<html aria-label="message body"><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi all<div><br></div><div>Draft 06 of HAIP 1.0 has now been published:</div><div><br></div><div><a href="https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0-06.html">https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0-06.html</a></div><div><br></div><div>The full change log is below; this version addresses comments received during the public review period. From the full change log, the changes that could (in my personal opinion) be considered normative are:</div><div><br></div><div><ul class="MailOutline"><li>requiring support for the multisig option in wallets (as per my email to the list earlier in the week)</li><li>the mention of the new fully specified cose alg identifier</li><li>the requirement for x5c in key attestations</li><li>new requirement around A256GCM</li></ul></div><div><br></div><div>As discussed on the 2 WG calls (APAC + EU) that happened in the last 24 hours, the editors/chairs have recommended the version currently under public review is updated to this version without restarting the public review period - and on the calls no one raised any comments, so this email serves as a 2 week notice of a formal vote on updating the version under public review, with the vote to happen during the DCP WG EU call on the 4th December.</div><div><br></div><div>The foundation-wide public review announcement will be updated today so that people are aware of the new version.</div><div><br></div><div>If anyone has any concerns please let the chairs know ASAP.</div><div><br></div><div>Many thanks</div><div><br></div><div>Joseph</div><div><br></div><div><br></div><div><br></div><div><br></div><div><p id="appendix-D-2" style="padding: 0px; margin: 0px 0px 1em; caret-color: rgb(34, 34, 34); color: rgb(34, 34, 34); font-family: "Noto Sans", Arial, Helvetica, sans-serif; font-size: 14px;">-06</p><ul class="compact" style="padding: 0px; margin: 0px 0px 1em 2em; line-height: normal; caret-color: rgb(34, 34, 34); color: rgb(34, 34, 34); font-family: "Noto Sans", Arial, Helvetica, sans-serif; font-size: 14px;"><li class="compact" id="appendix-D-3.1" style="margin: 0px 0px 0.25em;">updates to assumptions</li><li class="compact" id="appendix-D-3.2" style="margin: 0px 0px 0.25em;">add the multi-signed option to the DC API variants</li><li class="compact" id="appendix-D-3.3" style="margin: 0px 0px 0.25em;">add cose alg identifer -9 (fully specified)</li><li class="compact" id="appendix-D-3.4" style="margin: 0px 0px 0.25em;">clarify that DCQL applies in HAIP as defined in OpenID4VP and all REQUIRED and OPTIONAL requirements remain the same</li><li class="compact" id="appendix-D-3.5" style="margin: 0px 0px 0.25em;">add reference to ECCG Agreed Cryptographic Mechanisms 2.0</li><li class="compact" id="appendix-D-3.6" style="margin: 0px 0px 0.25em;">require x5c header in the OID4VCI Appendix D key attestation</li><li class="compact" id="appendix-D-3.7" style="margin: 0px 0px 0.25em;">require A256GCM and A128GCM for verifiers</li><li class="compact" id="appendix-D-3.8" style="margin: 0px 0px 0.25em;">add "Non-normative Examples of Ecosystem-specific Extensions of this Specification" section</li><li class="compact" id="appendix-D-3.9" style="margin: 0px 0px 0.25em;">remove EU ARF bullet from scenario section as that's already better explained in scope section</li><li class="compact" id="appendix-D-3.10" style="margin: 0px 0px 0.25em;">add additional acknowledgements</li><li class="compact" id="appendix-D-3.11" style="margin: 0px 0px 0.25em;">add reference to VP & VCI privacy considerations</li><li class="compact" id="appendix-D-3.12" style="margin: 0px 0px 0.25em;">improve wording about ephemeral encryption keys</li><li class="compact" id="appendix-D-3.13" style="margin: 0px 0px 0.25em;">clarify how combined issuance of SD-JWT and mdoc is supported</li><li class="compact" id="appendix-D-3.14" style="margin: 0px 0px 0.25em;">rename 'Cryto Suites' section to 'Requirements for Digital Signatures'</li><li class="compact" id="appendix-D-3.15" style="margin: 0px 0px 0.25em;">consistently use 'this specification' rather than 'document' or 'profile'</li><li class="compact" id="appendix-D-3.16" style="margin: 0px 0px 0.25em;">include links to the relevant sections in the ecosystems considerations section</li><li class="compact" id="appendix-D-3.17" style="margin: 0px 0px 0.25em;">clarify which requirements apply to wallet or verifier in W3C Digital Credentials API section</li><li class="compact" id="appendix-D-3.18" style="margin: 0px 0px 0.25em;">make 'Ecosystem' a defined term</li><li class="compact" id="appendix-D-3.19" style="margin: 0px 0px 0.25em;">clarify requirements for issuer-initiated / wallet-initiated issuance support</li><li class="compact" id="appendix-D-3.20" style="margin: 0px 0px 0.25em;">clarify that digital sig section applies to jwt proof type too</li><li class="compact" id="appendix-D-3.21" style="margin: 0px 0px 0.25em;">replace 'Annex' with 'Appendix' when referring to VCI/VP</li></ul></div></body></html>