15:07:02 RRSAgent has joined #vcwg 15:07:06 logging to https://www.w3.org/2025/02/05-vcwg-irc 15:07:06 RRSAgent, make logs Public 15:07:07 please title this meeting ("meeting: ..."), ivan 15:07:31 Meeting: Verifiable Credentials Working Group Telco 15:07:31 Date: 2025-02-06 15:07:31 Agenda: https://www.w3.org/events/meetings/d8dbb80a-e09f-49ed-8a49-536d60d7753c/20250205T110000/ 15:07:31 chair: brent 15:07:32 ivan has changed the topic to: Meeting Agenda 2025-02-06: https://www.w3.org/events/meetings/d8dbb80a-e09f-49ed-8a49-536d60d7753c/20250205T110000/ 15:53:58 brent has joined #vcwg 15:58:09 hsano has joined #vcwg 15:58:34 denkeni has joined #vcwg 15:58:39 present+ 15:58:49 present+ 15:59:50 present+ 15:59:50 present+ mahmoud 16:01:28 JoeAndrieu has joined #vcwg 16:01:37 present+ 16:01:37 TallTed has joined #vcwg 16:01:51 present+ TallTed , manu 16:01:52 KevinDean has joined #vcwg 16:01:58 present+ KevinDean 16:02:04 present+ davidc 16:02:23 DavidC has joined #vcwg 16:02:28 identitywoman has joined #vcwg 16:02:28 present+ 16:02:32 present+ joe 16:02:56 present+ identitywoman 16:03:27 scribe+ 16:03:42 present+ 16:04:00 brent: we'll start today with a report out from security group 16:04:10 ... then CID, then JOSE-COSE 16:04:11 present+ 16:04:30 ... any introductions? 16:04:43 Topic: Security group meeting 16:04:50 present+ bigbluehat 16:05:06 manu: A couple of us joined the first meeting of the security interest group yesterday 16:05:11 present+ dlongley 16:05:12 bigbluehat has joined #vcwg 16:05:21 ... we discussed VCDM and a variety of topics including their upcoming review queue 16:05:33 ... We wanted answers about (1) the review 16:05:43 ... they raised an issue asking us to restructure part of the spec 16:05:51 ... We mentioned that would be a burden 16:06:06 ... They agreed, that would be a challenge and this is a more long term ask 16:06:17 ... They didn't find any particular problems with the spec, so we are cleared to go to spec 16:06:44 ... Second, they said that any threat modeling work... if they request a more complete threat model that does not apply to the recent proposed REC things we are trying to do 16:07:08 ... They believe that SING plus the threat modeling CG will publish notes about threat models related to VCs, JOSE-COSE, etc. And tha twork will likely take several months. 16:07:13 q+ 16:07:19 ... So that work won't be a blocker 16:07:26 ... We said we'd be willing to help 16:07:32 mkhraisha has joined #vcwg 16:07:41 https://lists.w3.org/Archives/Public/public-vc-wg/2025Feb/0000.html 16:07:48 manu: I'm going to copy/past some of the proposed rec docs 16:07:50 Verifiable Credentials Data Model v2.0 16:07:50 https://w3c.github.io/vc-data-model/transitions/2025/PR/ 16:07:50 Verifiable Credential Data Integrity 1.0 16:07:50 https://w3c.github.io/vc-data-integrity/transitions/2025/PR/ 16:07:51 Data Integrity ECDSA Cryptosuites v1.0 16:07:51 https://w3c.github.io/vc-di-ecdsa/transitions/2025/PR/ 16:07:53 Data Integrity EdDSA Cryptosuites v1.0 16:07:55 https://w3c.github.io/vc-di-eddsa/transitions/2025/PR/ 16:07:57 Bitstring Status List v1.0 16:07:59 https://w3c.github.io/vc-bitstring-status-list/transitions/2025/PR/ 16:08:09 present+ pziv 16:08:23 ... One thing did come up. They confirmed they have not done security reviews of DI, CIDs, [and a few others], but they are at the top of the queue 16:08:51 ... We clarified we'll put this up for proposed REC and hopefully they can get those reviews done before we more to next stage 16:09:20 ... We also offered our help to come up to speed with design intent, etc. They appreciated that for VC2.0 and would appreciate it for other specs. 16:09:30 ... one of the chairs has actually implemented DI 16:09:41 ... so they have familiarity with the tech, it's just a lot of work on their plate 16:09:48 ... That's the report 16:09:56 ack ivan 16:10:23 ivan: on the practical side, manu can you put in the issues that are revelant, especially the ones where we asked for review. 16:10:32 ... Just add them to IRC 16:10:37 https://github.com/w3c/vc-data-model/issues/1575 16:10:48 manu: all the review requests? 16:10:54 https://github.com/w3c/security-request/issues/81 16:10:55 ivan: all the security ones (relevant to SING) 16:11:13 manu: ok, I think that's that. 16:11:27 one is the tracking issue for horizontal reviews, the other is the security request 16:11:43 s/one/... one/ 16:11:54 brent: anything else on this topic? 16:12:08 Topic: VC Data Model 16:12:18 https://github.com/w3c/vc-data-model/pulls 16:12:20 JennieM has joined #vcwg 16:12:23 brent: ok. moving on. we have a PR on VCDM 16:12:26 present+ 16:12:50 subtopic: https://github.com/w3c/vc-data-model/pull/1589 16:12:54 ... this updates references to CIDs in the spec 16:13:19 ivan: there are six pull requests that are essentially identical in six different places 16:13:22 ... it's nothing. 16:13:31 ... the CID spec is now published. Short name is changed. 16:13:39 ... It's part of the referenec generator used by respec 16:13:52 q+ 16:14:00 q+ to ask about normative references and PR. 16:14:19 ... I went through all the document that I believe have adjusted all informative and normative references 16:14:32 ack manu 16:14:32 manu, you wanted to ask about normative references and PR. 16:14:36 present+ dlehn 16:14:38 manu: +1 to this PR and the others. Thanks for raising them. 16:14:49 ... This is related to the administrivia question 16:15:06 q+ 16:15:12 ... VCDM now has a reference to CID spec and if we take VCDM to proposed REC before CID, that's ok per W3C process 16:15:28 ... I'm wondering if the publication team is going to have an issue if we don't take them all at the same time. 16:15:49 ... Like, VC-JOSE-COSE... we don't know when SD-JWT will be at whatever state at IETF it needs to be 16:16:14 ... and VCDM we refer to VC-JOSE-COSE normatively. Which means we can't take VCDM to global standard until the chain of dominos line up 16:16:37 ack ivan 16:16:37 ... I think we can argue that the spec is stable and our reference to it is stable because it's just a recommendation 16:16:51 ivan: unfortunately, I raised the same issues last week. 16:16:57 ... There are two aspects. 16:17:16 ... First, personally (and management) would prefer to publish them all at the same time. 16:17:37 ... We might do a press release about it, but that wants all the docs to be bundled 16:17:53 ... So the problem then is that they should be published at the same time. 16:18:39 ... Specifically for JOSE-COSE, the judgment is that we CAN publish JOSE-COSE as a recommendation because the SD-JWT as a spec is technical stable as it goes through administrative proecess at IETF. That's acceptable. 16:18:53 ... If that is all correct, we won't have a problem. 16:18:59 manu: Excellent. That answered my questions. 16:19:16 ivan: that means we need to synchronize everything and do it in a single launch to AC vote as a block 16:19:39 brent: there are no issues in VCDM we need to address 16:19:55 Topic: CID Issues 16:19:59 ... there are a few future tracking things, but we can move to the next topic 16:20:21 brent: One open PR that is updating echinda. We don't need to look at that one. 16:20:23 https://github.com/w3c/cid/issues 16:20:39 brent: we'll go through these issues 16:20:41 subtopic: https://github.com/w3c/cid/issues/147 16:20:45 q+ 16:21:05 brent: there is a name conflict with the identifier with CIDs as used in IPFS 16:21:05 ack manu 16:21:15 manu: this is them asking us to change the name of the spec again 16:21:43 ... I think they are concerned that people are going to confuse Content Identifiers with Controlled Identifiers. There are more acronyms that use CID. 16:21:50 ... We've debated this to death. 16:22:00 ... It took six weeks plus to do the actual rename. 16:22:11 ... If we made a change at this point it would be a huge lift. 16:22:52 ... The other argument is that the people providing this input are the bluesky and @proto folks, who don't really care about controlled identifiers. They are building decentralized systems and they care more about DIDs. 16:23:08 ... My suggestion is CIDs don't meet their needs, so they shouldn't use them. 16:23:29 ... They are different communities: CIDs if for centralized community, DIDs are for decentralized. 16:23:36 q+ 16:23:37 q+ 16:23:47 ack identitywoman 16:24:12 identitywoman: I saw something go by about CIDs and I just rolled my eyes. What the heck are these and how are they different? 16:24:24 ... it confused me. And I track this world a lot. 16:24:29 ... I think this causes confusion. 16:24:31 q+ 16:24:35 ack bigbluehat 16:24:41 q+ 16:24:49 bigbluehat: I do think we need to be careful here. Fatigue is real. Burnout is real. 16:24:59 ... I like to know if there is a streamlined way to do renaming. 16:25:02 `ctrlid` 16:25:14 ... I was going to propose ctrlid 16:25:31 -1 to ctrlid :( 16:25:32 ... I think its unwise to say "there will not be conflict" when we have a conflict now. 16:25:48 ... Its not fine right now. 16:25:54 q+ to ask how much trouble does the confusion actually cause? 16:25:57 ... We are in a waiting period anyway. 16:26:07 ... I don't think this confusion is going to away. 16:26:30 ack ivan 16:26:31 ... These groups do co-exist within the VC space. I don't think we need to scare off friends if we can avoid it 16:26:47 ivan: unfortunately there is no streamlined way to update. 16:26:59 ... we've done this several times and each time it is a major pain. 16:27:02 I can't express how much of a pain it is to do a spec rename 16:27:12 +1 to this confusion isn't going away with other namings. We have discussed it a lot. 16:27:17 (and it's not clear to me that the rename would be helpful) 16:27:32 ... It has to be formally republished, involving the webmaster, and must keep the provenance of the doc. Then additional things to get into spec-ref. This time it was at least a week. 16:27:35 ... It's a major pain. 16:27:49 ... The other thing, is we have spent hours and hours on the naming 16:28:03 ... This is probably the longest and biggest thread in this spec. 16:28:17 ... In the 24th hour, we probably should not reopen. 16:28:20 I think we're /concerned/ about confusion between spec names -- I'll suggest that people were horribly confused about Decentralized Identifiers and Verifiable Claims/Credentials in the beginning as well. 16:28:27 ... I don't think the world will collapse with this conflict. 16:28:35 ack brent 16:28:58 brent: We may have already mentioned: the ask is not to change the name of the spec, just the short name. 16:29:08 q+ 16:29:17 ... Not to speak to our ability to come to agreement on a new name, but the scope isn't the entire name. 16:29:21 ack dlongley 16:29:21 dlongley, you wanted to ask how much trouble does the confusion actually cause? 16:29:42 dlongley: it's clear there is confusion. But the mere existence of confusion doesn't mean we should change the name 16:29:51 ... the question is how much trouble is it going to cause. 16:30:15 q+ to suggest we instead work to distance the two CIDs from each other instead 16:30:17 ... These two techs do very different things, so I think the confusion will resolve quickly 16:30:22 ack manu 16:30:41 manu: remember everyone was horribly confused when we put out decentralized identifiers? 16:30:58 ... same thing with VCs: These are confusing, what are you doing? 16:31:09 ... Assertions at each point that we are confusing the market 16:31:25 ... We also have people claiming things are VCs that are completely incompatible with the spec 16:31:38 ... So its natural that at first people might be confused 16:32:01 ... To Brent's point, they are asking to change the acronym 16:32:15 ... We can make the change later if there really is confusion in the market 16:32:30 q+ 16:32:36 ... it took us a long time to get here. 16:32:44 ack bigbluehat 16:32:44 bigbluehat, you wanted to suggest we instead work to distance the two CIDs from each other instead 16:32:46 ... changing this at the last hour feels like a bad move 16:33:09 bigbluehat: if we are keeping the acronym, then anyhting we can do to put this in a completely different place... 16:33:24 ... and communicate with that community how we are going to help with that confusion 16:33:26 q+ to note that CID /is/ a completely separate thing, I don't think the specs will bump into each other. 16:33:33 q+ 16:33:35 q- 16:33:36 ... I don't think we'll revisit it later. 16:33:42 ... So we should clarify 16:33:43 ack manu 16:33:43 manu, you wanted to note that CID /is/ a completely separate thing, I don't think the specs will bump into each other. 16:34:03 manu: there is a subset of this community that wanted this specification. 16:34:17 ... I don't think most people building out VCs with DIDs care about CIDs at all. 16:34:27 ... It half-solves the problem. It's centralized. 16:34:37 ... I don't think there is overlap. 16:34:52 ... You can use a CID to do things. But most of us aren't going to use them. 16:35:06 ... The deployment community for CIDs is non-existent today. 16:35:33 ... The concept if VERY different from a content identifier. And if there is a concern about that being confusing in context, spell it out. 16:35:56 the use of CIDs outside their use as DIDs is virtually non-existent 16:36:01 ... When you say "controlled identifier" and "content identifier" its clear what is meant. 16:36:17 ... So don't use the acronym where it might be ambiguous. 16:36:21 ack identitywoman 16:36:44 identitywoman: If people aren't pushing to have the spec renamed, just the acronym. Then the acronym is the problem. 16:37:00 ... I like the suggestion that it's 'ctrlid' 16:37:08 ... That makes it clear that its different. 16:37:12 q+ 16:37:42 ack JoeAndrieu 16:38:25 q+ to ask if we can just take the shortname rename off of the table? 16:39:13 joeandrieu: agreed with Manu. If the acronym is the problem, don't use the acronym. The spelled out terms are clear. 16:39:14 ack manu 16:39:14 manu, you wanted to ask if we can just take the shortname rename off of the table? 16:39:43 manu: just from a process perspective, can we take the short-name rename off the table, that is a huge impact for the team 16:40:08 +1 for taking the shortname change off the table--since that seems to be where the cost/pain would be 16:40:17 +1 to manu 16:40:17 ... maybe we call it a CRID or CTRLID... but can we get some finality so editorial team can put together a proposed recommendation 16:40:34 +1 to either no change to the short name or do CRID and be done with it forever :) 16:40:35 brent: before we go there, I have a suggestion 16:40:36 what if we change "Controlled Identifiers (CIDs) v1.0" to "Controlled Identifiers v1.0", but keep the short name "cid-1.0" as is? 16:40:47 ... what if we just changed the title? 16:40:57 ... does that help anything? 16:41:15 q+ 16:41:20 ack manu 16:41:21 ... Then we back away from the officialness of the acronym. 16:41:29 manu: +1 to that suggestion 16:42:01 +1 to that suggestion. The communities would pick their beloved short name afterwards. 16:42:05 manu: then it just shows up in spec-refs, so I've been using expanded form, so you wouldn't see CID anywhere 16:42:25 q+ 16:42:38 ivan: minor change, the title 16:42:48 PROPOSAL: change the title "Controlled Identifiers (CIDs) v1.0" to "Controlled Identifiers v1.0", but keep the short name "cid-1.0" as is 16:42:52 +1 16:42:53 +1 16:42:53 +1 16:42:53 +1 16:42:54 +1 16:42:55 +1 16:42:56 +1 16:42:56 +1 16:43:00 +1 16:43:31 RESOLVED: change the title "Controlled Identifiers (CIDs) v1.0" to "Controlled Identifiers v1.0", but keep the short name "cid-1.0" as is 16:43:36 brent: hearing no objections 16:44:01 brent: second issue in CID spec 16:44:01 subtopic: https://github.com/w3c/cid/issues/141 16:44:24 q+ 16:44:24 brent: might just be a small editorial change 16:44:38 ack ivan 16:44:40 ack manu 16:44:53 manu: you're just waiting on me to raise a PR 16:45:05 brent: that's it. the rest are tracking issues 16:45:12 Topic: VC JOSE COSE 16:45:17 brent: one more topic on the agenda 16:45:19 https://github.com/w3c/vc-jose-cose/pulls 16:45:34 q+ 16:45:35 ... two PRs, but one is the same as VCDM 16:45:39 subtopic: https://github.com/w3c/vc-jose-cose/pull/327 16:46:14 ... This is in response to issue #325 a copy-paste error where values were identical in couple examples which was confusing. 16:46:41 ... Happy to take comments, but this is going in and addresses the last issues of JOSE-COSE 16:46:55 we are so beyond done for these specs :P 16:47:21 brent: Kudos to the group. This has been a remarkable amount of work. 16:47:29 q? 16:47:39 ack manu 16:47:57 manu: +1 to your comments. I noticed that we generate examples, like signed examples, for JOSE-COSE, SD-JWT. 16:48:18 ... I noticed the JOSE-COSE says they'd provide the data in some special mode 16:48:24 ... but they don't 16:49:07 ... I just put a feature last weekend for CBOR diagnostics. I could update that to handle COSE? Or we could remove "diagnostic mode" from the COSE examples. 16:49:11 <_denkeni> _denkeni has joined #vcwg 16:49:15 brent: i'm not finding what you mean. 16:49:26 manu: you see the orange text? 16:49:37 brent: I'm seeing something 16:49:54 manu: application/cbor/diagnostic (example 8 in VC-JOSE-COSE) 16:50:25 ... that information is the same across all the examples 16:50:29 ... oh way, maybe not. 16:50:39 q+ to ask if we could do it later during maintenance? 16:50:44 ... but its definitely not CBOR diagnostic 16:50:54 q+ to ask about diagnostic mode 16:51:01 ack dlongley 16:51:01 dlongley, you wanted to ask if we could do it later during maintenance? 16:51:10 dlongley: is this something we can improve during maintenance with better tooling. 16:51:20 brent: this is absolutely something that would fit in maintenance mode. 16:51:28 q+ 16:51:34 manu: then let's remove it for now. They can use the blob. 16:51:48 brent: or we do nothing at all. is the other option. 16:52:01 ack JoeAndrieu 16:52:01 JoeAndrieu, you wanted to ask about diagnostic mode 16:52:01 scribe+ 16:52:09 JoeAndrieu: What does diagnostic mode do? 16:52:12 q+ to answer "what does that do" 16:52:18 ack manu 16:52:18 manu, you wanted to answer "what does that do" 16:52:50 manu: CBOR diagnostic mode is just a huge hex string, which isn't very useful. CBOR diagnostic mode will dump that out as JSON so you can see the structure and check it 16:52:58 ... the current thing that is shown isn't helpful 16:53:09 ... It doesn't tell me what the payload is or what the signature is. 16:53:23 ack mkhraisha 16:53:26 ... It's showing me sometthing, but it's not really CBOR diagnoatics and it isn't helping 16:53:47 mkhraisha: About delete? Is that to delete the diagnostic part? 16:54:04 q+ 16:54:04 manu: these are all autogenerated, so we would have to remove it from all of them. 16:54:15 ... happy to remove it, but I'd rather not do anything. 16:54:23 q+ to note it might be harmful. 16:54:33 brent: argue that this is "not useful" rather than harmful. 16:54:36 ack bigbluehat 16:54:41 q+ to ask about normativeness 16:55:00 bigbluehat: we can shut off a given tab, e.g., the diagnostics tab 16:55:13 ack manu 16:55:13 manu, you wanted to note it might be harmful. 16:55:13 brent: turning it off should be minimal 16:55:30 q+ 16:55:31 manu: can't turn the whole tab off. 16:55:45 bigbluehat: that would be extra work. I misunderstood. 16:55:54 q? 16:55:54 q- 16:56:04 manu: five minutes to make the change. 16:56:20 ... currently, it looks like we don't know what we are doing. 16:56:25 ... I think it's actively harmful 16:56:51 ... We don't hurt anything by removing it. They can grab the blob and use a real CBOR tool 16:56:53 q- 16:57:04 brent: that's our agenda for today 16:57:09 ... thanks Joe. Thanks all. 16:57:31 ... Next week's call: we may have a PR or two, but we may cancel. (Probably) 16:57:42 rrsagent, draft minutes 16:57:44 I have made the request to generate https://www.w3.org/2025/02/05-vcwg-minutes.html ivan 16:57:51 brent: thanks all. See you in couple weeks. 16:58:57 rrsagent, bye 16:58:57 I see no action items