Oliver and Tobias raised security consideration about using custom url schemes, as malicious applications can claim to support that custom url scheme. This is applicable for VCI
and VP.</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">wg discussion:</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">- For both VP and VCI (Credential Offer), define separate custom url scheme value that stands for compliance to the requirements in HAIP. Whether support for that scheme is mandatory
or not is up to the ecosystem/etc. claimed urls are a (recommended) alternative. And maybe point to the security concerns of custom schemes that are already documented in other places.</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">https://github.com/openid/OpenID4VC-HAIP/issues/233 define intent_to_retain only for mdoc in haip so that iso can point to it and ISO don't have to have a separate discussion about
it.</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">wg discussion:</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">- will clarify with ISO what is their understanding of the "agreement"</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">- one option might be to have an mDL specific annex in haip where intent_to_retain in mandated? or mandate it only for mdocs?</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">https://github.com/openid/OpenID4VC-HAIP/issues/239</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">wg discussion:</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">- conditional to wg agreeing to use custom schemes for credential offer and presentation, it is reasonable to separate values used for issuance and presentation. haip-vp:// and
haip-vci:// or something? (feel free to suggest alternatives)</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">https://github.com/openid/OpenID4VC-HAIP/issues/193</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">there is no such things as "haip compliant", but there is such a thing that compliant to one or more of the flows (VP without dc api, VP with dc api, or VCI) with one of the credential
formats (sd-jwt vc or mdoc) defined in HAIP. Suggestions have been listed in the issue comments.</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">https://github.com/openid/OpenID4VC-HAIP/issues/112</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">wg discussion:</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">- in cases where there are existing requirements on crypto suites (like ISO 18013-5) mandating specific set of signing curves, probably worth adding a sentence that allows/encourages
compliance with those on top of what HAIP requires.</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">- also. in cases where there are existing requirements on MACing the credential on top of digital signatures (like ISO 18013-5), probably worth adding a sentence that allows/encourages
compliance with those on top of what HAIP requires.</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">- on top of a general statement on the ecosystems defining their crypto requirements, have an annex or something that gives specific examples like 18013-5. new issue will be opened
on this</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">https://github.com/openid/OpenID4VC-HAIP/pull/252 The X.509 certificate of the trust anchor MUST NOT be included in the x5c JOSE header of the signed request. has already been in
the spec before but got lost. Oliver might create another PR to just get this specific part in as it was approved in the past.</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Raj</div>
</body>
</html>