19:58:52 RRSAgent has joined #vcwg 19:58:56 logging to https://www.w3.org/2023/02/01-vcwg-irc 19:59:04 meeting: VCWG Weekly Teleconference 19:59:19 chair: Kristina Yasuda 19:59:29 zakim, start the meeting 19:59:29 RRSAgent, make logs Public 19:59:31 please title this meeting ("meeting: ..."), brentz 19:59:34 meeting: VCWG Weekly Teleconference 19:59:36 chair: Kristina Yasuda 19:59:40 present+ 20:00:46 DavidC has joined #vcwg 20:00:52 present+ 20:00:57 present+ 20:01:05 Phil has joined #vcwg 20:01:13 present+ 20:01:17 mkhraisha has joined #vcwg 20:01:45 KevinDeanGS1 has joined #vcwg 20:01:48 present+ 20:01:52 present+ 20:01:54 Kerri_Lemoie has joined #vcwg 20:01:57 present+ 20:02:14 dmitriz has joined #vcwg 20:02:19 present+ 20:02:23 Phil_ASU has joined #vcwg 20:02:29 ToddSnyder has joined #vcwg 20:02:33 present+ 20:02:35 present+ 20:02:40 markus_sabadello has joined #vcwg 20:03:12 JoeAndrieu has joined #vcwg 20:03:18 present+ 20:03:29 present+ 20:03:50 present+ 20:04:10 present+ 20:05:12 scribe: markus_sabadello 20:06:07 kristina: Agenda today is updates on F2F, then EdDSA crypto suite for Data Integrity, then usual issues 20:06:21 kristina: F2F is happening in 2 weeks, location is unchanged 20:06:43 kristina: Microsoft location in Miami 20:07:07 present+ 20:07:21 decentralgabe has joined #vcwg 20:07:24 present+ 20:07:26 Attendance sheet: https://docs.google.com/spreadsheets/d/1IguLcaIn8vAo-XDwYXbJTfY2c5SAjA9rgDjo057kKlc/edit#gid=179611341 20:07:34 kristina: We will have a hybrid setup. If you intend to come in person, please fill in the sheet. We have limited capacity 20:07:49 q+ 20:07:58 kristina: I will send out the registration, just show up and you get the badge. You have to do it every single day. 20:08:04 present+ 20:08:21 kristina: For the Wednesday activity, we are planning something like a boat tour 20:08:31 kristina: I hope all can come and socialize 20:08:52 kristina: For the actual agenda, can we go through it? 20:08:58 brentz: Yes but it may not yet be cleaned up yet 20:09:15 kristina: Day 1 we're planning to talk about the media type conversation 20:09:33 kristina: Then holder binding conversation with Oliver, he has been working on a proposal 20:09:39 kristina: Then we talk about extensibility mechanisms 20:09:45 kristina: Evidence, status list, etc. 20:10:11 kristina: Finishing the day with terminology related issues, we're surprised how many there are. We need to clarify and answer questions. 20:10:19 kristina: (that's Day 1) 20:10:30 dwaite has joined #vcwg 20:10:37 present+ 20:11:06 kristina: Second Day: Data Integrity, and VC-JWT 20:11:12 andres has joined #vcwg 20:11:29 brentz: I believe current plan is 1 hour or so after lunch to continue the VC-JWT conversation, possibly issue triaging 20:11:34 brentz: Then activity after that 20:11:53 kristina: If we have time, we'd like to talk about vc-jws-2020, status list, use case document, and implementation guidelines document 20:12:11 kristina: At the end of the day, we want to talk about what deliverables we can achieve by the end of the charter period. 20:12:45 kristina: We hear that some things that can't be agreed on are put into Implementation Guidelines, we need to clean that up 20:12:52 kristina: Day 3: Talk about making @context optional 20:13:16 kristina: After that, session where we share industry news 20:13:41 kristina: Then we'd like to do issue triaging 20:13:53 kristina: Coming to the end of day 3, we want a clear understanding of what deliverables are realistic 20:14:06 brentz: I'd only add that there are other folks who reached out regarding sponsoring. 20:14:18 kristina has joined #vcwg 20:14:19 present+ 20:14:27 brentz: If anyone is willing to sponsor, e.g. the activity we're planning, reach out to chairs. Also for snacks. 20:14:47 smccown__ has joined #vcwg 20:14:49 present+ 20:14:50 q? 20:14:59 ack brentz 20:14:59 present+ 20:15:20 q+ to provide some background 20:15:23 kristina: Moving on to EdDsa cryptosuite for Data Integrity 20:15:50 kristina: We have a process for pulling in new items to the WG 20:16:03 socialization email: https://lists.w3.org/Archives/Public/public-vc-wg/2023Jan/0027.html 20:16:05 kristina: Socialize it.. Has been fulfilled, more than 3 independent companies are interested. 20:16:12 kristina: Chairs believe it is in scope for the WG. 20:16:34 kristina: Remaining criteria to include it in the WG is whether there is rough consensus to adopt this as work item. 20:16:52 kristina: In this call, open up the floor to see if there is rough consensus. Chairs will determine if there is such rough consensus. 20:17:08 q+ 20:17:10 q+ Orie to note that there might be less overlap with JSON Web Signature in the future 20:17:11 kristina: If the questions are long, we might decide to move it to a Special Topic Call. 20:17:16 ack manu 20:17:16 manu, you wanted to provide some background 20:17:17 q- 20:17:44 manu: To provide some background about the letter that went out. A number of the implementers got together and wrote a letter of support, this includes 19 companies. 20:17:58 manu: A number of them are W3C members, but also significant number outside of W3C that have implemented this. 20:18:27 manu: The EdDSA cryptosuite is implemented for TruAge age verifications system, nation-wide, will go in production this year across the US. 20:18:46 q? 20:19:00 manu: Another interesting use is in the education sector, this was used to demonstrate interop at the Jobs for the Future (JFF) plugfest. 20:19:23 manu: And a number of people who didn't have time to get signatures, there are more than that. We see heavy usage for this cryptosuite. 20:19:31 kristina: Thank you for the context manu 20:19:31 ack Orie 20:19:31 Orie, you wanted to note that there might be less overlap with JSON Web Signature in the future 20:19:58 Orie: There has been some back and forth about JsonWebSignature2020 and the canonicalization component of it, which is a major overlap with this work. 20:20:18 Orie: Markus left some good feedback on the list whether there should be canonicalization, or should there be a proof suite without canonicalization 20:20:39 Orie: Eventually JsonWebSignature2020 might not look so similar to Ed25519Signature2020. 20:20:51 Orie: I think they are different 20:21:22 Orie: RDF Canonicalization from RCH WG is embedded. I proposed that JsonWebSignature2020 move away from it, due to performance issues with really large documents. 20:21:38 Orie: If you sign really large documents (e.g. in supply chain), it takes a long time to canonicalize it. 20:22:02 Orie: My hope is that JsonWebSIgnature2020 move away from this, so that it becomes a different approach with different performance characteristics. 20:22:16 Orie: Last time we discussed this, there were concerns that they are similar. 20:22:24 Orie: Discussion on the mailing list has been light 20:22:41 q+ 20:22:53 Orie: I don't think there has been commentary on the Ed25519Signature2020 post on the mailing list. I would like the proof suites to have unique value. 20:23:18 q+ 20:23:18 ack smccown__ 20:23:31 smccown__: Question for everybody about the cryptosuite, particularly Orie 20:23:55 smccown__: 1. If we move away from Ed25519, do you have a proposed signature scheme to use instead, e.g. Schnorr? 20:23:58 q- 20:24:07 q+ orie 20:24:11 ack orie 20:24:33 q+ to speak to the Schnorr signature stuff. 20:24:52 Orie: JsonWebSignature2020 in its current format uses IANA registry for algorithms, e.g. for RSA, Ed25519, P-256, etc. curves. JsonWebSignature2020 supports all of those 20:24:53 q+ 20:25:08 Orie: As far as I'm aware there haven't been registrations for Schnorr algorithms 20:25:36 Orie: This could be registered with IANA properly. There are suites that support more than Ed25519 20:25:38 ack manu 20:25:38 manu, you wanted to speak to the Schnorr signature stuff. 20:26:04 manu: Regarding Schnorr, we've been talking about doing variations of this in Data Integrity, as Orie mentions there have been experiments 20:26:32 manu: There could be another cryptosuite in the future that could be specifically focused on Schnorr signatures, there was input about this by Christopher Allen. 20:26:52 scribe+ 20:26:54 ack markus_sabadello 20:27:48 markus: Two things sinc eOrie mentioned my comment on the mailing list regarding JSONWebSignature2020 and canonicalization -- my proposal was to use VC-JWS proposal, where VC could be payload of JWS, that seemed a bit cleaner than changing mechanism and canonicalization of JsonWebSignature2020. 20:28:26 markus: 2nd comment, just want to express support for EdDSA Cryptosuite as work item, as manu said, it's very valuable, it uses canonicalization mechanism from RCH WG, and important to have these cryptosuites because they sign the canonicalized graph. 20:28:46 markus: a lot of these discussions are around "do you want to sign the JSON document" or "do you want to sign the underlying RDF dataset?" 20:28:55 q? 20:28:57 markus: I support adding this as a work item. 20:29:22 +1 for supporting EdSA as well. 20:29:25 kristina: There seem to be no objections here on this call. 20:29:36 kristina: I think we do have rough consensus for now. 20:29:54 brentz: Ideally we'd have a proposal 20:29:56 from Orie: Regarding performance issues, https://or13.github.io/decanonicalization/ 20:30:07 brentz: Any proposed changes to the proposal? 20:30:31 PROPOSAL: The WG will adopt the EdDSA Cryptosuite (https://w3c-ccg.github.io/di-eddsa-2020/) as a recommendation track editors draft under the shortname vc-di-eddsa. 20:30:38 +1 20:30:42 +1 20:30:43 +1 20:30:44 +1 20:30:47 +1 20:30:48 +1 20:30:49 +1 20:30:49 +1 20:30:53 +1 20:31:12 +1 20:31:16 +1 for adopting the EdDSA Cryptosuite (https://w3c-ccg.github.io/di-eddsa-2020/) as a recommendation track editors draft under the shortname vc-di-eddsa. 20:31:17 +1 20:31:19 brian: +1 20:31:26 +1 20:31:38 RESOLVED: The WG will adopt the EdDSA Cryptosuite (https://w3c-ccg.github.io/di-eddsa-2020/) as a recommendation track editors draft under the shortname vc-di-eddsa. 20:31:55 Orie: For folks who asked about schnorr https://github.com/decentralized-identity/SchnorrSecp256k1Signature2019 20:31:58 +1 20:31:59 kristina: Editors and chairs and Ivan will work on setting up the repo. 20:32:26 +1 20:32:39 q+ for updates on prs 20:32:41 kristina: Let's go to work item status updates no.. Any updates from anyone about work items? 20:32:42 q+ 20:32:55 s/no// 20:33:16 Topic: Work Item Status Updates 20:33:19 ack manu 20:33:19 manu, you wanted to discuss updates on prs 20:33:24 kristina: We need people working on documents to make sure they are in good shape for publications. Any help would be appreciated. 20:33:31 subtopic: https://github.com/w3c/vc-data-model/pull/987 20:33:57 manu: Add presentationSchema. Good discussion going in this PR, it would be good for other people to weigh in. David and I have some level of agreement on what's meant by this PR. 20:34:14 manu: I think Orie is right that we need to have a working group discussion so everybody understands what we are doing here. 20:34:21 manu: Wanted to make sure WG is aware. 20:34:25 q- 20:34:35 manu: Request to the chairs to schedule some discussion time for this. 20:35:02 subtopic: https://github.com/w3c/vc-data-model/pull/999 20:35:10 manu: PR 999 to remove ZKP section, there is another PR in the works that is more modern, we're waiting for that to be submitted, then we will look at both PRs side by side to determine which one we want to take. 20:35:13 subtopic: https://github.com/w3c/vc-data-model/pull/1014 20:35:57 manu: PR 1014 about media types. We're trying to figure out details regarding the media types, how many we're going to have, etc. This PR is about a very specific media type, and about whether you can include a proof in it, if it can be ignored, etc. Please jump in if you have opinions on media types. 20:36:03 subtopic: https://github.com/w3c/vc-data-model/pull/1022 20:36:34 manu: PR 1022 this one was put in by Juan which fixes some editorial issues that were just wrong. Also updated an image. This one looks really good, but would be good to have more reviewers. 20:36:36 subtopic: https://github.com/w3c/vc-data-model/pull/1023 20:37:11 manu: New one PR 1023 from yesterday, about credential schemas. This PR says you can have only one credential schema, and then there's some clarifying language. Please jump in if you have opinions on credential schema. 20:37:15 q? 20:37:16 manu: This is all about VC data model. 20:37:30 zakim, who is here? 20:37:30 Present: brentz, DavidC, shigeya, Phil, KevinDeanGS, cabernet, Kerri_Lemoie, dmitriz, Phil_ASU, mkhraisha, JoeAndrieu, ToddSnyder, manu, markus_sabadello, dlongley, decentralgabe, 20:37:35 https://github.com/w3c/vc-status-list-2021/pulls 20:37:35 ... dlehn, dwaite, kristina, TallTed, smccown__ 20:37:35 On IRC I see smccown__, kristina, andres, dwaite, decentralgabe, JoeAndrieu, markus_sabadello, ToddSnyder, Phil_ASU, dmitriz, Kerri_Lemoie, KevinDeanGS1, mkhraisha, DavidC, 20:37:35 ... RRSAgent, Zakim, cabernet, brentz, gkellogg, TallTed, tzviya, shigeya, Jem, dlehn, ounfacdo, dlongley, hadleybeeman, Dongwoo, bigbluehat, stonematt, bumblefudge, npd, cel[h], 20:37:36 ... w3c_modbot, cel[m], manu, rhiaro, stenr, cel, csarven 20:37:41 manu: Moving on to vc-status-list-2021 PRs 20:37:44 subtopic: https://github.com/w3c/vc-status-list-2021/pull/45 20:38:17 manu: PR 45 adds a section about bitstring encoding, how exactly is the bitstring encoded. There's a PR that clarifies this and adds examples. I don't think there is a lot of disagreement. 20:38:24 subtopic: https://github.com/w3c/vc-status-list-2021/pull/46 20:38:28 present+ KevinDeanGS1 20:38:50 manu: PR 46. We have language about the credential, what should you do if it can't be dereferenced. This PR adds some guidance. 20:38:55 manu: That's it regarding PRs 20:39:08 present+ BrianCampbell 20:39:10 kristina: To follow up on presentationSchema PR, did you say we need a Special Topic call? 20:39:25 manu: The group needs to discuss this in some manner. Could be done now, or on a Special Topic call? 20:39:36 manu: Potentially we could resolve it now in 15 min if the WG understands 20:39:44 present+ PaulDietrich 20:39:50 q? 20:39:51 kristina: I think Orie has opinions, might not be quick. Let's do it on the next WG call. 20:40:05 present+ Orie 20:40:17 kristina: Let's do issues. 20:40:23 Topic: issue discussion 20:40:26 subtopic: https://github.com/w3c/vc-data-model/issues?q=is%3Aissue+is%3Aopen+label%3Adiscuss+sort%3Aupdated-asc 20:41:07 present+ andres 20:41:44 q+ 20:41:46 subtopic: https://github.com/w3c/vc-data-model/issues/932 20:41:47 q+ 20:41:48 kristina: Issue 932.. Can anyone talk about this specific issue about multi-issue credentials? 20:41:50 ack manu 20:42:01 manu: At a high level, this is about whether a VC can have multiple issuers. 20:42:24 manu: It's a bit deeper than it sounds. On the data model level, of course we could have an array. But then it's not clear what you do with the proofs. 20:42:40 manu: Perhaps we want the issuer to be a single field (like it is today), and then have multiple signatures 20:42:44 q+ 20:42:52 q+ 20:42:52 manu: You may have one primary issuers but n signatures on the credential. 20:43:16 manu: And then there's the argument that we shouldn't complicate the ecosystem. When you have multiple issuers, ultimately there needs to be an issuing authority. 20:43:23 orie q+ to complain about proof in the core data model 20:43:26 q? 20:43:33 q+ orie to complain about proof in the core data model 20:43:37 manu: E.g. you have multiple schools in a district that test the students, but you only have one authority that issues the credentials. 20:43:54 manu: There are different aspects on what this is about, and Gabe is leading the discussion. 20:43:59 or just issue two (or N-many) VCs ... need clear use cases and how those could / ought to be solved 20:44:09 kristina: We discussed mechanisms such as chaining, I think GS1 has something in production with multiple issuers. 20:44:26 kristina: Do we want to define how the multiple issue scenario would work, and if yes which mechanisms do we want to use. 20:44:31 ack decentralgabe 20:44:50 orie: +1 Gabe 20:44:53 decentralgabe: I see signing as a separate concern as the data model. It's important to clarify the data model first, if there can be multiple signatures. 20:45:12 decentralgabe: A multi signature scheme could be used, or having multiple proofs. I think there is still work to be done in crypto suites. 20:45:31 q+ 20:45:39 decentralgabe: I think the requirement is solid, I believe there are situations where single credentials are signed by multiple parties, and the spec text should clarify this. 20:45:48 q+ to note that issuer field in vc-data-model is currently only allowed to be a single value. 20:45:48 ack dmitriz 20:45:51 decentralgabe: We can add language to the spec, even if a crypt suite doesn't exist yet. 20:46:01 q? 20:46:04 dmitriz: I agree that multiple issuers is a legitimate use case. 20:46:22 dmitriz: We have a similar situation in the DID data model, we have the notion of multiple controllers in a DID document 20:46:33 dmitriz: We haven't done much with this mechanism, 20:46:48 dmitriz: I recommed that we do not model multiple issuers as multiple signatures 20:47:04 dmitriz: Either change the model to allow multiple issuers, or specify the notion of a compound issuer 20:47:24 dmitriz: If a student has a diploma from 2 universities, there would be 1 issuer, which is the partnership/combination of the 2 universities. 20:47:43 ack KevinDeanGS 20:47:49 KevinDeanGS1: The GS1 example is not one of multiple issuers in this sense 20:48:04 +1 to the notion that there are multiple different ways this problem could be solved and needs further exploration 20:48:13 KevinDeanGS1: The authority to issue a credential is derived from a prior credential. There is a chain of credentials, but this is not the same as having a credential with multiple issuers. 20:48:28 KevinDeanGS1: My authority to issue a final credential in a chain is derived from previous credentials in a chain. 20:49:04 KevinDeanGS1: Going back to private key cryptography in environments where parties don't trust each other. 20:49:35 orie: +1 Kevin, it's hierarchical 20:49:41 KevinDeanGS1: Control of issuing a final credential is put either into completely unrelated party, or it's under some partial control of one of the parties. This might not be acceptable to others. 20:49:56 KevinDeanGS1: Environment where issuers don't necessarily trust each other, but they want to issue a credential together. 20:50:09 +1 Kevin 20:50:12 treaties and contracts would be best modeled as a COLLECTION of VCs, from individual issuers 20:50:14 KevinDeanGS1: For treaties, certain contracts, there may well be requirements for multple issuers in low trust environments. 20:50:15 ack orie 20:50:15 orie, you wanted to complain about proof in the core data model 20:50:21 +1 kevin 20:50:38 Orie: I agree with what KevinDeanGS1 said and what decentralgabe said initially 20:50:44 Orie: We have seen several security approaches to this problem 20:50:48 +1 to dmitri ... that it may be best to model these things as collections of VCs 20:51:07 Orie: Going back to what decentralgabe said, the data model is about the intention, and securing it is a separate concern. 20:51:08 q- 20:51:25 Orie: Maybe you're used to OIDC or access tokens, where you have only 1 issuer and 1 subject. 20:51:39 Orie: The core data model should express the actual information that's important 20:51:50 Orie: I feel uneasy how we talk about proofs in relation to the core data model. 20:52:13 Orie: I have a feel we perceive Data Integrity Proofs to be more "imporant" than JWS proofs 20:52:32 Orie: The data model should be expressed in JSON-LD, and then the security aspect should be modeled using the proofs 20:52:51 Orie: I'm aware of some of the work dmitriz mention regarding multiple controllers 20:53:13 Nickname has joined #vcwg 20:53:17 ack manu 20:53:17 manu, you wanted to note that issuer field in vc-data-model is currently only allowed to be a single value. 20:53:18 Orie: This is not equivalent to a data model that allows expressing multiple issuers 20:53:21 q+ to mention CLR 2.0 in education 20:53:29 what is the value of two issuers URIs if there is only one signature? 20:53:51 manu: The current data model restricts the "issuer" to be a single value. If we just talk about the data model, do we want to loosen that requirement? 20:53:57 ack dmitriz 20:53:57 dmitriz, you wanted to mention CLR 2.0 in education 20:54:16 multiple VCs, each signed by a different issuer, could all make the same claim about a credential subject (such as a treaty) ... and merging those together would represent all parties of the treaty signing together, etc. -- options to explore. 20:54:18 dmitriz: I think there would be great value if we restrict a VC to a single issuer. 20:54:38 BrianCampbell has joined #vcwg 20:54:45 dmitriz: In the education space, there is a "Comprehensive Learner Record", which is a kitchen sink approach that contains a lot of information 20:54:45 orie: +1 Manu, it would be a change to the core data model first 20:55:03 present+ BrianCampbell 20:55:07 dmitriz: This can be a single "outer" credential with "nested" credentials. Each one has a single issuer. The "outer" one is signed by an aggregator. 20:55:18 +1 to dimitri 20:55:27 CLR spec: https://1edtech.github.io/ComprehensiveLearnerRecord/docs/clr_v2p0.html 20:55:27 dmitriz: I think we can express these situations while keeping the restriction of having a single "issuer" in the data model 20:55:35 ack will keep talking on the issue 20:55:37 kristina: I don't think we're ready for a PR yet 20:55:58 +1 dlongley, re having the /treaty/ itself be the subject of VCs 20:56:02 kristina: I encourage continued conversation about the data model aspect of this. 20:56:10 that's the approach taken by our recent RWoT paper 20:56:14 kristina: Thank you everyone, see you next week. 20:56:30 rrsagent, draft minutes 20:56:32 I have made the request to generate https://www.w3.org/2023/02/01-vcwg-minutes.html kristina 20:56:47 zakim, end meeting 20:56:47 As of this point the attendees have been brentz, DavidC, shigeya, Phil, KevinDeanGS, cabernet, Kerri_Lemoie, dmitriz, Phil_ASU, mkhraisha, JoeAndrieu, ToddSnyder, manu, 20:56:50 ... markus_sabadello, dlongley, decentralgabe, dlehn, dwaite, kristina, TallTed, smccown__, KevinDeanGS1, BrianCampbell, PaulDietrich, Orie, andres 20:56:50 RRSAgent, please draft minutes 20:56:51 I have made the request to generate https://www.w3.org/2023/02/01-vcwg-minutes.html Zakim 20:56:57 I am happy to have been of service, kristina; please remember to excuse RRSAgent. Goodbye 20:56:57 Zakim has left #vcwg 20:56:58 rrsagent, bye 20:56:58 I see no action items