Verifiable Credentials WG Telco — Minutes

Date: 2022-02-02

See also the Agenda and the IRC Log

Attendees

Present: Logan Porter, David Chadwick, Charles Lehner, Justin Richer, Michael Prorock, Michael Jones, Kyle Den Hartog, Manu Sporny, Dave Longley, Orie Steele, Yuriy Yuzifovich, Ted Thibodeau Jr., Brent Zundel, Kevin Dean, Juan Caballero, Kristina Yasuda, Joe Andrieu

Regrets:

Guests:

Chair: Brent Zundel

Scribe(s): Manu Sporny, Dave Longley

Content:

Brent Zundel: Quick agenda review – look at Editorial improvements, all of those should be merged, but will look. We’ll look at status of responses to feedback to normative changes to VCDM.
… After that, we’ll look at progress on test suite.
… Bulk of meeting will be discussing draft charter for next VCWG. Anything else to add to the agenda?.

Manu Sporny: Do we have a timeline for when we’re going to be done? Do we want to set a date?.
… For the charter..

Brent Zundel: Let’s tackle that as the first subtopic for the charter.
… We should try to converge on that..

1. Introductions and Reintroductions.

Brent Zundel: Anyone new?.

Yuriy Yuzifovich: Hi Yuriy Yuzifovich from Alibaba, leading initiatives in there. I joined during December 2021..

Brent Zundel: Welcome, good to have you with us!.

2. v1.1 Editorial Improvements status.

Brent Zundel: We have a number of editorial improvements on the way, we made a resolution a couple of weeks back to pull in a set of PRs as soon as VC 1.1 was approved..
… Once the official publication happens, we’ll roll these editorial changes in..
… How are the changes going, Kyle?.

Kyle Den Hartog: I think we’re just in a hold period, things look good. We are just waiting for the 14 day merge..
… I opened a PR, got updates pushed last week, add clarification to address comments….
… Google rep accepted changes. We have some discussion about v2, we might hold off a bit, unless we have WG approval to merge..
… https://github.com/w3c/vc-data-model/pull/847 seems ready to go according to DavidC..
… I think it needs a re-review..
… That’s a short status update of PRs in progress for v1.1..

Brent Zundel: Looks like there is one PR from original determination, one PR that addresses feedback, and new PR that updates some references..
… We don’t have resolution from group to do so, noting that it’s going to take a bit of time to get all of feedback to the changes according to v1.1 normative changes… because that process is taking longer, my intention is, when we have date by which updated spec is published, then we’ll have another resolution for editorial PRs in intervening time..
… Let’s look at the feedback..

3. v1.1 feedback.

Brent Zundel: See https://github.com/w3c/vc-data-model/issues?q=is%3Aissue+is%3Aopen+tracking.

Brent Zundel: Both of these are v2.0 issues..

3.1. ZKP Section Normative Changes (issue vc-data-model#863)

See github issue vc-data-model#863.

Kyle Den Hartog: Quick status update, based on my understanding – we don’t need to address this in v1.1, but should address in v2.0.

Brent Zundel: I’ll change title of issue to align with that realization..

3.2. [Tracking Issue - Proposed Corrections Feedback] URL to URI (issue vc-data-model#862)

See github issue vc-data-model#862.

See github pull request vc-data-model#866.

Brent Zundel: This is another tracking change from URL to URI – general concern around using URIs vs. URLs. There is a PR to address this..
… This was raised by kdenhartog.

Kyle Den Hartog: Status is that it should be ready to go, pending approval, the Google representative has approved it..
… It looks like we’re going to leave this issue open as well, just to track during the v2.0 work..
… We should address this in detail when new WG is formed..

Brent Zundel: We’re looking for more review..
… Any questions on response to feedback before we move on to our next topic?.

4. test suite feedback.

Brent Zundel: We also got feedback on test suite….

4.1. [Tracking Issue - Proposed Corrections Feedback] Test suite improvements are needed (issue vc-test-suite#126)

See github issue vc-test-suite#126.

Brent Zundel: Charles, can you give us an update on status of this?.

Charles Lehner: No update yet. Changes might be remove number of tests in test suite..

Manu Sporny: Yeah, Charles, your read is correct. Our approach in the group has not been to do tests for MAY statements..
… If it’s associated with a MAY statement, it should not be in the test suite. I haven’t had a change to dig deep into this, but some of the things they are referring to seem to be non-normative things in the specification, except for id that is normative..
… The other thing we’ll do in the VCWG 2.0 work is to define more stringent tests for at least id and proof, credentialSchema we still need implementers to step forward and write the tests for..

Brent Zundel: cel, does that give you info to move forward on this?.

Charles Lehner: Kinda, still trying to understand how to test these things. It seems like this is optional, up to suite type rather than make it mandatory..

Manu Sporny: Yeah, Charles, your read is correct on that. We shouldn’t be testing that stuff. They are asking us to test an extension point; the spec doesn’t define it. We can discuss this more in VCWG 2.0. If you just ping me we can go through it one by one and fix or defer to 2.0..

Charles Lehner: Ok, thanks..

Brent Zundel: Anything else on this topic before we move to Charter..

5. VCWG Draft Charter.

Brent Zundel: See List of open issues for the charter.

Brent Zundel: Before we do this, let’s have a brief conversation – what are our hopes and expectations for timeline?.
… Speaking as co-chair, I’d like to see this charter together and before the AC for a vote as soon as possible. I’d like to see the next group under way – conversation pertains to important details, but they’re not the main ones. I think we know roughly what we need to do, refine it, get feedback from key players, and then I’d like to move forward. Ideally, we’d have this presented by end of Feb for a vote and then on to WG within a couple of months..

Michael Jones: From my experience in many other WGs, the charter should be sent for approval when there is consensus from the members working on the item and not before. We shouldn’t be driven by time pressures, I don’t want to take a long time, but also in my experience, we’re far better off with a narrow charter where we agree..
… Let’s find a subset of stuff that everyone agrees to and go from there. The way to do this fast is to determine what we agree to. If we want to keep debating stuff that doesn’t belong in the charter, we can do that, but I don’t think that’s productive..
… We shouldn’t be time based, we should be content based..

Orie Steele: +1 mike.

Orie Steele: I totally agree with Mike. I think we should be careful with this charter to fix the mistakes that have been made in previous charters by not carving out the time to address the concerns that will need to be addressed. So we don’t end up in position as DID Core. So we have a charter that is filled with high degree of consensus items. I don’t think we’re going to end up in a situation where everyone is happy with all of the items in the charter..
… Especially on the non-normative side, some people will think that not all people will agree, where purpose of the note is to identify disagreements..
… There is a big difference between technical recommendation, where we all have consensus, but leave room to address interop profiles, implementation details, this has come up before… if we don’t do that work, we could have FOs..

Manu Sporny: Yeah, I agree in principle with Mike and Orie. We shouldn’t rush this. At the same time, we should remember that this charter has been out there for more than 9 months and has gone through two review cycles. We’ve had new people join and have strong opinions about what should and shouldn’t be in scope..
… All of us should keep in mind exactly what Orie said. In some cases this will be a “hold your nose” exercise, there are some things people don’t want to work on. But they are there because others want to do the work and have demonstrated implementations and so on. I especially don’t want us to get wrapped around the axle on non-normative items..
… This group has a strong record of prioritizing normative work items..

Michael Prorock: +1 manu - different folks have different priorities, but a key thing is are folks willing to do the actual writing, editing, etc on those items - if so, and if it helps adoption I am a fan of keeping those items in.

Manu Sporny: I’m concerned about us taking so much time that it gives people time to dig in their heels and delay the group where there are items that people have committed to work on that those individuals disagree with..
… I think we shouldn’t delay too much especially for non-normative work items..

Michael Jones: No one is attempting to drag anything out – we could be done today if people drop the items that there isn’t WG consensus on. I guess, at a personal level, at a personal level I object and want you to retract that statement, Manu..

Orie Steele: -1 we can’t be done today… there are a large number of issues..

Manu Sporny: I wasn’t talking about you, Mike, it wasn’t directed at any individual in particular..

Michael Jones: I didn’t find it constructive..

Ted Thibodeau Jr.: We should build in extra time that’s needed into the charter, month off in christmas, month in summer, publication blackouts, we might need 2.5 to 3 year charter because of those blocks..

Brent Zundel: I’ll have to see with Ivan if a 2.5 year charter is an option..

David Chadwick: Can’t non-normative items be taken out of charter and given to CCG to work on..

Manu Sporny: They could, but then there’s no possibility of publishing them as a WG NOTE. They just become some random document that some group published on the network. When WGs publish, they carry more weight. If we work on an implementation guide in the VCWG, when people read that, they know that at least some percentage of a W3C WG worked on it..
… It’s not clear who worked on it or how much vetting there was, etc. if it comes from somewhere else. It’s similar to a research paper from a journal vs. a post on a random website..

Orie Steele: Yeah, I think the WG has to agree to publish NOTEs, vs. a CG can publish whatever they want..
… David is getting to something that’s likely to happen, some of them might be better addressed in a CG. I think we have to be careful and clear where CGs should be the right place to work on something… or if WG members want to work on something and they find value, even if it’s not 100% of the group, that’s fine..
… There are many people that objected to publishing certain NOTEs in DID WG, there were strong objections from some folks, but yet, the WG felt it was important to publish comments and document where there was alignment and disagreement. Goal is to define, is this a topic that is better happened in CCG and remove it from charter. If there is strong agreement on NOTE or we will want to publish a note in an area of interest that is shared with WG members..
… It’s not wise to handcuff/blind ourselves before we start the work. We need to protect ourselves from disruption that was caused in DID WG, if we don’t plan for that sort of thing w/ NOTEs and implementation guides, we’re going to see the same categories of objections, absolutely..
… registries cannot be entrusted to a CG..
… we didn’t do it for dids.

Michael Prorock: Speaking with my Chair hat on of CCG – CCG is good at many things, incubation, but things that need a permanent home – how to write software about VCs and transmission of VCs, that needs to have a permanent home. If you’re filtering down to members of the WG… review, feedback, note where there is disagreement, it lends more authority with stuff coming out of WG. I’m a fan of things that are not limiting..
… The focus will be on the normative items, but there are things I’m willing to dedicate time to, so developers can come in and use this stuff. That’s an important issue for me, so I’m willing to put time into it..

Brent Zundel: Sounds like we’re going to put the charter out when it’s right, and we want to get it out as soon as it’s possible to get it out..
… Here’s a new link w/ better sorting:.

5.1. Data Integrity Crypto Suite Registry (issue vc-wg-charter#62)

See github issue vc-wg-charter#62.

Orie Steele: As you all know, the VC Data Model 1.0 shipped a bunch of term definitions in it’s v1 context w/ cryptosuite proofs and everyone has experienced how painful and bad of an idea that was..
… I think we know that we want the v2 context to not do that, and we want to allow people to build cryptosuites, some of which leverage new crypto, some that might be owned by CGs, some by open source software, we don’t know where cryptosuites are going to be built, we know not all are going to be normatively defined, we need some way of addressing that and being respectful where work is happening..
… In DID Core, we had a DID Spec Registries and it acknowledged both normative properties and extension properties. It’s not a perfect solution, but it does account for this desire to do work in CGs and register it, but not have it impact the core specifications..
… I think it can address issues that mike jones and davidc discussed..

Kyle Den Hartog: Registries are in scope and so question is – do we need to further define what scope means, can we leave it to WG?.

Manu Sporny: +1 to Orie’s framing of the concern and the potential solution. As Kyle also said, registries are in scope. I think people should just look at the language in the current charter and propose new language in a PR. I think this work you mentioned, Orie, is already in scope..
… Please take a look at the language and raise a PR if you think it needs refining. I currently think it’s adequate..
… I do think it should be left up to the WG – it would be terrible if the charter didn’t allow us to be responsive to work done in the WG..

Dave Longley: +1 to leaving it up to the WG.

Brent Zundel: All comments we made will be put into issue, any other comments before moving forward?.

Michael Prorock: +1 to leaving up to WG.

Orie Steele: There was a question in chat for IANA registries? We’ve talked about this a lot here – for VC-JWT, we should point to IANA (we shouldn’t duplicate/replace them for JWT).

Manu Sporny: +1 to that.

David Chadwick: +1.

Orie Steele: I think the current language needs work..

Dave Longley: +1 to not duplicate or replace existing registries that work, +1 for letting the WG figure out what registries are needed.

Justin Richer: Another data point for cryptographic algorithm registry – HTTP Signatures work, it also has its registry of algorithms, but also has explicit instructions when people want to use JWA and how those apply. For cryptographic algorithms, same approach could be applied here..

Orie Steele: +1 justin.

Michael Jones: To the extent that we’re specifying things that are a category, they should be in registries. If there is an existing IANA registry, we should reuse it. If it’s a new kind of thing, we should run a registry like DID Spec Registries..
… I’d be glad to help work on that..

Michael Prorock: +1 - well stated mike jones.

Manu Sporny: +1 to what selfissued just said.

5.2. Protocols and APIs should remain out of scope (issue vc-wg-charter#24)

See github issue vc-wg-charter#24.

Brent Zundel: Orie, if there is further refinement needed, we’d like to see a PR.

Michael Prorock: two PRs.

See github pull request vc-wg-charter#43.

Brent Zundel: This issue (and PR) has received quite a lot of attention lately..

See github pull request vc-wg-charter#66.

Brent Zundel: MikeJ, can you give us a status update?.

Michael Jones: This has been an active discussion, which is great… in summary, we do have consensus to not do normative protocol or API work..
… There is a discussion on whether discussion on non-normative APIs and protocols should be in scope or not..
… There is another thing we have consensus on, which is parenthetical remark in PR, discussion of implications of protocol usage needs to be in scope..
… I had a private conversation about “interlinking” adding audience to jwts and connect protocol said how to use it. If we didn’t have audience, we couldn’t use it in the protocol..

Orie Steele: kid being pretty important for use in protocols… and disastrously not commented on in the V1 data model..

Michael Jones: There is an interplay where working on both can be helpful. That said, specifying non-normative API/deliverables would be a distraction. I did hear from Manu that WG has good track record of keeping their focus. We might also want to look at MikeP’s PR..

Michael Prorock: https://github.com/w3c/vc-wg-charter/pull/66 - ensures we don’t touch on that stuff from a normative standpoint.

Michael Jones: His PR does says not to do normative API work, removes normative API deliverable, but then adds a bunch of other stuff..

Orie Steele: still not a day lol :).

Michael Jones: Orie said things couldn’t be done in a day, but that could be a path to be done soon..

Orie Steele: I would be in favor of pairing down the non normatively deliverables even further..

Juan Caballero: +1 to kyle, i can feel this confusion in my bones.

Kyle Den Hartog: I saw MikeP’s PR – agree with that direction. One of the most difficult is that people don’t understand which protocols should be used when/where. This is the non-normative aspect that would be useful. One of the things that VC API comes into play is because it’s a CCG work item, having it move to NOTE gives it a home and can point to it more easily..
… OpenID/DIDComm are viewed as protocols that are accepted and widely usable, non-normative language – we expect how protocols align to each other w/o having to set any specifics on what market must be doing. Set guidance on how market forms as multiple protocols exist..

Michael Prorock: I wanted to clarify on the PR, MikeJ and Kyle got it well – we clarify that we don’t want to do normative protocol work, but from non-normative side, we don’t want to box ourselves from talking about guidance to provide, critical from adoption and messaging standpoint. That’s why I want to include those non-normative protocol items..
… We don’t want to limit ourselves, we need to allow WG to decide how much to allow in – we are enabled to discuss stuff, talk about OIDC, how systems echange in API context, those are important things to provide developer context..

Orie Steele: I agree with MikeP, as much as we want to get charter out to AC – there are other things important, data model work here, w/o protocol to move things around is terrible and useless. We want to drive attention/traffic/support to where that work is happening. I need that work to be done sooner than I need the v2 charter sent to AC mailing list. We need those OpenID Connect drafts to be further along. We need a standard for moving that data model around. we won’t be doing that work here, we want people to contribute, use what they have, be supportive of OIDC, IETF, etc..

Manu Sporny: We do have consensus on not doing protocol work in a normative fashion. That’s true. There’s a corollary to that, which is – as long as we can do work around describing protocols and how developers use them and all the things Mike Prorock and Orie have been outlining..
… As long as we can do that in the group and that does include talking about the VC-API..

Joe Andrieu: +1 for publishing how to use external protocols with the VC Data Model.

Manu Sporny: We do not have consensus on not talking about protocol at all. What we don’t have consensus on is not being able to talk about the VC-API or publishing it as a note..
… A number of members in the group want to work on that non-normatively..

Joe Andrieu: Sounds like an implementation guide, which has always been an expectation for WGs to publish such items as non-normative NOTEs.

Orie Steele: Use the “approve” and “request changes” feature…. make it easy for the chairs..

Manu Sporny: We should go forward with those things we have consensus on, but we should not overlook on the statements from Mike Prorock’s PR… the only objector, I believe, is Mike Jones – on the non-normative items from Mike Prorock. There’s a fairly large group of people that want to be able to talk about this non-normatively and publish NOTEs..
… I want to know if there’s anyone else in the group other than Mike Jones that think non-normative work including NOTEs should be out of scope..

Kristina Yasuda: I think Tony made a comment it is also an IPR issue.

Orie Steele: yes, and I don’t agree with Tony :).

Kristina Yasuda: saying protocols/APIs are in-scope normatively would have IPR implications for those joining if I understood correctly.

Brent Zundel: non-normative discussion or specification of protocols or APIs has no bearing on IPR commitments.

Michael Jones: To Manu’s point, he said that there are those that don’t want us to talk about protocols at all – I don’t know who those people are. Using the audience example, data structure and protocol, important to understand relationship between the two. There is substantial objection to specifying protocols/APIs in this group. Fine to reference specs/discussions elsewhere, but there is a bright line between specifying protocol and just talking abut protocol work happening elsewhere..
… We don’t need to do protocol work, picking winners..

Orie Steele: I think this position is harmful..

Michael Jones: We defined JWTs w/o protocols, we knew they would use it, some of them in OAuth, data formats stands by itself and is used by all kinds of things, secured caller ID, which I never imagined, but that’s great..

Orie Steele: everything that is being said right now is why we need to be allowed to comment on this in WG Notes..

Kevin Dean: If a protocol is to be standardized, it should be done separately..

Kyle Den Hartog: Rhetorical question – do we expect that the discussion of how data model is moved along many different protocols that we should be able to speak about wrt. parehtentical. If I issue VC around OpenID Connect, but want to present via VC API/DIDComm, if there are implications, how are we able to discuss those sorts of things w/o documents? CCG is considered referenceable, but is that good enough?.

Michael Prorock: +1 kdenhartog.

Michael Jones: We can talk about anything we want..

Juan Caballero: ^^.

Orie Steele: there is a big difference between “discussions” and “blocking working group notes from being in scope for the charter”..

Michael Prorock: +1 joe.

Joe Andrieu: I don’t understand pushback against non-normative documents..

Juan Caballero: whether a NOTE somehow based on or taking as input document CCG can be one ingredient in the impl guide.

Juan Caballero: feels to me the technicality under discussion.

Kristina Yasuda: https://github.com/w3c/vc-wg-charter/pull/43#issuecomment-1020826349.

Kristina Yasuda: we can non-normatively mention anything without saying so in the charter. fyi.

Brent Zundel: The question comes down to – explicitly list intended non-normative notes that should be published concerning APIs/protocols. That’s the remaining question/disagreement..
… Thanks all for discussion, please continue discussion in issue tracker and PRs. Look forward to chatting next week..