14:55:06 <RRSAgent> RRSAgent has joined #did
14:55:10 <RRSAgent> logging to https://www.w3.org/2025/07/24-did-irc
14:55:12 <ottomorac> rrsagent, draft minutes
14:55:13 <RRSAgent> I have made the request to generate https://www.w3.org/2025/07/24-did-minutes.html ottomorac
14:55:18 <ottomorac> rrsagent, make logs public
14:55:23 <ottomorac> Meeting: Decentralized Identifier Working Group
14:55:28 <ottomorac> Chair: ottomorac
14:55:41 <ottomorac> Agenda: https://www.w3.org/2025/07/24-did-minutes.html
14:58:06 <TallTed> previous meeting: https://www.w3.org/2025/07/17-did-minutes.html
14:58:08 <TallTed> next meeting: https://www.w3.org/2025/07/31-did-minutes.html
14:59:06 <TallTed> present+
15:00:30 <JoeAndrieu> JoeAndrieu has joined #did
15:00:38 <ottomorac> present+
15:00:44 <RRSAgent> I have made the request to generate https://www.w3.org/2025/07/24-did-minutes.html TallTed
15:01:09 <markus_sabadello> markus_sabadello has joined #did
15:02:02 <KevinDean> KevinDean has joined #did
15:02:08 <KevinDean> present+
15:02:45 <pchampin> present+
15:03:27 <Wip> Wip has joined #did
15:03:36 <Wip> present+
15:03:49 <JoeAndrieu> scribe+
15:03:54 <JoeAndrieu> present+
15:05:10 <markus_sabadello> present+
15:05:37 <JoeAndrieu> ottomorac: reviews current progress and agenda
15:05:53 <pchampin> q+
15:05:53 <JoeAndrieu> ... Any questions?
15:06:00 <ottomorac> ack pchampin
15:06:23 <manu> present+
15:06:29 <JoeAndrieu> pchampin: Email from Julian from ISO about the decentralized identity architecture.
15:06:45 <JoeAndrieu> ... basically very positive. we can got for category A liason for TC307
15:06:54 <JoeAndrieu> ... I'll work on that form with a goal of end of this week
15:07:07 <JoeAndrieu> s/can got/can go/
15:07:07 <ivan> present+
15:07:08 <ottomorac> Topic: Debrief DID Test Suite Special Topic - 23rd July
15:07:19 <JoeAndrieu> ottomorac: first topic: test suite topic call
15:07:27 <Wip> q+
15:07:32 <ottomorac> ack Wip
15:07:35 <JennieM> JennieM has joined #did
15:07:38 <JennieM> present+
15:07:47 <JoeAndrieu> wip: It was a great discussion. Markus wasn't there, so we want some feedback.
15:08:05 <JoeAndrieu> ... We want to pick 1-5 normative statements in the spec we feel are stable ...
15:08:12 <JoeAndrieu> ... Manu?
15:08:38 <JoeAndrieu> manu: Good discussion. The things we talked about were like what would be the best way to create the test. 1. We have to extract all the normative statements.
15:08:48 <JoeAndrieu> ... initial extract: 82 statements.
15:08:57 <JoeAndrieu> ... Concern that is a lot of statements.
15:08:57 <smccown> smccown has joined #did
15:09:08 <JoeAndrieu> ... Concern raised that these tests take a lot of effort
15:09:16 <JoeAndrieu> ... and we want to avoid problems we had with previous approaches.
15:09:28 <JoeAndrieu> ... specifically avoiding static tests
15:09:43 <JoeAndrieu> ... we want to ensure that the test suite can be regularly run to make sure conformance is maintained
15:10:06 <JoeAndrieu> ... There was a discussion about starting small and focused and get to an end-to-end scenario with at least two different implementations?
15:10:14 <JoeAndrieu> ... If we can, then we can expand to more tests
15:10:30 <JoeAndrieu> ... Also discussed how disruptive it is for the spec to change after tests are written.
15:10:54 <JoeAndrieu> ... So we discussed how we as a group figure out how implementers should run the test
15:11:11 <TallTed> s|Agenda: https://www.w3.org/2025/07/24-did-minutes.html|Agenda: https://lists.w3.org/Archives/Public/public-did-wg/2025Jul/0009.html |
15:11:18 <RRSAgent> I have made the request to generate https://www.w3.org/2025/07/24-did-minutes.html TallTed
15:11:26 <JoeAndrieu> ... No one signed up for leading the test suite. Will mentioned willingness to help, as did Digital Bazaar, but neither could take the lead.
15:11:43 <JoeAndrieu> ... Then, towards the end, we talked about concrete things to move the test suite forward.
15:12:06 <JoeAndrieu> ... 1. Pick an architecture. (Reuse VC 2.0 or something else)
15:12:30 <bigbluehat> bigbluehat has joined #did
15:12:49 <bigbluehat> present+
15:13:11 <JoeAndrieu> ... I can go into detail about what that means, but if we have consensus on that, the downstream decisions get easier.
15:13:22 <ottomorac> q?
15:13:42 <JoeAndrieu> ... Next question is what are the first 5 tests and what organizations are going to provide endpoints?
15:14:17 <JoeAndrieu> ... Another key decision to make: do we require that each resolver work against at least one did method? or do resolvers bring their own method
15:14:56 <JoeAndrieu> ottomorac: some of these tests might be automated. Was there a discussion about hiring a tester?
15:15:59 <ottomorac> Topic: Unaddressed denial of service vector #897
15:16:18 <JoeAndrieu> manu: I think it would be good for us to take some resolutions with the test suite
15:16:19 <Wip> +1 to resolutions
15:16:32 <JoeAndrieu> ... Will had suggested some proposals. I have some rough ones written up.
15:16:46 <JoeAndrieu> ottomorac: let's go to that
15:16:57 <ottomorac> q?
15:17:15 <ivan> s/Topic: Unaddressed denial of service vector #897//
15:17:29 <JoeAndrieu> manu: I have three rough proposals
15:17:46 <JoeAndrieu> ... first is to make the test suite did method agnostic
15:18:37 <JoeAndrieu> ... the alternative is we would need to require that all resolvers resolve a specific DID method for testing, such as a did:key
15:18:43 <markus_sabadello> q+
15:18:53 <ottomorac> q?
15:18:55 <JoeAndrieu> ... So the resolver tells the test suite which methods it supports
15:18:59 <ivan> q+
15:19:01 <ottomorac> ack markus_sabadello
15:19:08 <JoeAndrieu> markus_sabadello: I think its a good idea based on our experience.
15:19:24 <Wip> *chair hat off* I strongly prefer the BYO DID Method approach
15:19:25 <ottomorac> ack ivan
15:19:25 <JoeAndrieu> ... when you submit your implementation, you specific a number of DIDs and expected results and we run against that.
15:19:48 <JoeAndrieu> ivan: Nothing against it, but to make it automatic, we'll need a clear way to identity each method.
15:20:00 <JoeAndrieu> manu: it will literally be a DID that it supports
15:20:04 <JoeAndrieu> ivan: ok. that works.
15:20:10 <ottomorac> q?
15:20:13 <JoeAndrieu> +1
15:20:29 <ottomorac> PROPOSAL: Make the DID Resolution test suite "DID Method agnostic" (each endpoint specifies legitimate and invalid DIDs to use against the implementation)
15:20:33 <ivan> +1
15:20:33 <manu> +1
15:20:34 <Wip> +1
15:20:34 <JoeAndrieu> +1
15:20:38 <ottomorac> +1
15:20:39 <pchampin> +1
15:20:42 <markus_sabadello> +1
15:20:50 <KevinDean> +1
15:21:36 <ottomorac> RESOLUTION: Make the DID Resolution test suite "DID Method agnostic" (each endpoint specifies legitimate and invalid DIDs to use against the implementation)
15:21:39 <TallTed> +1
15:21:58 <JoeAndrieu> ottomorac: ok. thanks for that.
15:22:06 <JoeAndrieu> ...
15:22:13 <JoeAndrieu> manu: two more to consider
15:22:46 <JoeAndrieu> ... The next one is imperfect, but the general architecture of VC 2.0 can be reused
15:23:08 <JoeAndrieu> ... I think this is a solid improvement over the original DID test suite
15:23:56 <JoeAndrieu> ... these are mocha driven tests that output JSON we format for humans
15:24:12 <JoeAndrieu> ... hundreds of thousands of dollars of work that we can reuse
15:24:19 <JoeAndrieu> ... Then we just need to write the literal tests
15:24:35 <markus_sabadello> q+
15:24:41 <JoeAndrieu> ... The only thing I'm concerned about is that Danube Tech did build a test suite.
15:24:45 <ottomorac> ack markus_sabadello
15:25:07 <JoeAndrieu> markus_sabadello: I would have suggested the same thing. All these tests suites (VC-related) have been successful, so starting with that as a basis is great.
15:25:19 <ottomorac> q+
15:25:26 <JoeAndrieu> ... And we can help with specific tests by copying what we have into the VC framework
15:25:29 <ottomorac> ack ottomorac
15:25:39 <manu> q+
15:25:44 <JoeAndrieu> ottomorac: Does this architecture require the use of Mocha?
15:26:01 <bigbluehat> q?
15:26:03 <ottomorac> ack manu
15:26:19 <bigbluehat> q+
15:26:20 <JoeAndrieu> manu: Yes. It does use Mocha. We don't have to use it, but it would be more work to replace it
15:26:33 <JoeAndrieu> ... Let's reuse as much as possible
15:26:34 <ottomorac> ack bigbluehat
15:26:54 <JoeAndrieu> bigbluehat: what we're getting from Mocha is the reporter integration. We could use something else, but it would basically be starting over.
15:27:33 <JoeAndrieu> ... The tests can be rewritten in another language, but the framework with mocha/chai/javascript would be non-trivial to replace that
15:27:39 <ottomorac> q?
15:28:01 <ottomorac> RESOLUTION: For the DID Resolution test suite - adopt the test suite infrastructure that was used for VC v2.0; configuration based, HTTP API driven, runs at a regular interval, generates JSON output, formatted into a human-readable report.
15:28:01 <Wip> +1
15:28:03 <JoeAndrieu> +1
15:28:05 <bigbluehat> +1
15:28:07 <markus_sabadello> +1
15:28:08 <TallTed> +1
15:28:10 <ottomorac> +1
15:28:10 <JennieM> +1
15:28:12 <manu> +1
15:28:17 <pchampin> +1
15:28:19 <KevinDean> +1
15:28:24 <TallTed> s/s/RESOLUTION: For/PROPOSED: For/
15:28:25 <ivan> +1
15:28:34 <smccown> +1
15:29:11 <ottomorac> RESOLUTION: For the DID Resolution test suite - adopt the test suite infrastructure that was used for VC v2.0; configuration based, HTTP API driven, runs at a regular interval, generates JSON output, formatted into a human-readable report.
15:29:36 <JoeAndrieu> manu: hopefully an easy one. We're going to start small.
15:29:51 <ivan> q+
15:29:56 <ottomorac> +1 , fully agree to start small
15:29:59 <JoeAndrieu> ... this is modest guidance to the person writing the initial tests
15:30:11 <ivan> q-
15:30:19 <JoeAndrieu> ... Then we will decide how to flesh out the rest of the tests as things stabilize
15:30:33 <ottomorac> q?
15:30:40 <ottomorac> PROPOSAL: For the DID Resolution test suite, focus on a small number (~5) of end-to-end tests with at least two implementations to start.
15:30:42 <manu> +1
15:30:43 <ivan> +1
15:30:44 <pchampin> +1
15:30:44 <JoeAndrieu> +1
15:30:46 <ottomorac> +1
15:30:46 <Wip> +1
15:30:47 <markus_sabadello> +1
15:30:47 <TallTed> +1
15:30:50 <smccown> +1
15:30:54 <bigbluehat> +1
15:30:57 <KevinDean> +1
15:31:02 <JennieM> +1
15:31:32 <ottomorac> RESOLUTION: For the DID Resolution test suite, focus on a small number (~5) of end-to-end tests with at least two implementations to start.
15:31:33 <JoeAndrieu> q+ to ask DDOS question
15:31:41 <ottomorac> ack JoeAndrieu
15:31:41 <Zakim> JoeAndrieu, you wanted to ask DDOS question
15:31:43 <ottomorac> scribe+
15:31:47 <Wip> q+
15:32:01 <manu> q+
15:32:04 <Wip> q-
15:32:34 <ottomorac> JoeAndrieu:  I wanted to ask, If I have resolver that wants to work with these tests... I think we agreed that I need to have resolver up and running to respond to these tests, how to handle denial of service?
15:32:58 <ottomorac> manu: I think we had this concern before, we could use a docker based approach....
15:33:07 <JoeAndrieu> manu: yes. that was a concern with VC 2.0, but nobody had a problem with that. We do have a docker option.
15:33:19 <JoeAndrieu> ... that could be a way to provide a non-DDOSable way to do it.
15:33:20 <ivan> s|Topic: Debrief DID Test Suite Special Topic - 23rd July|Topic: Debrief DID Test Suite Special Topic - 23rd July https://github.com/w3c/did-resolution/issues/92|
15:33:24 <bigbluehat> q+
15:33:30 <bigbluehat> +1
15:33:31 <ottomorac> ack manu
15:33:35 <JoeAndrieu> ... Also we have authorization turned on for some of the VC services.
15:33:52 <JoeAndrieu> ... So that would also be a way to do it. Oauth or ZCAPs.
15:33:57 <ottomorac> ack bigbluehat
15:34:11 <JoeAndrieu> ... Github secrets manage the access tokens
15:34:41 <Wip> My connection is still a little spotty. I just wanted to flag, that we will aim to schedule another special topic call soon to make progress on the test suite work. Especially focusing on selecting the 1-5 statements
15:34:59 <ottomorac> Topic: Unaddressed denial of service vector #897
15:35:10 <ottomorac> https://github.com/w3c/did/issues/897
15:35:23 <ottomorac> Issue raised by Victor Dods in regards to possible loophole for infinite did resolutions related to various way in which we refer to the term controller in the spec. He sees a risk for infinite loops which he thinks should be addressed in the security considerations section. Will has provided some comments on it. And Manu is suggesting that we perhaps move it to DID resolution.
15:36:02 <JoeAndrieu> ottomorac: manu thought this might be more a did resolution issue than did-core
15:36:22 <markus_sabadello> q+
15:36:27 <ottomorac> ack markus_sabadello
15:36:31 <RRSAgent> I have made the request to generate https://www.w3.org/2025/07/24-did-minutes.html TallTed
15:36:48 <manu> q+
15:36:59 <ottomorac> ack manu
15:37:36 <JoeAndrieu> manu: I can do the move. Basically we had to provide advice that did resolvers need to detect cycles and make sure they don't get lost in infinite loops
15:38:05 <ottomorac> Topic: DID Resolution PR Processing
15:38:19 <ottomorac> Subtopic: add security consideration about how noCache can lead to DDOS so clients should expect that servers may deny cache bypass #171
15:38:31 <ottomorac> Feedback has been provided by Manu and Will on the PR.
15:38:39 <ottomorac> https://github.com/w3c/did-resolution/pull/171
15:38:44 <JoeAndrieu> ottomorac: feedback from Manu and Will. Markus anything to point out?
15:38:55 <TallTed> s|RESOLUTION: For the DID ReRESOLUTION: For/PROPOSED: Forolution |PROPOSED: For the DID RESOLUTION |
15:39:07 <RRSAgent> I have made the request to generate https://www.w3.org/2025/07/24-did-minutes.html TallTed
15:39:13 <JoeAndrieu> markus_sabadello: I haven't been able to review yet. It makes sense.
15:39:13 <Wip> q+
15:39:25 <ottomorac> ack Wip
15:39:51 <JoeAndrieu> wip: Wanted to add, the PR is great. But there is a mention of an error in there. We probably need to add the error to our error list.
15:39:56 <ottomorac> q?
15:39:59 <markus_sabadello> q+
15:40:06 <ottomorac> ack markus_sabadello
15:40:30 <Wip> This bit "Resolvers that deny resolution without caching can respond with an error that makes it clear that bypassing the cache was not permitted "
15:40:32 <JoeAndrieu> markus_sabadello: I agree. If we say there's an error, we should also define that using problem details and error codes
15:40:47 <JoeAndrieu> ... we already have a few errors specific to resolution. So we should add it
15:41:08 <ottomorac> Subtopic: Remove "Future Work" section #170
15:41:13 <ottomorac> https://github.com/w3c/did-resolution/pull/170
15:41:19 <ottomorac> Suggestion from Markus to remove this section from the spec since we haven&rsquo;t had much suggestions and corresponding issues have been closed and/or moved to DID Extensions
15:41:43 <JoeAndrieu> ottomorac: this seems to have general agreement
15:41:50 <markus_sabadello> q+
15:42:02 <ottomorac> ack markus_sabadello
15:42:20 <JoeAndrieu> markus_sabadello: it just made sense to me. There were three topics: JSON Pointers, Introducing Proxy Service and Introducing redirection functions.
15:42:31 <JoeAndrieu> ... Those discussions, we moved these things to extensions
15:42:43 <JoeAndrieu> ... Unless we want a list of future extensions, we can just remove this
15:42:51 <JoeAndrieu> ... But I'm not sure we should have such a list
15:42:57 <ottomorac> q?
15:43:00 <ivan> +1 to remove this
15:43:04 <JoeAndrieu> +1 to remove
15:43:14 <pchampin> +1
15:43:21 <ottomorac> Subtopic: Write examples as text instead of PNG images. #168
15:43:30 <ottomorac> https://github.com/w3c/did-resolution/pull/168
15:43:40 <markus_sabadello> q+
15:43:48 <JoeAndrieu> ottomorac: this next one is examples in text instead of images
15:43:54 <ottomorac> ack markus_sabadello
15:44:06 <JoeAndrieu> markus_sabadello: used to be a lot of PNG documents, largely replaced with SVG docs
15:44:27 <JoeAndrieu> ... this one replaces images directly with text (JSON)
15:44:46 <ottomorac> Subtopic: Remove a few issue markers #169
15:44:54 <ottomorac> https://github.com/w3c/did-resolution/pull/169
15:45:03 <JoeAndrieu> ottomorac: mostly editorial.
15:45:11 <ottomorac> ack markus_sabadello
15:45:26 <JoeAndrieu> markus_sabadello: In some sections there are references to old issues. So this just removes the ones that have been closed.
15:45:34 <ottomorac> q?
15:45:49 <ottomorac> Topic: DID Resolution Issue Processing
15:46:04 <ottomorac> Add DID Resolution architecture security and privacy considerations #133
15:46:10 <ottomorac> Subtopic: Add DID Resolution architecture security and privacy considerations #133
15:46:20 <ottomorac> https://github.com/w3c/did-resolution/issues/133
15:46:25 <ottomorac> What considerations do implementers of the resolvers need to have in mind. Joe had referenced &ldquo;RFC 3552 Guidelines for Writing RFC Text on Security Considerations&rdquo; indicating that in the work with Simone this was incorporated.
15:46:43 <ottomorac> scribe+
15:46:56 <JoeAndrieu> q+
15:47:05 <ottomorac> ack JoeAndrieu
15:47:53 <ottomorac> JoeAndrieu: Simones suggestion is that security consideration sections be done as threat model and the walk through the various types of threats....
15:47:56 <ivan> q+
15:47:58 <markus_sabadello> q+
15:48:19 <ottomorac> JoeAndrieu: I am still working with Simone, so we should probably revisit later
15:48:21 <ottomorac> ack ivan
15:48:46 <manu> q+
15:48:47 <JoeAndrieu> ivan: would that kind of requirement be there for already existing recommmendations that get republished. Do we need it for DID spec as well.
15:48:53 <ottomorac> Ivan: Is this something that we should do for the did spec as well?
15:50:00 <ottomorac> JoeAndrieu:  I think it is desirable, but perhaps not required....   The goal we have is to have a threat model framework that any spec in the W3C VC spec can fit into...
15:50:20 <ottomorac> Ivan: I have some doubts about it.....
15:50:39 <ottomorac> ack markus_sabadello
15:51:03 <JoeAndrieu> markus_sabadello: I've been thinking about security consideration. I agree we need more work. The threat modeling sounds useful.
15:51:24 <JoeAndrieu> ... One thing is the specification has a section about resolver architectures. Which introduces some security related topics.
15:51:38 <JoeAndrieu> ... How to read from a VDR, how to talk with a resolver, and proofs and meta data.
15:51:47 <JoeAndrieu> ... So how does that relate?
15:51:48 <JoeAndrieu> q+
15:52:07 <ottomorac> ack JoenAdrieu
15:52:17 <ottomorac> ack JoeAdrieu
15:52:34 <ottomorac> JoenAdrieu: the diagrams are the right place to start the work....
15:52:41 <JoeAndrieu> q-
15:52:53 <ottomorac> S /JoenAdrieu/JoeAndrieu/
15:53:11 <JoeAndrieu> manu: Just to react to did-core consideration request. I'm not sure what the ask would be.
15:53:45 <JoeAndrieu> ... I don't think it's quite there yet. It's a lot of work. I'd rather not redo that section until we have a good guidance on what to do.
15:53:49 <JoeAndrieu> q+
15:53:54 <ottomorac> ack manu
15:54:03 <ottomorac> ack JoeAndrieu
15:54:26 <ottomorac> q?
15:54:39 <ottomorac> Subtopic: Complete threat modelling analysis for different DID Resolution architectures #132
15:54:41 <JoeAndrieu> ottomorac: there is another issue.
15:54:44 <ottomorac> https://github.com/w3c/did-resolution/issues/132
15:55:04 <markus_sabadello> q+
15:55:17 <JoeAndrieu> ottomorac: should we merge these?
15:55:18 <ottomorac> ack markus_sabadello
15:55:25 <JoeAndrieu> markus_sabadello: Will created that one.
15:55:47 <JoeAndrieu> ... My recollection is that there is maybe an interest in describing the architectures in a general way (as it is now) but maybe also concrete examples.
15:55:56 <Wip> Wip has joined #did
15:56:21 <JoeAndrieu> ... This feels like adding the specific examples.
15:56:53 <JoeAndrieu> ottomorac: sounds like this is more specific for each architecture.
15:57:03 <JoeAndrieu> ... this is also blocked by having more guidance
15:57:12 <RRSAgent> I have made the request to generate https://www.w3.org/2025/07/24-did-minutes.html pchampin
15:58:06 <ottomorac> JoeAndrieu: this is not blocked by Simone's guidance....   I think the security considerations section does need to wait, but the let's dive into the diagrams....
15:58:26 <Wip> Yep I think so. We first select the architectures, then model the threats
15:58:33 <manu> agree ^
15:59:18 <RRSAgent> I have made the request to generate https://www.w3.org/2025/07/24-did-minutes.html pchampin
17:10:53 <ottomorac> zakim, end the meeting
17:10:53 <Zakim> As of this point the attendees have been TallTed, ottomorac, KevinDean, pchampin, Wip, JoeAndrieu, markus_sabadello, manu, ivan, JennieM, bigbluehat
17:10:55 <Zakim> RRSAgent, please draft minutes
17:10:56 <RRSAgent> I have made the request to generate https://www.w3.org/2025/07/24-did-minutes.html Zakim
17:11:01 <Zakim> I am happy to have been of service, ottomorac; please remember to excuse RRSAgent.  Goodbye
17:11:02 <Zakim> Zakim has left #did
17:11:26 <ottomorac> RRSAgent, please excuse us
17:11:26 <RRSAgent> I see no action items