<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div style="margin-top:6pt;">Dear all,</div>
<div style="margin-top:6pt;">Please find below the preliminary minutes of our call on April 17<font size="1"><span style="font-size:7.3pt;"><sup>th</sup></span></font> 2018. In any case of error or misunderstanding, please let me know.</div>
<div style="margin-top:6pt;"> </div>
<div><font color="#1F497D"><u>Proposed a</u><u>genda</u> :</font></div>
<ol style="margin:0;padding-left:18pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">Roll Call</li><li style="margin-top:5pt;margin-bottom:5pt;">Adoption of the Agenda [Bjorn/John]</li><li style="margin-top:5pt;margin-bottom:5pt;">External Updates</li></font>
</ol>
<ul style="margin:0;padding-left:36pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">IETF 101 [John]</li><li style="margin-top:5pt;margin-bottom:5pt;">OpenID Foundation Workshop [John]</li><li style="margin-top:5pt;margin-bottom:5pt;">IIW [John]</li></font>
</ul>
<ol start="4" style="margin:0;padding-left:18pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">Liaisons Updates</li></font>
</ol>
<ul style="margin:0;padding-left:36pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">GSMA [Siva]</li></font>
</ul>
<ol start="5" style="margin:0;padding-left:18pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">Working Group Updates</li></font>
</ol>
<ul style="margin:0;padding-left:36pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">FAPI WG [John/Dave]</li></font>
</ul>
<ol start="6" style="margin:0;padding-left:18pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">Issue Tracker</li></font>
</ol>
<ul style="margin:0;padding-left:36pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">CIBA [Gonzalo]</li><li style="margin-top:5pt;margin-bottom:5pt;">Authentication Profile [Joerg]</li><li style="margin-top:5pt;margin-bottom:5pt;">Other</li></font>
</ul>
<ol start="7" style="margin:0;padding-left:18pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">AOB</li></font>
</ol>
<div style="margin-top:6pt;"> </div>
<div style="margin-top:6pt;"><u>Discussion</u>:</div>
<ol style="margin:0;padding-left:18pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">Roll Call</li></font>
</ol>
<div style="margin-top:6pt;">Participants (Gotomeeting) : Bjorn Hjelm (Verizon),<font color="blue"><u> </u></font> John Bradley, Gonza, Petteri Stenius (Ubisecure), Philippe Clement (Orange), Siva(GSMA)IETF</div>
<ol start="2" style="margin:0;padding-left:18pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">Adoption of the Agenda [Bjorn/John]</li></font>
</ol>
<div style="margin-top:5pt;margin-bottom:5pt;">Adopted</div>
<ol start="3" style="margin:0;padding-left:18pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">External Updates</li></font>
</ol>
<ul style="margin:0;padding-left:36pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">IETF 101 [John]</li></font>
</ul>
<div style="margin-top:5pt;margin-bottom:5pt;">work in progress on proof of possession and device flow</div>
<ul style="margin:0;padding-left:36pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">OpenID Foundation Workshop [John]</li></font>
</ul>
<div style="margin-top:6pt;">discussions around Ciba, security concerns brought up by people, already known concerns. Was the main topic of conversation.</div>
<ul style="margin:0;padding-left:36pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">IIW [John]</li></font>
</ul>
<div style="margin-top:6pt;">Ciba discussions. Questioning on the real need to use Ciba with MNOs. Following conversations of John with banks: they already have ways to authenticate customers. Banks would prefer to redirect the user for authentication rather
than use Ciba through MNOs.</div>
<div style="margin-top:6pt;">Using Ciba between banks and the front app (TPP) could be envisioned, banks consider themselves as IdPs, what they are now. They can use or not MNOs (their choice).</div>
<div style="margin-top:6pt;">Banks can use additional biometrics in their app to strengthen Id proofing or authentication. Banks already use the smartphonre geoloc in their apps.</div>
<div style="margin-top:6pt;">Gonzalo: following discussions In Madrid with BBVA: banks have a risk engine.</div>
<div style="margin-top:6pt;">TC68, mutual TLS, token binding, proof of possession, IESG conf… banks have a look on this. </div>
<ol start="4" style="margin:0;padding-left:18pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">Liaisons Updates</li></font>
</ol>
<ul style="margin:0;padding-left:36pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">GSMA [Siva]</li></font>
</ul>
<div style="margin-top:6pt;">PSD2 analysis. Attribute sharing work on progress. PSD2 strong authentication is decoupled. From CPAS point of view, 2 types of authentication must be considered.</div>
<div style="margin-top:6pt;">User Questioning API still discussed. </div>
<div style="margin-top:6pt;">The question of technical changes required for User Questioning is set. There can be an impact on authenticators on SIM applets. Commercial discussions are ongoing.</div>
<ol start="5" style="margin:0;padding-left:18pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">Working Group Updates</li></font>
</ol>
<ul style="margin:0;padding-left:36pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">FAPI WG [John/Dave]</li></font>
</ul>
<div style="margin-top:6pt;">Topics to address: FAPI profile of CIBA, mutual TLS is under discussion. </div>
<ol start="6" style="margin:0;padding-left:18pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">Issue Tracker</li></font>
</ol>
<ul style="margin:0;padding-left:36pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">CIBA [Gonzalo]</li></font>
</ul>
<div style="margin-top:6pt;"><b>54</b>: Dave proposal accepted., Gonzalo added a reference about how to calculate the hash.</div>
<div style="margin-top:6pt;"><b>52</b>: token endpoint authentication: in case of polling mechanism, it is mandatory to register an URI. On the other hand, MTLS is mandatory to authenticate the endpoint.</div>
<div style="margin-top:6pt;">Attention to separate client authentication and proof of possession on resource server, these are different issues.</div>
<div style="margin-top:6pt;">Using MTLS can be sufficient instead of using signing things. Alternative is using the private key and signed JWT.</div>
<div style="margin-top:6pt;">John: having a JWT doesn’t prove anything. You have to sign something if you want to prove your possession on an object. Sending a JWT signed during the authentication request is probably enough.</div>
<div style="margin-top:6pt;">The 2 possibilities focus on these 2 approaches: Either send a signed request object or use MTLS. Using MTLS is possible on the 2 types of request (token request or authentication request), but recommendation is to stay coherent
on the 2 types of request.</div>
<div style="margin-top:6pt;">It is considered mandatory to use an authentication method that proves that you are the owner and you possess the things you send .</div>
<div style="margin-top:6pt;">Questions about the case where a redirection to the browser is triggered, in this case an alternative to MTLS must be used.</div>
<ul style="margin:0;padding-left:36pt;">
<li style="margin-top:6pt;">Gonza: send an email to the list about merging 2 commits and updated text.</li></ul>
<div style="margin-top:5pt;margin-bottom:5pt;"><font color="#1F497D"> </font></div>
<ul style="margin:0;padding-left:36pt;">
<font color="#1F497D">
<li style="margin-top:5pt;margin-bottom:5pt;">Authentication Profile [Joerg]</li></font>
</ul>
<div style="margin-top:5pt;margin-bottom:5pt;">Not addressed</div>
<div style="margin-top:5pt;margin-bottom:5pt;"> </div>
<div style="margin-top:5pt;margin-bottom:5pt;">Best regards,</div>
<div style="margin-top:5pt;margin-bottom:5pt;">Philippe</div>
<div style="margin-top:5pt;margin-bottom:5pt;"> </div>
</span></font>
<PRE>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</PRE></body>
</html>