13:02:15 RRSAgent has joined #wot-sec 13:02:15 logging to https://www.w3.org/2021/11/08-wot-sec-irc 13:02:31 cris_ has joined #wot-sec 13:03:00 meeting: WoT Security 13:03:38 present+ Kaz_Ashimura, Cristiano_Aguzzi 13:04:19 present+ Jiye_Park, Michael_McCool, Sebastian_Kaebisch 13:04:35 Mizushima has joined #wot-sec 13:05:16 present+ Zoltan_Kis 13:05:37 McCool has joined #wot-sec 13:05:40 topic: Preliminary 13:05:52 jp: Jiye Park from Siemens 13:06:14 ... taking over the role from Oliver 13:06:22 present+ Tomoaki_Mizushima 13:06:54 Hello 13:06:54 rrsagent, make log public 13:06:57 Jiye has joined #wot-sec 13:08:55 mm: (gives basic instructions) 13:09:25 https://www.w3.org/WoT/IG/wiki/IG_Security_WebConf#8_November_2021 13:09:36 mm: you can bookmark the URL of the wiki page above 13:09:39 sebastian_ has joined #wot-sec 13:09:44 thanks! 13:09:52 sebastian has joined #wot-sec 13:10:00 agenda: https://www.w3.org/WoT/IG/wiki/IG_Security_WebConf#8_November_2021 13:10:13 mm: we have 2 documents 13:10:23 ... Security and Privacy Guidelines 13:10:41 ... and Security Best Practices document 13:11:12 ... tell people the best strategy for security and privacy 13:11:23 ... currently the document is thin 13:11:45 ... need use cases and best practices 13:11:52 ... including HTTPS ant OAuth 13:12:13 ... as discussed during the vF2F, we require authentication 13:12:28 ... separate spec for key distribution 13:13:11 ... the best practices document is not yet published 13:13:26 https://github.com/w3c/wot-security 13:14:00 https://w3c.github.io/wot-security/ 13:14:00 mm: we use separate GitHub repositories for spec work for easier rendering 13:14:27 ... GitHub and HTML rendering for WoT Security and Privacy Guidelines above 13:14:56 https://github.com/w3c/wot-security-best-practices 13:15:13 mm: the Best Practices document will be changed in the future 13:15:24 q+ 13:15:28 ... meant to be an appendix 13:15:40 https://w3c.github.io/wot-security-best-practices/ 13:16:18 sorry, I need to go now. Bye 13:17:09 mm: we have two large sections fr the Security Best Practices document 13:17:47 s/fr /for / 13:18:33 jp: thanks for the summary 13:18:42 topic: Agenda 13:18:43 q? 13:18:48 ack z 13:18:53 mm: anything to be added to the agenda? 13:19:27 zk: would it make sense to have generic guidelines for exposing/consuming Things? 13:19:58 ... there should be different requirements for exposing Thing and consuming Thing 13:20:24 mm: ok 13:20:34 ... let me capture the points within an issue 13:21:04 q? 13:21:32 q+ 13:21:51 -> https://github.com/w3c/wot-security-best-practices/issues/26 wot-security-best-practices issue 26 - Use Cases for Exposed and Consumed Things 13:22:11 mm: and another issue on onboarding and key distribution 13:22:58 -> https://github.com/w3c/wot-security-best-practices/issues/26 wot-security-best-practices issue 27 - Add Onboarding/Key Distribution Section 13:23:52 mm: keys are needed for TLS 13:24:17 ... in a global network, existing CA-based mechanisms can and should be used 13:24:38 ... in local and offline networks, a separate key distribution mechanisms is needed in order to use TLS 13:24:54 ... this is currently a gap but we should define the requirements here 13:25:00 ... iscovery may also be needed 13:25:10 ... explain how this relates to WoT Discovry 13:27:14 ... bunch of stuff being discussed on onboarding 13:28:02 zk: can give some comments 13:28:12 ... to the GitHub Issue 13:29:17 q? 13:29:35 ca: we're also tracking issue for Scripting API 13:29:53 https://github.com/w3c/wot-scripting-api/issues/315 13:30:04 zk: should belong to another issue on provisioning 13:30:25 (to be more precise we have this issue https://github.com/w3c/wot-scripting-api/issues/298) 13:30:27 mm: (adds that point to the Issue 27) 13:30:39 -> https://github.com/w3c/wot-security-best-practices/issues/27 Issue 27 - Add Onboarding/Key Distribution Section 13:30:57 ca: two links above 13:31:32 ... wot-scripting-api issue 298 should be better to use here 13:31:57 mm: (adds a link for wot-scripting-api issue 298 to wot-security-best-practices issue 27) 13:32:19 -> https://github.com/w3c/wot-security-best-practices/issues/27#issue-1047450206 updated comments for Issue 27 13:32:47 mm: it's a separate issue from key management 13:32:59 ... we should look into the library 13:33:59 ... (adds comments to wot-scripting-api issue 298) 13:36:28 ... we should add exploratory work 13:37:39 ... (adds comments to wot issue 978 about the WoT WG renewal) 13:37:51 -> https://github.com/w3c/wot/issues/978 wot issue 978 - WoT WG renewal 2021 13:39:27 mm: Management API as a separate API from the Scripting API 13:39:43 ... including configuring security schemes and establishing keys 13:40:09 ... onboarding process results in a set of "key objects" 13:41:27 -> https://github.com/w3c/wot/issues/978#issuecomment-963160698 updated comments for wot issue 978 13:43:01 q? 13:45:51 kaz: 2 comments 13:46:00 ... we should work with the DAS WG about this point 13:46:53 ... also we should have generic issue on onboarding and key management for the wot-security repository as well as the wot-best-practices repository 13:47:59 mm: yeah 13:48:30 ... woud consider making the "Security Best Practices" a normative document 13:49:50 ... but we'd like to update the document based on the latest best practices 13:50:00 kaz: in that case, Note would be a better direction 13:50:18 mm: or might be a ever-green approach 13:50:30 s/ever-green/evergreen/ 13:51:48 ... need to consider how this relates to certification 13:53:38 https://www.chromium.org/teams/web-capabilities-fugu 13:54:58 mm: possibility of Fugu above 13:55:00 topic: AOB 13:55:18 mm: we had joint discussion on Signature, etc., with the DID WG guys 13:55:27 ... they have a mechanism to distribute keys 13:56:41 zk: any idea on offloading by Web Assembly, etc.? 13:57:27 mm: similar discussion during the breakout by the Web Networks guys 13:57:49 ... our own question is do we want to work on that ourselves? 13:58:01 ... or would the other group(s) to work on that? 13:59:58 ... need to look into Web Workers as well 14:00:09 ... will continue to work on the topics 14:00:42 ... will review the prev minutes next week. 14:00:51 [adjourned] 14:00:52 rrsagent, make log public 14:00:56 rrsagent, draft minutes 14:00:58 I have made the request to generate https://www.w3.org/2021/11/08-wot-sec-minutes.html kaz 14:01:44 s/will continue/let's continue/ 14:01:57 rrsagent, draft minutes 14:01:57 I have made the request to generate https://www.w3.org/2021/11/08-wot-sec-minutes.html kaz 16:03:15 Zakim has left #wot-sec 16:15:34 zkis has joined #wot-sec 18:23:43 sebastian has joined #wot-sec 19:47:53 sebastian has joined #wot-sec 19:48:16 sebastian has joined #wot-sec 20:27:19 sebastian has joined #wot-sec 20:27:43 sebastian has joined #wot-sec