<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><meta http-equiv="content-type" content="text/html; charset=utf-8"><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><meta http-equiv="content-type" content="text/html; charset=us-ascii"><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><meta http-equiv="content-type" content="text/html; charset=us-ascii"><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>Hi all</div><div><br></div><div>Draft 05 of HAIP has been published:</div><div><br></div><div><a href="https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0-05.html">https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0-05.html</a></div><div><br></div><div>As per the discussion on today’s WG call, this is the version we have sent to the OIDF Secretary team to go for public review and then voting (foundation members will get a separate notification about that from the secretary soon hopefully).</div><div><br></div><div>Change log is:</div><div><br></div><div><ul class="compact" style="padding: 0px; margin: 0px 0px 1em 2em; line-height: normal; caret-color: rgb(34, 34, 34); color: rgb(34, 34, 34); font-family: "Noto Sans", Arial, Helvetica, sans-serif; font-size: 14px;"><li class="compact" id="appendix-D-3.1" style="margin: 0px 0px 0.25em;">mandate support for same device flow for redirect-based OpenID4VP</li><li class="compact" id="appendix-D-3.2" style="margin: 0px 0px 0.25em;">add ecosystem guidance section</li><li class="compact" id="appendix-D-3.3" style="margin: 0px 0px 0.25em;">change wallet attestation format from mandatory to recommended</li><li class="compact" id="appendix-D-3.4" style="margin: 0px 0px 0.25em;">update crypto suites to require at least ECDSA w/ P-256 and SHA-256 for verifying signed artificats; and made ecosystem-specific exceptions for crypto suites and hash algorithms if certain criteria is not met</li><li class="compact" id="appendix-D-3.5" style="margin: 0px 0px 0.25em;">removed intent_to_retain mandatory</li><li class="compact" id="appendix-D-3.6" style="margin: 0px 0px 0.25em;">add small note about signed requests</li><li class="compact" id="appendix-D-3.7" style="margin: 0px 0px 0.25em;">clarify batch issuance requirements</li><li class="compact" id="appendix-D-3.8" style="margin: 0px 0px 0.25em;">remove text about <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">iat</code> and <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">exp</code> in JWT claims</li><li class="compact" id="appendix-D-3.9" style="margin: 0px 0px 0.25em;">resolve contradictory text about key attestation support requirements</li><li class="compact" id="appendix-D-3.10" style="margin: 0px 0px 0.25em;">add "Requirements Notation and Conventions" section</li><li class="compact" id="appendix-D-3.11" style="margin: 0px 0px 0.25em;">remove requirement that SD-JWT <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">iss</code> is a https url</li><li class="compact" id="appendix-D-3.12" style="margin: 0px 0px 0.25em;">add section about the OIDF conformance tests</li><li class="compact" id="appendix-D-3.13" style="margin: 0px 0px 0.25em;">add implementation considers around browser/OS limitations</li><li class="compact" id="appendix-D-3.14" style="margin: 0px 0px 0.25em;">combine text about ecosystem profiling of X.509 certifications</li><li class="compact" id="appendix-D-3.15" style="margin: 0px 0px 0.25em;">add guidance around key sizes</li><li class="compact" id="appendix-D-3.16" style="margin: 0px 0px 0.25em;">require wallets (that render images from credential metadata) to support png and svg, and data: and https: urls</li><li class="compact" id="appendix-D-3.17" style="margin: 0px 0px 0.25em;">clarity text around flows that are defined in this specification</li><li class="compact" id="appendix-D-3.18" style="margin: 0px 0px 0.25em;">add requirement on status list index uniqueness</li><li class="compact" id="appendix-D-3.19" style="margin: 0px 0px 0.25em;">add recommendation that SD-JWT VC validity period is limited then it must use <code style="background-color: rgb(248, 248, 248); font-family: var(--font-mono); font-size: 13.3px;">exp</code> or a token status list</li><li class="compact" id="appendix-D-3.20" style="margin: 0px 0px 0.25em;">explain intent of 'high assurance' in document title</li><li class="compact" id="appendix-D-3.21" style="margin: 0px 0px 0.25em;">require compliance with (most of) FAPI2 Security Profile for VCI</li><li class="compact" id="appendix-D-3.22" style="margin: 0px 0px 0.25em;">add requirement that, if implementing mdoc revocation, one of methods defined in 2nd edition draft of ISO 18013-5 must be used</li><li class="compact" id="appendix-D-3.23" style="margin: 0px 0px 0.25em;">update editors/contributors</li></ul><br class="Apple-interchange-newline" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"></div><div><br></div><div>Thanks</div><div><br></div><div>Joseph</div><div><br></div></div></div></div></body></html>