12:02:24 RRSAgent has joined #wot-sec 12:02:24 logging to https://www.w3.org/2022/04/25-wot-sec-irc 12:03:26 jiye has joined #wot-sec 12:03:36 meeting: WoT Security 12:03:43 citrullin has joined #wot-sec 12:04:02 present+ Kaz_Ashimura, Jan_Romann, Jiye_Park, Philipp_Blum, Tomoaki_Mizushima 12:05:04 present+ Micheal_McCool 12:06:58 scribenick: JKRhb 12:07:05 topic: Minutes Review 12:08:07 mm: Security and Privacy Considerations for Discovery were merged, but for Architecture the PR is still open 12:08:28 ... there are minor spelling issues 12:09:03 ... (mentions the progress on a number of PRs) 12:09:14 i|Security and|-> https://www.w3.org/2022/04/11-wot-sec-minutes.html Apr-11| 12:09:20 kaz: The typo is fixed now 12:09:30 mm: Propose to publish these. Any objections? 12:09:39 There are none, minutes are published 12:10:12 topic: PRs 12:10:40 subtopic: Discovery PR #295 12:10:51 mm: Got merged in the Discovery call 12:11:02 ... issue #293 got closed by it 12:11:25 ... if you have any concerns regarding discovery, raise new issues otherwise we can consider it done 12:11:44 subtopic: Architecture PR #734 12:11:51 mm: This one is still open 12:12:01 ... did not manage to continue working on it 12:12:21 ... no significant edits regarding normative changes, with the exception of assertions 12:12:43 ... as we discussed last time, there is a serious problem with the document structure 12:12:58 ... One aspect is the structuring by deliverables 12:13:16 ... another one is the mix of problem descriptions and mitigations 12:13:41 i|This one is still|-> https://github.com/w3c/wot-architecture/pull/734 wot-architecture PR 734 - Make Security and Privacy Considerations Normative #734| 12:13:59 ... a third one is related to public security information in TDs 12:14:09 ... we currently don't allow public keys in TDs 12:14:29 pb: One question: Didn't DID also contain public keys? 12:14:46 mm: DID does, but they also contain information for validating 12:15:21 q+ 12:15:23 ... DID is currently opposed, 50 different mechanisms for resolution but some are not secure 12:15:57 ... can be secure but it is not guaranteed 12:16:12 ... in my opinion 12:16:41 ... to summarize, public security data should not include public keys 12:16:56 ... I'll try to get it done by the next architecture call 12:17:08 ... then there will be a feature freeze by May 6 12:17:42 ... we can do a review in the next call and then merge on May 5 12:18:04 ... are there any more points that should be addressed here? 12:18:24 kaz: I generally agree with you, Michael, but public keys can be public 12:19:34 mm: They would theoretically be okay in a TD 12:19:56 ... not allowing public keys is not normative, yet 12:20:01 s/can be public/can be public. Also TD doesn't need to handle the public key directly but it can refer to an external DID document for that purpose. So we should at least think about how a TD should refer to an external DID./ 12:20:26 ... we could delete the sentence 12:20:41 kaz: How are DIDs related to TDs? 12:20:58 mm: We don't mention them in the TD spec, yet 12:21:20 ... we are currently in the clean up phase 12:21:40 ... we could say that public keys are only allowed in signed TDs 12:22:54 ... should be addressed in the next version, where we should be able to adopt JSON-LDs signing mechanism 12:23:14 ... we could also refer to other documents with public keys, as Kaz mentioned before 12:23:31 ... DID would be an option but they are not normative, yet 12:23:52 pb: DIDs could also be changed in a TD, so there is a similar problem 12:24:22 s/How are DIDs related to TDs?/How TDs should rfer to DIDs should be documented at least. Maybe not for 1.1 specs but for 2.0 specs, though./ 12:24:55 mm: At this point we should not open "cans of worms" in order to not be inconsistent 12:25:50 mm: Is there anything else we should consider regarding S&P considerations? 12:26:51 i|mm: Is there anything else|topic: S&P considerations for Profiles| 12:27:15 ... there is no section for S&P considerations in the profile document yet 12:27:51 rrsagent, draft minutes 12:27:51 I have made the request to generate https://www.w3.org/2022/04/25-wot-sec-minutes.html JKRhb 12:27:54 rrsagent, make log public 12:28:11 ... there is a mentioning of security 12:28:59 ... we still have the problem with security in that local networks 12:29:10 ... could be added, but might be a bit redundant 12:29:59 pb: I wrote you an email regarding security in local networks, should I open a PR with that? 12:30:27 jp: Could you summarize? 12:31:30 pb: Especially with IPv6 you can let nodes change IP addresses to avoid attacks on DNS entries(?) 12:31:45 mm: You describe an onboarding mechanism 12:32:02 ... there are a lot of points that need to be figured out here 12:32:19 ... we should open an issue and put it in the next charter 12:32:25 pb: I'll create an issue 12:33:04 mm: Defining a mechanism normatively might not be possible, unfortunately 12:33:18 ... there is a lot of ongoing discussion 12:33:46 s/topic: PRs/topic: Security and Privacy Considerations 12:35:33 rrsagent, make log publicc 12:35:39 rrsagent, make log public 12:35:48 s/rrsagent, make log publicc// 12:35:50 rrsagent, draft minutes 12:35:50 I have made the request to generate https://www.w3.org/2022/04/25-wot-sec-minutes.html kaz 12:36:35 https://github.com/w3c/wot/issues/978 12:37:12 mm: Onboarding is already mentioned in the issue for the next charter 12:37:34 ... can you add your points regarding onboarding here, Philipp? 12:37:47 ... You can also create an issue and link it here 12:37:51 pb: Will do 12:38:57 mm: I just noticed that there is already an issue for S&P cosiderations in the Profile repository 12:39:04 https://github.com/w3c/wot-profile/issues/182 12:39:24 ... also another one 12:39:38 https://github.com/w3c/wot-profile/issues/183 12:39:59 s/ is already an issue for S&P cosiderations/ is already an issue for security cosiderations 12:40:09 https://github.com/w3c/wot-profile/issues/183 12:40:21 s/... also another one/... and also one for privacy considerations 12:40:47 https://github.com/w3c/wot-thing-description/pull/1474 12:41:53 rrsagent, draft minutes 12:41:53 I have made the request to generate https://www.w3.org/2022/04/25-wot-sec-minutes.html kaz 12:41:59 chair: McCool 12:42:00 rrsagent, draft minutes 12:42:01 I have made the request to generate https://www.w3.org/2022/04/25-wot-sec-minutes.html kaz 12:42:31 topic: Additional Security Schemes 12:42:41 https://github.com/w3c/wot-thing-description/pull/1474 12:42:53 jr: Extensions are currently not allowed by the JSON schema 12:43:12 mm: We should probably change the document and schema to allow extensions again 12:43:24 ... additional requirements are needed 12:43:48 i|Got merged in the|-> https://github.com/w3c/wot-discovery/pull/295 wot-discovery PR 295 - Make Security and Privacy Considerations Normative| 12:43:53 rrsagent, draft minutes 12:43:53 I have made the request to generate https://www.w3.org/2022/04/25-wot-sec-minutes.html kaz 12:44:47 ... One possibility would be to do nothing and simply allow extensions 12:45:17 ... we should focus on bug fixes for now, not add additional normative statements 12:45:27 ... a broken example certainly is a bug 12:45:48 ... (adds a comment to the PR) 12:48:11 ... we should rather refrain from adjusting the JSON Schema 12:48:32 https://w3c.github.io/wot-thing-description/#adding-security-schemes 12:48:48 ... current specification is consistent as it says "oneOf" instead of "e. g." for the values of scheme 12:49:06 above is inconsistent with "one of" used in https://w3c.github.io/wot-thing-description/#securityscheme 12:49:15 pb: 1.0 also says e.g. not oneOf 12:49:34 also, TD 1.0 uses "e.g.", so using "one of" also breaks compatibility. 12:49:38 ... saying oneOf in 1.1 would break compatability with 1.0 12:51:23 mm: Change to oneOf was a breaking change, should be reverted 12:51:47 topic: Matter Specification 12:52:04 mm: Took a first look into the Matter specification 12:52:13 ... looks interesting with regard to onboarding 12:52:22 ... should align our process with Matter's 12:52:58 rrsagent, draft minutes 12:52:58 I have made the request to generate https://www.w3.org/2022/04/25-wot-sec-minutes.html JKRhb 12:54:32 i|Took a first|-> https://csa-iot.org/all-solutions/matter/ Matter site (CSA IoT)| 12:54:37 [adjourned] 12:54:42 rrsagent, draft minutes 12:54:42 I have made the request to generate https://www.w3.org/2022/04/25-wot-sec-minutes.html kaz 13:05:16 Mizushima has left #wot-sec 14:32:35 Zakim has left #wot-sec 15:08:42 JKRhb has joined #wot-sec 15:32:45 JKRhb has joined #wot-sec