18:49:54 RRSAgent has joined #vcwg 18:49:58 logging to https://www.w3.org/2023/08/30-vcwg-irc 18:50:09 zakim, start the meeting 18:50:09 RRSAgent, make logs Public 18:50:10 please title this meeting ("meeting: ..."), brent 18:50:13 gkellogg has joined #vcwg 18:50:23 Meeting: Verifiable Credentials Working Group Telco 18:50:32 Chair: Brent 18:50:40 Date: 2023-08-30 18:51:21 gkellogg_ has joined #vcwg 18:52:36 gkellogg has joined #vcwg 18:53:20 mprorock has joined #vcwg 18:53:55 gkellog__ has joined #vcwg 18:57:37 dmitriz has joined #vcwg 18:57:53 present+ 18:59:09 present+ 18:59:36 present+ TallTed 19:00:20 gkellogg has joined #vcwg 19:01:46 Kristina has joined #vcwg 19:01:58 present+ 19:02:07 gkellogg_ has joined #vcwg 19:02:08 decentralgabe has joined #vcwg 19:02:10 justin_r has joined #vcwg 19:02:12 present+ 19:02:34 present+ 19:02:43 DavidC has joined #vcwg 19:02:55 Rachel has joined #vcwg 19:03:20 JoeAndrieu has joined #vcwg 19:03:26 present+ 19:03:26 present+ 19:03:30 present+ 19:03:35 scribe+ 19:03:44 present+ 19:04:08 pl-asu has joined #vcwg 19:04:12 present+ 19:04:44 brent: processing issues and discussions as usual 19:05:41 Rachel: self-introduction (hard to hear) 19:06:04 present+ 19:06:10 CalvinCheng: self-introduction. here to learn. 19:06:29 Topic: Work Item status updates/PRs 19:06:39 q+ 19:06:40 brent: starting with updates and PRs 19:06:42 q+ 19:06:42 q+ 19:06:54 ack mprorock 19:06:58 https://github.com/w3c/vc-jose-cose/pull/143 19:06:58 brent: looking to transition to CR no later than end of September 19:07:12 mprorock: one PR ready to merge (vc-jose-cose) 19:07:24 ... clean things up. better to test. 19:07:31 ... should help with test suites. 19:07:32 andres_ has joined #vcwg 19:07:32 https://github.com/w3c/vc-jose-cose/pull/144 19:07:35 present+ 19:07:37 Calvin has joined #vcwg 19:07:40 ... Also PR #144 could use eyes 19:08:21 ... pulling over items from data integrity 19:08:21 ... some won't apply to jose-cose, so help with that would be appreciated 19:08:30 ack decentralgabe 19:08:37 https://github.com/TBD54566975/vc-json-schema-test-suite 19:08:43 decentralgabe: the VC-json-schema test suite is up. testing our implementation at Block 19:08:52 selfissued_ has joined #vcwg 19:08:53 ... reach out to me if you're interested in integrating it 19:08:59 present+ 19:09:05 ack manu 19:09:07 brent: Ivan is out, but I'll follow up with him about moving the repo 19:09:16 manu: update on data-integrity and crypto suite specs 19:09:42 ... we have PRs for all before-CR issues. In DI and the cryptosuites 19:10:04 Orie has joined #vcwg 19:10:06 ... for VC Data Model, by the end of september, I don't see that happening. Its close but we need more issue processing and PRs 19:10:06 present+ 19:10:16 ... maybe October? 19:10:41 ... StatusList continues to drag. It shouldn't have much work, but should be doable. 19:10:55 present+ 19:11:00 brent: StatusList, just needs rebasing on the one open PR 19:11:07 manu: yes, some merge conflicts, Mike? 19:11:14 mprorock: I'll look after the call 19:11:30 manu: we should discuss if we are going to have multiple status list types or not 19:11:32 +1 manu 19:12:01 brent: for the group, the chairs perspective: meetings up to and including TPAC will be processing issues and PRs for all issues marked before CR 19:12:13 ... whatever we don't get to before TPAC, we'll deal with that at TPAC. 19:12:25 q+ 19:12:32 ... Editors, can you reach out to us to tell us how much time you need during TPAC 19:12:45 ack manu 19:12:52 present+ 19:12:54 manu: I'm wondering what you mean by time. 19:13:04 ... if we have no pre-cr issues what are you expecting? 19:13:26 brent: if no pre-cr issues open and all PRs are merged, then we can talk proposal to move to CR 19:13:33 ... which probably won't need much time 19:13:38 ... other work items might need more time 19:13:58 Topic: Issue Triage 19:14:13 q+ 19:14:14 ... Next: Issue Triage 19:14:28 q- 19:14:36 subtopic: https://github.com/w3c/vc-data-model/pull/1260 19:14:48 q+ 19:14:59 ack Orie 19:15:21 Orie: this PR was raised after a thread in DI repo about how many contexts are needed 19:15:44 .,, vc-di has the vc-di context, but only with limited terms 19:16:06 ... [more details] 19:16:36 ... in DI, we have three contexts. one for proof and DI proof. one for multi-key and one for webkey 19:16:59 ... for StatusList2021 you can use without one of the contexts, but that context is bundled into v2 context 19:17:11 ... you can use multikey and json multikey but these are not bundled 19:17:32 ... so this adds those terms to that bundle, so you can get the same URI in all situations 19:17:49 ... the contentious part is the private key representations. 19:18:09 ... manu said he doesn't know a good use case for private keys 19:18:25 ... my preference is that the term definitions be consistent, as its harder to prevent them from ... 19:18:43 ... people can do whatever they want. my preference would be to make sure the graph looks right 19:18:54 gkellogg has joined #vcwg 19:18:55 ... also, the keys part of a JSON web key set 19:19:02 q+ 19:19:04 ... similiar to JWK in v2 19:19:08 ack manu 19:19:18 manu: I think that's a fair introduction to the issue 19:19:26 ... to hone in on the parts that are contentious 19:19:45 ... One is, do we have a use case where people are going to express private key material in a VC and signing it? 19:19:56 ... If so, they can always do that 19:20:07 ... but its a corner case, so it's not clear we want to promote that by default 19:20:20 ... I don't think that as a working group we should be promoting that 19:20:33 ... Signing over private key material doesn't seem like something we should support 19:20:49 ... We don't currently have an example of representing this 19:21:04 gkellogg_ has joined #vcwg 19:21:06 ... if we had confidenceMethod is included, that might make sense 19:21:10 q+ 19:21:17 ... but that doesn't look to be on a trajectory to make it into the spec, so I think we should hold off 19:21:31 ... If we get a super valid use case, we can always put that into the context later 19:21:47 q+ to say you can use confidenceMethod with JsonWebKey today... and adding these terms to v2 context just makes the RDF graph correct. 19:21:47 ... We have text in the spec that the context file might change during CR and we can deal with it then 19:21:55 +1 to NOT supporting signing over private credentials - not something we should encourage. As we're in an open world model we can't prevent this. 19:22:06 ... I don't think its a good idea to merge this PR at this time. We need a good use case. 19:22:14 ack seabass 19:22:30 private credentials should have read private keys. 19:22:30 seabass: Orie, I know where you're coming from. I asked Manu something similar last week. 19:22:43 ... given the VC flexibility, you can use them to cross-sign keys 19:23:02 You can sign whatever you want... this working group does not control what issuers sign... and using RDF to try and enforce that is... not a good idea. 19:23:03 ... any one of those use cases could be addressed with cross-signing 19:23:15 To be clear - we're not blocking any of the use cases Orie is talking about... we're just saying: "That's not a mainstream use case, but if you want to do it, there is a mechanism there to do it (include the other context)." 19:23:17 ... at no point do you actually need a private key to move 19:23:21 ack Orie 19:23:21 Orie, you wanted to say you can use confidenceMethod with JsonWebKey today... and adding these terms to v2 context just makes the RDF graph correct. 19:23:38 Orie: The confidenceMethod is reserved. Not clear if we settled domain & range 19:23:54 gkellog__ has joined #vcwg 19:24:04 q+ to note that there is no concrete implementation for `confidenceMethod` 19:24:05 ... There is a question if we should define those for reserved properties 19:24:07 ... You could say the range is "verification methods" 19:24:17 ... then you could expect to see those defined 19:24:21 gkellog__ has joined #vcwg 19:24:29 ... For those who want confidence method, one of the use cases is to bind to a DID 19:24:37 ... the other is to bind to some key material 19:25:18 ... the only contentious issue I see here is the secret key material in them 19:25:39 ... if its better to do that not in the V2 context, but can be in a different one 19:25:53 ... I was surprised to see secret keys in the context definition 19:26:00 dwaite has joined #vcwg 19:26:05 present+ 19:26:32 ... I want to move away from the multi-base approach but support issuer-provided means 19:26:36 ack manu 19:26:36 manu, you wanted to note that there is no concrete implementation for `confidenceMethod` 19:26:43 brent: this is good, about ready to move on 19:27:03 manu: two contentious part here. one confidenceMethod doesn't exist (because of no implementations) 19:27:03 confidenceMethod the "predicate" is reserved, and exists. 19:27:16 ... we've agreed that if you don't have an implementation, don't add it to the context 19:27:30 ConfidenceMethod the RDF class does not exist, but "VerificationMethod" does... afaik. 19:27:47 ... I agree. In theory you could use confidence method, but that will need another context (because it isn't in V2) 19:27:50 disagree with basically everything Manu is saying... but happy to keep talking about it on issues. 19:28:00 ... So we shouldn't put that into the spec 19:28:24 ... Two, yes. We've been arguing for a long time. Orie, you said you would object if it isn't in there. So that was a compromise made. 19:28:37 ... That is shifting into core context where it doesn't look like it belongs 19:28:42 I will object in core context defines confidenceMethod, but not JsonWebKey and Multikey. 19:28:51 ... There is no use case that's broad enough for secret keys to be in the base context. 19:28:52 s/in/if/ 19:29:08 steele has joined #vcwg 19:29:11 ... if its not there, it can be an issuer-specific context 19:29:24 Topic: Issue Triage 19:29:25 https://github.com/w3c/vc-data-model/issues/1263 19:29:26 brent: sounds like Orie is happy to drop it from the main context if we can get it in other contexts 19:29:30 ... now moving to issue triage 19:29:31 subtopic: https://github.com/w3c/vc-data-model/issues/1263 19:29:36 ... only on issue so far 19:29:49 s/on/one/ 19:30:29 q+ 19:30:31 ... looking for before-cr or post-cr comments 19:30:37 ack manu 19:30:52 manu: discussed this yesterday. Ted mentioned he would think about it. 19:31:12 brent: ok, that's ok with me. Ted did you want to share anything now? 19:31:23 q+ 19:31:29 TallTed: not yet. This is probably post-cr 19:31:42 ack Orie 19:32:11 orie: there are reserved terms that also point to reserved RDF classes 19:32:20 ... we currently have confidenceMethod as a reserved RDF class 19:32:44 ... which maybe implies some future inheritance. but what is the reslationship between the reserved predicate and the reserved RDF class. 19:33:15 ... what's the thought process around confidenceMethod being reserved in this way, instead of having confidencemethod refer to verification method. 19:33:20 q+ 19:33:24 ... are these normative 19:33:32 ack manu 19:33:37 manu: ivan did a lot of this work. we'd need to ask him. 19:33:45 Does this work reflect working group consensus? 19:34:01 Is the vocabulary normative? 19:34:10 Topic: Issue Discussion 19:34:12 https://github.com/w3c/vc-data-model/issues?q=is%3Aopen+is%3Aissue+label%3Abefore-CR+sort%3Aupdated-asc 19:34:15 brent: moving to final topic 19:34:45 ... These are all labeled before CR, some are ready for PR we'll ask when we might see that. Some are not. We'll ask what the plan is. 19:34:50 subtopic: https://github.com/w3c/vc-data-model/issues/1152 19:35:09 ... Raised by Mike Prorock. Ready for PR. 19:35:41 q+ 19:35:55 mprorock: I thought we were going to get some guidance from Ivan, but maybe I'm misremembering 19:36:04 ... it's ready for PR. I'll try to get to it. 19:36:12 ack seabass 19:36:23 seabass: is this the same a #1261 19:36:28 pauld_gs1 has joined #vcwg 19:36:31 manu: no 19:36:33 brent: no 19:36:37 mprorock: no. different 19:36:54 This should be an easy one -- fairly straight-forward PR. 19:37:00 brent: the resource integrity is literally adding that term to the vocabulary (rather than integrity of the vocabulary) 19:37:06 subtopic: https://github.com/w3c/vc-data-model/issues/1155 19:37:23 q+ 19:37:30 ack manu 19:37:32 ... any actions to take here? 19:37:39 q+ 19:37:59 manu: it's not clear. Addison continues to review. So I think we are getting active i18n reviews. 19:38:15 ... we should probably ask outright if we've addressed his concerns in his review. 19:38:34 brent: we do have on i18n pre-cr issue 19:38:38 ack dmitriz 19:39:01 +1 to an example 19:39:03 q+ 19:39:05 dmitriz: I wanted to ask if there would be any objections or push back to adding a PR with an example of i18n 19:39:09 ack manu 19:39:15 manu: we have stuff in the internationalization section 19:39:25 dmitriz: it doesn't have value-level language selection 19:39:34 manu: yes, we had that and people complained, so we removed it 19:39:50 ... so maybe we could add one that has the bare @language or @value in there 19:39:59 maybe file an issue capturing the example you want to see, and cross link for discussion. 19:40:16 dmitriz: I just mean, for example, if the value is a string, then an object with the properties for lang. 19:40:19 q+ 19:40:25 brent: hold on. remember the queue 19:40:48 brent: an issue to track this concern with an example example, would be an appropriate way to advance this 19:40:55 ack manu 19:41:09 subtopic: https://github.com/w3c/vc-data-model/issues/959 19:41:26 brent: issue 959. says PR exists 19:41:41 q+ 19:41:47 ack Orie 19:41:55 ...If we merge that PR we can close this? 19:42:15 Orie: that was the intent 19:42:32 subtopic: https://github.com/w3c/vc-data-model/issues/1047 19:42:47 q+ 19:42:49 brent: NIST defines credential differently 19:43:00 Orie: I definitely need to get to it. 19:43:11 ... it might be that credential has more alignment 19:43:26 ... it's related to previous topic about the abstract class confidentMethod 19:43:41 ... I do plan to do this at some point 19:43:51 brent: is the some point anticipated before TPAC 19:44:05 Orie: possibly, but this should probably be post-CR 19:44:33 q+ 19:44:33 ... assuming the other PR is merged this gets to post-cr 19:44:40 ack Orie 19:44:45 ack justin_r 19:44:45 brent: comments to that effect with link to PR would be helpful 19:44:57 Thank yoou! 19:45:13 justin_r: the TLDR version is that 863 definition of credential is authenticator plus attributes 19:45:21 ... fundamentally this is how credentials are used in VCs 19:45:41 ... but that's largely based on the definition of authenticator, which is fundamental to the NIST definition of credential 19:45:58 s/863/800-63/ 19:45:58 ... so the W3C can align or redefine or reference 19:46:04 q+ to note that we seem to be calling "confidenceMethod" an "authenticator". 19:46:20 ack Orie 19:46:20 Orie, you wanted to note that we seem to be calling "confidenceMethod" an "authenticator". 19:46:30 ... this term has changed about 6 times since I started working with NIST 19:47:02 Orie: the group has been discussing how to express "confidenceMethod" in VCs, which would express the public key that would be used for an authenticator 19:47:13 ... we are using similar but not the same 19:47:24 Nope -- that's not the only use case for `confidenceMethod` -- it's not only bound to authenticators. 19:47:36 brent: moving to next issue 19:47:38 subtopic: https://github.com/w3c/vc-data-model/issues/1153 19:47:49 ConfidenceMethod is a "super set" that includes authenticators? 19:48:05 ... we added context resource integrity. how do we test it? 19:48:05 or we just need it to not be the same thing in order to justify defining it? 19:48:23 Orie: ^not that later question, which is presuming bad faith, please don't do that. 19:48:26 q+ 19:48:32 mprorock: I will be adding code for testing the jose-cose side of this 19:48:49 manu: +1 should be straightforward to add 19:48:50 "authenticator" per 800-63 is fundamentally about proving access to a secret, it's an intentionally wide definition that spans many technologies. It might or might not make sense for it to be used exactly the same way here. NIST is not likely to change how it's used. 19:48:57 brent: should we move this to the test suite repo? 19:49:10 manu: or we just test in the core data model 19:49:14 so its a superset, where we are not defining the behavior beyond authenticators?... I am not going to assume thats being done maliciously, but I will assert its a bad idea to do this way. 19:49:22 brent: If I here no issues, I'll move to vc test suite repo 19:49:44 subtopic: https://github.com/w3c/vc-data-model/issues/1227 19:49:52 justin_r: yeah, that makes sense -- and people here have said they want some concept that also includes other "authentication mechanisms" that are not strictly related to secrets or proof of possession / use of keys. 19:49:56 ... value of processing JSON-LD 19:49:58 @orie I think it's more a matter of the ven diagram having some overlap that's fuzzy around the edges - not a super or subset from what I can tell 19:50:01 ack manu 19:50:11 manu: you can mark it ready for PR. we are working on text for it activly. 19:50:42 subtopic: https://github.com/w3c/vc-data-model/issues/1232 19:50:59 brent: revisit verification and validation 19:51:21 scribe+ 19:51:32 JoeAndrieu: I don't think there's been any forward movement. 19:51:35 dlongley: right, which in the NIST framework would include things that aren't authenticators, which is fine. 19:51:49 +1 19:51:55 JoeAndrieu: I do think it's on me to do a review on validation/verification... could come back and add them as comments. I think that's where we're at. 19:52:19 s/justin_r: yeah/justin_r, yeah/ 19:52:29 s/dlongley: right/dlongley, right/ 19:52:30 subtopic: https://github.com/w3c/vc-data-model/issues/1010 19:52:42 brent: termsOfUse insufficiently specified 19:53:01 q+ 19:53:05 ... can anyone give us an update 19:53:12 ack DavidC 19:53:36 DavidC: I think we got to the text in the space should be generic enough to allow anyone to specify their own terms of use with their own URI 19:53:44 ... and for testing we want something more than generic URI 19:54:01 ... we want specific URI for the type, which we can actually test for 19:54:15 ... I think we're at this state now. 19:54:44 ... I think we can now write specific tests with specific URIs and we could have different implementations that understand that type and can process it. 19:54:56 Q+ 19:55:03 ack pl-asu 19:55:09 pl-asu: I think David said it well. 19:55:25 ... the issue was that we needed something machine processable and not just a reference to a description. 19:55:32 q+ 19:55:36 ... now we have a way to test out David's idea. 19:55:42 ack manu 19:55:51 manu: I'm confused about where we are on this topic. 19:55:56 +1 to being confused 19:56:03 q+ 19:56:12 ... we made ... we had a consensus that the reserve term is going to be removed if we don't have a spec with two implementations by end of CR 19:56:30 q+ 19:56:39 ... the other way to do it is that we have multiple implementations and there is functional interoperability 19:56:53 ... where are we as a group. have we decided on one way or another 19:56:54 q+ 19:57:01 ack seabass 19:57:09 q- 19:57:18 +1 manu 19:57:28 seabass: I was going to propose something complicated, but in the interest of time, I'll yield to David 19:57:30 ack DavidC 19:57:37 manu: to be clear, I'm fine w/ either way forward... we just need to pick a direction. :) -- the first one is more stringent than the second. 19:57:55 DavidC: manu didn't quite catch what I said. There *will* be two implementations that are interoperable. 19:57:56 great, thanks DavidC -- that makes things easy. 19:59:08 zakim, who is here? 19:59:08 Present: brent, mprorock, TallTed, Kristina, decentralgabe, seabass, manu, DavidC, JoeAndrieu, bigbluehat, pl-asu, dlongley, andres_, selfissued_, Orie, dmitriz, dlehn, dwaite 19:59:11 On IRC I see pauld_gs1, steele, dwaite, gkellog__, Orie, selfissued_, Calvin, andres_, pl-asu, JoeAndrieu, Rachel, DavidC, justin_r, dmitriz, mprorock, RRSAgent, Zakim, brent, 19:59:11 ... TallTed, shigeya, Jem, cel, dlehn, manu, hyojin, csarven, bumblefudge1, cel[m], w3c_modbot, ounfacdo, seabass, saysaywhat, npd, MojGraph, cel[h], bumblefudge, Github, 19:59:11 ... bigbluehat, Dongwoo, hadleybeeman, stonematt, stenr, dlongley, rhiaro 19:59:29 present+ justin_r 19:59:42 zakim, end the meeting 19:59:42 As of this point the attendees have been brent, mprorock, TallTed, Kristina, decentralgabe, seabass, manu, DavidC, JoeAndrieu, bigbluehat, pl-asu, dlongley, andres_, selfissued_, 19:59:46 ... Orie, dmitriz, dlehn, dwaite, justin_r 19:59:46 RRSAgent, please draft minutes 19:59:47 I have made the request to generate https://www.w3.org/2023/08/30-vcwg-minutes.html Zakim 19:59:54 I am happy to have been of service, brent; please remember to excuse RRSAgent. Goodbye 19:59:54 Zakim has left #vcwg 20:00:07 rrsagent, bye 20:00:07 I see no action items