<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div><div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Hi all,</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Below are the notes for today’s call.</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Best Regards,</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Christian</div></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">-------</div></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br></div><div>--- Attendees:</div><div><br></div><div>Christian Bormann</div><div>Kristina Yasuda</div><div>Gail Hodges</div><div>Torsten Lodderstedt</div><div>Andreea Prian</div><div>Bjorn Hjelm</div><div>Brian Campbell</div><div>Gareth Oliver</div><div>Hakan Yildiz</div><div>Jan Vereecken</div><div>Joe DeCock</div><div>Klaus Roehrle</div><div>Lukasz Jaromin</div><div>Michael Jones</div><div>Oliver Terbu</div><div>Peter Sorotokin</div><div>Ryan Galluzzo</div><div>Thomas Darimont</div><div>Valentine Mazurov</div><div><br></div><div>--- Events/Updates:</div><div><br></div><div>(re)introductions</div><div>Joe DeCock: Engineer and architect working for duende software, who are among others developing IdentityServer (.NET implementation)</div><div>Hakan Yildiz: Was on a call a few weeks ago, but got the IPR finalized now and can contribute.</div><div><br></div><div>OIDF Interop Event: Gail briefly explains the current results of the interop event. There are 2 Issues/PRs that will be raised as a result of the interop event - mainly clarifying comments. Preliminary results will be shared via mailing list.</div><div><br></div><div>IETF Updates: Kristina summarizes that the jose-hpke specification has made great progress in IETF 124 and we might be able to reference it sooner than expected. Mike explains that a path forward was found that everyone seems happy with and there is a draft PR being worked on to unblock the draft and get it towards working group last call. Draft PR can be found at https://github.com/ietf-wg-jose/draft-ietf-jose-hpke-encrypt/pull/84.</div><div><br></div><div>--- Issues/PRs:</div><div><br></div><div><a href="https://github.com/openid/OpenID4VC-HAIP/pull/338">https://github.com/openid/OpenID4VC-HAIP/pull/338</a>:</div><div><br></div><div>Kristina explains that we missed to clarify that x.509 certificates should be used to trust key attestations. This is a PR adding that to HAIP. This is in line with requiring X.509 certificate for trust in all other places. </div><div><br></div><div><a href="https://github.com/openid/OpenID4VC-HAIP/pull/335">https://github.com/openid/OpenID4VC-HAIP/pull/335</a>:</div><div><br></div><div>Kristina explains that we are bike-shedding on the concrete formulation, so please comment on the wording and review/approve.</div><div><br></div><div><a href="https://github.com/openid/OpenID4VC-HAIP/pull/333">https://github.com/openid/OpenID4VC-HAIP/pull/333</a>:</div><div><br></div><div>Kristina introduces the PR that this re-introduces non-normative examples what ecosystem profiles could look like.</div><div><br></div><div><a href="https://github.com/openid/OpenID4VC-HAIP/pull/332">https://github.com/openid/OpenID4VC-HAIP/pull/332</a>:</div><div><br></div><div>Kristina asks about the text currently stating "MUST NOT use any other mechanism" since verifiers might implement the redirect-based flow as a fallback.</div><div><br></div><div><a href="https://github.com/openid/OpenID4VC-HAIP/pull/327">https://github.com/openid/OpenID4VC-HAIP/pull/327</a>:</div><div><br></div><div>Kristina explains that we plan to add a reference to the agreed cryptographic mechanisms. Christian explains that there are 2 documents we could reference, one is a high-level document which mainly says to consider the European Agreed Cryptographic Mechanisms, the second one is the agreed mechanisms document. Agreement to use the second document that has concrete text on cryptographic mechanisms and key sizes.</div><div><br></div><div><a href="https://github.com/openid/OpenID4VC-HAIP/pull/313">https://github.com/openid/OpenID4VC-HAIP/pull/313</a>:</div><div><br></div><div>Kristina asks about the change proposal from Paul which recommends supporting issuer-initiated. Torsten asks if we need the first sentence in the PR which states that ecosystems need to define support for issuer-initiated or wallet-initiated issuance. Kristina and Gareth respond that you would need to understand the custom scheme and possibly be able to prase a QR code to support issuer-initiated flows. This currently not mandatory to support. Christian states that from his understanding we didn't reach a consensus on a mandatory to implement mechanism and we should at least be explicit in stating that ecosystems likely want to make a decision here.</div><div>Torsten questions whether we need that much text and votes to just say if issuer-initiated flows are supported, credential offer must be supported.</div><div><br></div><div>Kristina asks for reviews and comments on the open PRs, especially the ones that still see more discussion like 313.</div><div><br></div><div>---</div><div>Short discussions on HAIP:</div><div>---</div><div>Hakan asks about DCQL requirement and there is some discussion about optional features. Agreement is that DCQL features marked as optional should be understood as additional signals, but support from the Wallet cannot be expected. That means from a HAIP compliance perspective, the Wallet does not have to support those features.</div><div>---</div><div>Christian asks for COSE identifiers in HAIP - OpenID4VP allows both, -7, and -9 and HAIP currently only talks about -7. Discussion between Oliver, Kristina, Peter, Michael, and Christian results in the creation of an Issue to also allow/mention -9 for HAIP.</div><div><br></div><div><a href="https://github.com/openid/OpenID4VC-HAIP/issues/334">https://github.com/openid/OpenID4VC-HAIP/issues/334</a>:</div><div><br></div><div>Requirements for JWK in attested_keys are not fully clear. Some discussion ensues about requirements regarding kid, etc. There seems to be some agreement that requiring kid in the attested_keys might make sense to make matching easier. </div><div><br></div><div><a href="https://github.com/openid/OpenID4VCI/issues/668">https://github.com/openid/OpenID4VCI/issues/668</a>:</div><div><br></div><div>Chairs are considering to start a focus group for Server to Server flows to make progress on the initial concepts and then bring it back to the normal working group calls.</div><div>Jan has some clarifying questions regarding these flows, especially on better understanding the mental model that went into them. Gareth asks to make comments and clarifying questions in the issue/document to make sure we capture it for everyone.</div><div><br></div></body></html>