13:06:00 RRSAgent has joined #wot-sec 13:06:04 logging to https://www.w3.org/2022/12/19-wot-sec-irc 13:06:06 chair: McCool 13:07:18 present+ Kaz_Ashimura, Michael_McCool, Jiye_Park 13:07:24 present+ Tomoaki_Mizushima 13:07:27 topic: Minutes 13:07:35 -> https://www.w3.org/2022/12/05-wot-sec-minutes.html Dec-5 13:07:42 mm: (goes through the minutes) 13:08:15 Mizushima has joined #wot-sec 13:10:43 topic: Next Charter 13:11:12 agenda: https://www.w3.org/WoT/IG/wiki/IG_Security_WebConf#19_December_2022 13:11:32 mm: we'll cancel the call next week and Jan 9 13:11:57 i|we'll|-> https://github.com/w3c/wot/tree/main/proposals/deliverable-proposals Deliverable Proposals 13:12:47 -> https://github.com/w3c/wot/pull/1031 wot PR 1031 - Create Security Deliverable Proposal 13:12:58 mm: proposal for a normative spec for Security and Privacy 13:13:21 q+ 13:13:37 ... would put onboarding 13:13:55 ... also thinking that key management for DID, etc. 13:14:11 jp: normative document for Security and Privacy? 13:14:44 mm: there is some ambiguity around onboarding 13:15:09 q? 13:15:28 ... need discussion on what would be a better security scheme 13:15:44 ... embedded security key is not a good practice 13:16:10 ... best practice to be clarified 13:17:40 kaz: so far, we've put security/privacy portions into the other specs 13:17:55 ... e.g., Architecture, TD, Discovery and Profile 13:18:05 ... but do we want to change that approach? 13:18:11 mm: right 13:18:29 ... note that right now security guideline is an informative document 13:20:02 kaz: the expectation for the normative security/privacy document is describing the best practices for WoT systems in general rather than the level of TDs, etc. 13:20:06 mm: right 13:21:24 kaz: so "WoT Best Practices" or something like that could be the name for that document 13:21:27 mm: yeah 13:21:41 ... still need discussion, though 13:21:43 ack k 13:22:03 ... should include security scheme and ontology for that purpose as well 13:22:20 ... registry for that purpose as well 13:24:17 ... (mentions "WoT Security and Privacy Recommendations" or "WoT Security and Privacy Best Practices" as potential titles) 13:24:26 jy: we don't need to make decision today 13:24:30 mm: right 13:25:18 ... one more thing I wanted to mention 13:25:35 ... VC, SSI, and key distribution 13:26:26 (merged) 13:26:42 topic: Publications 13:27:11 mm: not have time to go through the Security Guideline doc... 13:27:33 ... would aim to complete the reviews and suggested changes by Jan 23 13:27:57 s/Publications/Publication for S&P Guidelines/ 13:28:24 topic: Planning 13:28:35 mm: January 23 13:28:58 topic: Testing 13:29:09 mm: Testfest happened last week 13:29:42 ... as expected, the most of the remaining features at-risk were around security 13:30:17 ... (shows the results) 13:30:25 subtopic: TD 13:31:14 mm: (shows the latest Implementation Report on his PC) 13:31:29 kaz: how many remaining? 13:31:36 mm: 18 13:32:20 ... and 12 or so of them are around security 13:33:34 ... regarding "282: security-mutual-auth-td", need to see if it's really correct because it says "mutually authenticated" 13:33:41 q? 13:34:04 ... the next one "283: security-server-auth-td" should be easy 13:34:14 q+ 13:34:41 ack k 13:34:52 kaz: have you updated the results during the weekend? 13:35:16 mm: still need to work on that 13:36:08 jp: what about OAuth2? 13:37:38 i|shows|-> https://w3c.github.io/wot-thing-description/testing/report11.html latest Implementation Report on GitHub| 13:38:30 mm: "td-security-oauth2-client-*" to be looked into 13:39:32 ... "td-security-oauth2-code-flow" is already covered, though 13:40:01 subtopic: Discovery 13:40:59 -> https://w3c.github.io/wot-discovery/testing/report.html latest Implementation Report on GitHub 13:41:09 mm: still have 44 features at-risk 13:41:33 ... a bit weird to have this big number 13:42:10 ... 33, 34, 35, 36 are easy 13:42:19 s/easy/easy, though/ 13:43:52 ... 56, etc., are not security 13:44:20 ... "137: sec-tdd-throttle-queries", etc., are around mitigation 13:46:01 ... "142: sec-tdd-intro-if-multicast-required" might be difficult due to lack of library 13:46:23 ... hope we can get rid of some of the features at-risk 13:47:24 ... think client-flow features are more important than code-flow features 13:48:18 s/code-flow features/others like watchdog features/ 13:48:30 subtopic: Architecture 13:48:45 -> https://w3c.github.io/wot-architecture/testing/report11.html latest Implementation Report on GitHub 13:49:59 mm: "31: arch-security-consideration-communication-platform", etc., were added for binding 13:50:26 ... to be honest, I'm OK with removing this feature because it's kind of vague 13:50:56 ... (goes through the features at-risk) 13:51:19 ... "46: arch-security-consideration-tls-recommended-priv" should be done 13:52:05 ... "50: arch-security-consideration-dtls-1-3" to be changed 13:52:07 q+ 13:52:35 kaz: what do you mean by "change" here? 13:52:41 ... removing the feature? 13:52:51 https://github.com/w3c/wot-architecture/pull/886 13:53:28 s/https/-> https/ 13:53:45 s/886/886 Revise (D)TLS-1-2 assertions/ 13:54:39 kaz: so the proposed change is "TLS 1.2 MAY be used" to be changed to "at least TLS 1.2 SHOULD" 13:54:50 s/SHOULD"/SHOULD be used"/ 13:56:12 mm: we need to consult with the Director before PR transition 13:57:32 ... regarding "31: arch-security-consideration-communication-platform", it depends of which platform to be considered, ECHONET, OPC UA or what? 13:57:53 topic: Charter discussion 13:58:15 mm: we'll have a special meeting on new WG Charter on Jan 16-19 13:58:32 https://www.w3.org/WoT/IG/wiki/Main_WoT_WebConf#Special_Meetings_to_Discuss_Next_Charter 13:58:39 ... Security normative spec idea also to be discussed there 13:58:50 s|https://www.w3.org/WoT/IG/wiki/Main_WoT_WebConf#Special_Meetings_to_Discuss_Next_Charter|| 13:59:03 i|we'll|-> https://www.w3.org/WoT/IG/wiki/Main_WoT_WebConf#Special_Meetings_to_Discuss_Next_Charter Special Meeting on Next Charter 13:59:18 ... would be great if you also could join that meeting, Jiye 13:59:58 jiye: overlapping with the WoT Security call? 14:00:13 mm: the Security call will be cancelled on Jan 16 14:00:24 ... we'll use a different WebEx for that meeting 14:00:41 jiye: OK, will try to join that meeting on Jan 16 14:01:08 mm: Sebastian will be also join it 14:01:11 [adjourned] 14:01:15 rrsagent, make log public 14:01:19 rrsagent, draft minutes 14:01:20 I have made the request to generate https://www.w3.org/2022/12/19-wot-sec-minutes.html kaz 15:55:14 Zakim has left #wot-sec