11:57:43 RRSAgent has joined #wot-sec 11:57:43 logging to https://www.w3.org/2022/05/23-wot-sec-irc 12:01:23 meeting: WoT Security 12:01:38 present+ Kaz_Ashimura, Michael_McCool, Jiye_Park, Philipp_Blum 12:01:44 chair: McCool 12:02:57 McCool has joined #wot-sec 12:05:36 JKRhb has joined #wot-sec 12:05:57 present+ Jan_Roann, Tomoakai_Mizushima 12:06:12 agenda: https://www.w3.org/WoT/IG/wiki/IG_Security_WebConf#23_May_2022 12:06:42 Mizushima has joined #wot-sec 12:07:14 JIYE has joined #wot-sec 12:07:57 scribenick: JIYE 12:10:05 topic: Minutes 12:10:14 -> https://www.w3.org/2022/05/16-wot-sec-minutes.html May-16 12:13:03 approved 12:13:15 topic: TLS cleanup 12:13:19 https://github.com/w3c/wot-architecture/issues/753 12:15:12 s/https/-> https/ 12:15:19 mm: no PR yet, the problem is that when we discussed about TLS 1.3, browsers didn't support TLS 1.3 yet 12:15:27 s/753/753 wot-architecture Issue 753 - Clean up new TLS S&P Considerations/ 12:15:35 rrsagent, make log public 12:15:40 rrsagent, draft minutes 12:15:40 I have made the request to generate https://www.w3.org/2022/05/23-wot-sec-minutes.html kaz 12:15:43 https://caniuse.com/tls1-3 12:17:05 jy: Nowdays major browsers support TLS 1.3 12:19:57 i/Now/jr: (provides link for "Can I use...")/ 12:20:00 q? 12:20:04 https://datatracker.ietf.org/doc/html/rfc9147 12:20:24 s/jr:/pb:/ 12:21:08 jr: there is DTLS 1.3 RFC, it is official 12:21:15 jy: is there any implementation? 12:21:36 jr: DTLS 1.3 implementation is not supported by Openssl 12:23:21 topic: IDs 12:23:38 ->https://github.com/w3c/wot-thing-description/issues/1497 12:25:02 mm: word 'tracking' causes confusion as it can interpreted two meanings. 12:25:20 s/->https/-> https/ 12:25:40 ...: any thoughts about definition of 'tracking'? 12:26:00 i|topic: IDs|-> https://github.com/w3c/wot-architecture/issues/753#issuecomment-1134607063 McCool's comments| 12:26:55 ...: two meaning can be : determining location and observing behavior. Anything missing here? 12:27:17 i/1497/1497 wot-thing-description Issue 1497 - Identifiers don't seem to rotate enough/ 12:30:43 ...: we can make assertion that for onboarding and offboarding, new ID is required 12:31:04 pb: I agree, that is a good idea 12:32:18 pb: isn't it onboarding and offboarding kind of topic that we still need to discuss? 12:32:29 mm: yes, we need to dicuss about it 12:32:59 pb: maybe we discuss about it again when we are discussing onboarding offboarding topics 12:35:02 pb: as we didn't discuss onboarding offboarding process yet, ID can stay the same unless onboarding offboarding happens 12:39:01 topic: Specify how to treat ids in ThingModel 12:39:06 -> https://github.com/w3c/wot-thing-description/issues/1503 12:39:34 i|Specify|-> https://github.com/w3c/wot-thing-description/issues/1497#issuecomment-1134623635 McCool's comments| 12:41:16 pb: I would have serious security concerns if it goes as written on the comments of others 12:41:43 mm: id shouldn't define relationships 12:44:40 mm: it can be directly related to privacy issues, so let's don't do this 12:47:46 pb: general question, is it nessary to have an id in the thing model? 12:47:55 mm: id and id of the thing can be confused. id of the thing model is id of the abstraction. 12:48:30 pb: wouldn't it make more sense to have some mechanism by having some hashing value as an id or something? 12:48:40 mm: UUIDv4 is using a random value 12:49:32 topic: Security Bootstrapping #313 12:49:42 -> https://github.com/w3c/wot-discovery/pull/313 12:50:48 i|Security Boo|-> https://github.com/w3c/wot-thing-description/issues/1503#issuecomment-1134635114 McCool's comments| 12:51:22 mm: this problem is addressing : we have introduction mechanism which is url indicating TD. The thing is you don't know what the security scheme is when you don't know TD yet. so you have a bootstrapping problem. so at this point, we just use HTTP bootstrapping mechanism. 12:51:27 s/313/313 wot-discovery PR 313 - Security Bootstrapping| 12:52:08 ...: had a look the available schemes 12:52:45 s/...:/.../ 12:53:01 s/look/look at/ 12:57:01 mm: farshidtz suggested associating security definitions with links but I want to avoid complications 12:59:01 pb: to have our own security mechanism, having links is out of scope of our work 12:59:52 mm: I will discuss about it in the discovery call, if anybody wants to comment on this, feel free to do that 13:00:57 s/about it/it/ 13:01:01 [adjourned] 13:01:08 rrsagent, draft minutes 13:01:08 I have made the request to generate https://www.w3.org/2022/05/23-wot-sec-minutes.html kaz 13:58:18 i/May-16/scribenick: kaz/ 13:58:29 i/TLS clean/scribenick: JIYE/ 13:58:31 rrsagent, draft minutes 13:58:31 I have made the request to generate https://www.w3.org/2022/05/23-wot-sec-minutes.html kaz 14:25:54 Zakim has left #wot-sec 16:00:34 JKRhb has joined #wot-sec