<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title></title>
</head>
<body>
<div name="messageBodySection">
<div dir="auto"><span style="font-family:Helvetica Neue;font-size: 13px">Hi all</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Here are notes from the APAC call</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">1. HAIP Public Review</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">WG last call passed via email</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Public review scheduled to conclude Dec 8</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Voting Dec 9-23 & published around Christmas</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">2. WG Cadence reduction </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Probably cancelling Tuesday and keeping APAC/EU & US/EU calls. Need to figure out a better timeslot for the APAC/EU. </span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">3. WG Priorities</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">IETF meeting in Montreal covering HPKE spec, which hopefully can cover DCP use cases. </span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">4. HAIP PRs</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#327 On links to recommended key size advice</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#313 Clarify requirements on support for issuer-initiated and wallet-initiated issuance</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">5. HAIP 1.0 Issues</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#318 To retain the term "ecosystem" or switch it?</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#319 Clearly state targets of statements in spec are "wallets" or "verifiers"</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#319 Which enc should be mandated? </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">S: It may be best to align with Annex B. Though ISO Annex C mandates AES128. Multiple countries approved differences in the ISO spec. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">M: Arguably, around 256 is better than 128. No one ever argues that the smaller variants aren't secure. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">S: School system assessment in Aus & NZ - to meet the requirement, the system needs to use AES192 as a minimum, and AES256 is recommended for transport. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">M: That mandates using TLS 1.3. </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">S: The requirement around TLS is 1.2 or greater, and P-384 is also required.</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">J: Need a good reason to change anything in the HAIP spec, as it would be a breaking change.</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Someone mentioned that maybe best to add optional combinations for AES192/AES256 & P-384 to let ecosystems decide</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">6. VCI 1.0 Issues: </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#676 Key attestation is in the proof header, but should include the c_nonce. Suggestions to fix it by permitting the reuse of the key attestation.</span></div>
<ul>
<li style="font-size: 13px"><span style="font-family:Helvetica Neue;font-size: 13px">errata to set nonce to be server-provided c_nonce</span></li><li style="font-size: 13px"><span style="font-family:Helvetica Neue;font-size: 13px">Add VCI different proof type </span></li><li style="font-size: 13px"><span style="font-family:Helvetica Neue;font-size: 13px">different proof type in HAIP 1.0</span></li></ul>
<div dir="auto"><span style="font-family:Helvetica Neue;font-size: 13px">M: mention that pre-generation is a good reason to deviate from the spec. clarify if/how c_nonce in the key attestation is a security feature. Also pointed out that there would be a knock-on
effect in HAIP</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">S: errata to permit reuse </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">J: That would be tricky since it may already be implemented and in law.</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">7. VCI 1.1 Issues: </span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Initial IAE PRs have been merged</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">#602 Tidies up the text and completes renaming to IAE + Adds format-specific guidance. Origin vs URL binding is separated. Some of this may be moved into OpenID4VP. Needs reviews</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">8. Publication Planning</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">After IAE is in, then probably WG will do an Implementors Draft and have Stuttgart do a formal security analysis before the final version. HAIP 1.0 may be in scope of that analysis.</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">Discussed if VCI 1.1 may require HAIP 1.1</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-size: 13px"><br>
</span><span style="font-family:Helvetica Neue;font-size: 13px">cheers,</span></div>
</div>
<div name="messageSignatureSection"><br>
<div dir="auto"><font color="">Andres Olave</font></div>
<div dir="auto">
<div dir="auto">
<div dir="auto">
<div dir="auto">
<div dir="auto">
<p class="MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span lang="EN-US" xml:lang="EN-US" style="font-size: 10.5pt; color: blue; text-decoration: none;"></span></p>
<p class="MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<br>
</p>
<p class="MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="color: rgb(32, 31, 30);"></span></p>
</div>
<div dir="auto">
<div class="WordSection1" style="page: WordSection1; caret-color: rgb(255, 255, 255); color: rgb(255, 255, 255); font-family: sans-serif; background-color: rgb(38, 38, 38);" dir="auto">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>