14:41:23 RRSAgent has joined #vcwg 14:41:27 logging to https://www.w3.org/2026/05/13-vcwg-irc 14:41:27 RRSAgent, make logs Public 14:41:28 please title this meeting ("meeting: ..."), ivan 14:41:36 Meeting: Verifiable Credentials Working Group Telco 14:41:36 Agenda: https://lists.w3.org/Archives/Public/public-vc-wg/2026May/0024.html 14:41:36 chair: brentz 14:41:36 ivan has changed the topic to: Meeting Agenda 2026-05-13: https://lists.w3.org/Archives/Public/public-vc-wg/2026May/0024.html 14:57:24 brent3 has joined #vcwg 14:57:31 brent3 has left #vcwg 14:57:45 brent has joined #vcwg 14:59:45 phila has joined #vcwg 15:00:00 present+ 15:00:03 wes-smith has joined #vcwg 15:00:58 present+ 15:01:03 hsano has joined #vcwg 15:01:04 present+ 15:01:10 hxavier has joined #vcwg 15:01:17 present+ hxavier 15:01:46 present+ 15:02:19 present+ msporny 15:02:43 present+ brent 15:02:55 present+ bigbluehat 15:03:02 present+ kevin 15:03:22 present+ joeandrieu 15:03:35 present+ 15:03:49 kezike has joined #vcwg 15:03:59 present+ 15:04:07 present+ dlongley 15:04:18 scribe+ 15:04:29 KevinDean has joined #vcwg 15:04:56 present+ Phil-ASU 15:05:05 phila: I'm watching IRC and not Zoom, so please post in IRC if you need anything 15:05:17 present+ kezike 15:05:24 present+ 15:05:32 .... Hiroyuki, could you please introduce yourself? 15:05:38 pdl-asu has joined #vcwg 15:05:46 present+ 15:05:49 Hiroyuki: I met many of you at past events 15:05:49 present+ wip 15:05:52 q+ 15:05:58 ack TallTed 15:05:58 phila: right. Hiroyuki is from Sony 15:06:14 TallTed: I'm Ted and have been attending many of these calls for many years 15:06:30 present+ olvis 15:06:34 ... I will be absent next week, but should be in the week after 15:06:45 phila: thank you, Ted. Anyone else want to do an introduction? 15:06:49 q+ to mention something quickly. 15:07:02 ... k. let's move on to discuss the face-to-face 15:07:04 ack manu 15:07:04 manu, you wanted to mention something quickly. 15:07:15 -> https://docs.google.com/spreadsheets/d/1Emo_yVt90Z5xnHNBPhShO4B7zYQ7kwMfNcOa6sKAdoc/edit?gid=179611341#gid=179611341 15:07:21 ... I think everyone who's coming has already filled in the attendance form 15:07:38 ... but if you haven't and plan to come in person, we need to know now 15:07:45 ... so if fill that in if you're coming 15:08:03 manu: for the face to face, I think we've got several threat modeling things we want to do 15:08:15 Render Method threat model: https://docs.google.com/document/d/1mQg0pdPMfytkAIgsaApODbaKO--PJvr_E4ZM2HoQPzk/edit?tab=t.0#heading=h.py96npebo7ox 15:08:32 Recognized Entities: https://docs.google.com/document/d/1EDKHeg03lXcjCq2_evNI18bUjtmhMU66HvyrCa5gQa0/edit?tab=t.0#heading=h.py96npebo7ox 15:08:32 JoeAndrieu has joined #vcwg 15:08:34 ... and in prep for that, I've created a few documents that cover some brainstroming we've been doing in other groups 15:08:41 VC Data Model: https://docs.google.com/document/d/1lKDPZwezBbTrBM8_OalrKVO4JwPdwZl3nB6eLfJ_-4A/edit?tab=t.0#heading=h.py96npebo7ox 15:08:51 VC Barcodes: https://docs.google.com/document/d/1EWC5EQB-rfDho8lxm5fBhDGAoprTwqLw_o34qKVe6QU/edit?tab=t.0 15:09:07 Wip has joined #vcwg 15:09:11 present+ 15:09:13 q+ to mention possibly having Simone facilitate an exercise 15:09:16 ... the usefulness of using a Google Doc for this is that anyone can contribute and then editors can clean it up 15:09:18 ack JoeAndrieu 15:09:18 JoeAndrieu, you wanted to mention possibly having Simone facilitate an exercise 15:09:32 ... we also have a VCALM one that might show up soon 15:09:42 JoeAndrieu: I'll try and find that one too 15:10:00 ... I wanted to mention that Simone may be available to help facilitate for us at the face to face 15:10:12 ... not sure of the logistics, but he's at least the right timezone 15:10:19 q+ 15:10:24 -> Agenda https://docs.google.com/spreadsheets/d/1h-0OXOR5NsY-OlC0i26mCDK45B15j2BfkL8f2CIY30E/edit?gid=0#gid=0 15:10:25 ... so, chairs, perhaps we can add that to the agenda 15:10:29 phila: that does sound good 15:10:41 ... we've got coffee breaks scheduled so far at least! 15:10:59 ... and we've started accommodating remote participants for some discussions 15:11:00 VCALM draft threat model https://docs.google.com/document/d/11DvzPJhiMuXLLyifA6ANLhT4aOXne_C1rEv4Bedy26M/edit?tab=t.0 15:11:03 ack manu 15:11:14 ... so if we can find a time that works for Simone, then we should try and schedule that 15:11:27 manu: JoeAndrieu do we have a VC Data Model threat model yet? 15:11:34 JoeAndrieu: my hope was to work backwards to that 15:11:53 ... our different task forces seem to have very different attack surfaces 15:12:12 ... but yes, the VCDM threat model is still on the horizon 15:12:28 present+ jennie 15:12:39 phila: most of the EU is taking the day off tomorrow, so scheduling Simone may be tricky 15:12:50 ... brent ivan can one of you get Simone scheduled? 15:12:57 ivan: do we have a preference for the day? 15:13:07 phila: there's a link to the draft agenda in chat 15:13:21 ... so looking at that, it's ideally Tuesday afternoon 15:13:28 ... maybe after lunch? 15:13:39 ivan: k. I'll start there and see what simone needs 15:13:52 -> Social event, Wednesday https://www.belgianbeerworld.be/en 15:13:54 phila: agreed. we can work to accommodate simone's schedule 15:14:15 ... there's a social event, please sign up! 15:14:23 ... the face to face is 3 weeks away 15:15:18 ... Jenny, can you scribe? 15:15:26 Jenny: not this week, I'm on the phone 15:15:36 phila: thank you, sounds good. bigbluehat please continue 15:16:09 topic: https://github.com/w3c/vc-wg/pull/13 15:16:28 phila: ivan, please set the stage 15:16:41 ivan: I promised I'd do an overview, so here goes 15:16:46 https://github.com/w3c/vc-wg/pull/13/changes 15:17:05 ... this PR includes a table of all the vocabularies in progress 15:17:19 ... their context files, formal URLs for the vocabs, etc. 15:17:27 ... where they're stored, etc. 15:17:38 ... hopefully, I did not forget anything 15:17:53 ... manu and dlongley have reviewed so far 15:18:09 ... the question we have to answer is whether we continue this structure 15:18:20 ... using version numbers, etc. 15:18:45 ... and we might need to bump version numbers for context files, vocabs, etc. 15:19:07 ... we haven't historically done this specifically this way, so we need to define this more strictly this time 15:19:30 ... and we need to decide where we put new terms--existing vocabs? or new ones? 15:19:45 ... not all of this needs to be decided today, but we should set down some governance 15:19:49 q+ to note review (LGTM) and future vocab/context work (the governing principles) 15:20:01 ack manu 15:20:01 manu, you wanted to note review (LGTM) and future vocab/context work (the governing principles) 15:20:04 scribe+ 15:20:23 manu: +1 to the PR 15:20:40 manu: Suggested changes I made you merged in, Ivan, thank you. The rest looked good to me, it aligns with what we've been doing for many years now, +1 to that. 15:20:57 manu: With respect to what are the governing principles for the future with vocabs and context files, a couple of thoughts. 15:21:04 q+ 15:21:32 manu: Ivan has created a really useful tool called yml2vocab and it can take a vocab file and auto-generate well-formed JSON-LD context files. He has refined this over the years and we don't even need to handcraft those now we just generate them. We should use that by default for any work in this group. 15:22:01 manu: I think there are some challenges where there are -- like a subset where we want to define something in a base vocab and only use a subset in a context file and, Ivan, that might be another feature we might need. 15:22:02 scribe- 15:22:18 manu: Ideally want to lock in all the URLs for the extension specifications 15:22:28 ... so we need to decide for VC Barcodes 15:22:44 ... I'd suggest we put all the extension terms into the VC Data Model vocab 15:22:58 ... and for the JSON-LD context files, we need to do 2 things 15:23:18 ... a tiny JSON-LD context so those can be mixed into other things like VC1.1 implementations 15:23:35 ... as well as getting those terms into a VCv2.1 context containing all the new extension terms 15:23:47 ack me 15:23:48 ... and make sure all the vocab URLs are in `w3.org` space 15:23:55 phila: thank you 15:24:13 ... as someone who was not deeply involved by how this came about, this looks like a "dog's dinner" 15:24:32 ... I know there's a lot of things in-flight with implementations happening alongside specification writing 15:24:42 ... but now we have multiple namespaces 15:24:49 q+ to note we build a decentralized system, and people are using it :) 15:24:53 q+ 15:25:00 ... some in `w3id.org`, some in `w3.org` 15:25:26 ... the terms specified in the VCDM as part of the recommendation, then part of the process should be to show that those terms have been used 15:25:48 ... and in an ideal world (which is not the one we're in), we'd go back in time and fix all the URIs properly 15:26:01 ... and we could add all those terms as a sidecar to the main vocab 15:26:18 ... but, absent that, it would be good to help developers to explain all the vocab terms 15:26:28 ... how they came into being, etc. 15:26:32 q+ to note each spec does that (point to the proper locations). 15:26:39 q+ to +1 entry point. 15:26:39 ... if that's not absurd, then we need some sort of entry point to this 15:26:47 ack next 15:26:48 manu, you wanted to note we build a decentralized system, and people are using it :) and to note each spec does that (point to the proper locations). and to +1 entry point. 15:26:53 ... I'd love for them to be outside the main vocab, because it all feels like a mess to me 15:27:02 manu: it may feel like a mess 15:27:11 ... because you now see the gory details 15:27:18 ... folks outside just use the VCDM context 15:27:29 ... so they just copy/paste a URL and they're done 15:27:41 ... so maybe you're reacting to the "sausage making"? 15:27:50 ... and not what most developers will need 15:28:04 ... ivan's done a great job of tracking all that down already 15:28:16 ... it'd be great to have a front door, like you descibe 15:28:30 ... and start with "just use the VCDM context" to get started 15:28:44 ... and then maybe mention how to augment that if/when needed 15:28:59 ... we very consciously built this as a decentralized system 15:29:13 ... and to some extent this is exactly how this should play out 15:29:40 yay for decentralized innovation! -- coming together again afterwards is important too to help people understand, +1 for "entry points" 15:29:50 ... we've talked about doing a "clean up"/renaming before, and that usually just runs into what implementations are already doing 15:29:57 ack ivan 15:30:00 ... so, I think from the outside, I think it looks OK 15:30:09 ... but I agree it is hard/ugly from inside the group 15:30:15 ivan: I do agree with you phila 15:30:26 q+ 15:30:38 ... I don't really buy the "it's decentralized" argument, because it's all built by mostly the same group 15:30:47 ... but however it happened, what's done is done 15:31:01 ... happily, though, most of this is starting to take a consistent shape 15:31:12 ... so, if we can continue that, we are at least sort of OK 15:31:28 ... for the "entry point" document, I'd still need to know more about what it would contain 15:31:38 ... it should probably get folded into the overview documenpt 15:32:02 ... having it as a separate document feels too abstract for most people to care about 15:32:06 q+ to note that there seems to be an argument for centralization here -- academic purity (we have all worked on this -- isn't right, there have been varying opinions in the group -- for example, data integrity) -- which the Web doesn't do -- "it would have been nice for all commerce sites to be put under the .com domain name" 15:32:07 s/documenpt/document 15:32:17 ... but we can discuss that 15:32:17 q+ olvis 15:32:18 q-later 15:32:22 q- later 15:32:35 phila: I think that's a great idea to add it to the overview doc 15:32:48 ... point people to the VCDM context and call it good 15:32:51 q+ to note we have those sections already (here's the hash, etc.) 15:33:18 ack olvis 15:33:21 ... just a reminder, if you are naturally quiet person, please feel free to type 15:33:26 ... we want to hear from you 15:33:41 olvis: I appreciate the chance to talk 15:34:03 ... I want to say a consistent vocabulary adds a lot of value 15:34:29 ... for an architecture perspective, a lot of work has been done for the years--which is great and amazing 15:34:39 ... but we also have to consider the current reality 15:34:48 ... and think this through from a user perspective 15:34:58 ... and we should think through some alternative ways related to AI 15:35:27 ... because when we develop documentation and standards, considering AI seems very relevant 15:35:42 ... especially it we include CLIs and things for agents to use 15:36:06 ack manu 15:36:06 manu, you wanted to note that there seems to be an argument for centralization here -- academic purity (we have all worked on this -- isn't right, there have been varying opinions 15:36:07 ... having these vocabs and terms will have a lot of value 15:36:10 ... in the group -- for example, data integrity) -- which the Web doesn't do -- "it would have been nice for all commerce sites to be put under the .com domain name" and to note we 15:36:10 ... have those sections already (here's the hash, etc.) 15:36:23 manu: I think we're getting into some academic purity 15:36:44 ... so, I don't think we're going to reach some level of academic purity 15:36:51 q+ 15:37:00 ... we approached the W3C about a redirect service, and they said no 15:37:04 +1 to manu ... decentralization was required here to make progress 15:37:12 ... which is why we now have `w3id.org` 15:37:17 ... which is fine 15:37:22 ... but now we have what we have 15:37:49 ... there's no consistency of use across domain names 15:38:05 ... even when TLDs were originally intended to classify businesses with `.com`, etc. 15:38:21 ... we really shouldn't fear the URLs that get used in these contexts and vocabs 15:38:33 present+ elaine 15:38:35 ... because controlling them isn't really achievable 15:38:52 ... we can try, but we continue to make decisions that cause problems 15:38:59 try for cohesion and consistency where you can get it, but accept it's ok when you don't always get it (because the trade offs are better than gatekeeping) 15:39:03 ... like putting the VCDM in front of Data Integrity 15:39:05 An index page, that Phil A and Manu have mentioned previously is still a good idea. But that's encough. 15:39:12 ... that was a political choice...and a bad one 15:39:18 ... Data Integrity can be used on it's own 15:39:31 ... but now it has this awkward VCDM namespace in front of it 15:39:31 ack brent 15:39:33 ... which confuses people 15:39:45 ... and that confusion is not technical, but political 15:40:14 brent: w3id.org got brought up as a possibility for the W3C to take on 15:40:18 manu: yes! 15:40:24 Topic: https://github.com/w3c/vc-data-integrity/issues 15:40:50 phila: manu you have issues in the Data Integrity spec 15:41:06 manu: just to make folks aware of what that Task Force is doing 15:41:15 subtopic: https://github.com/w3c/vc-data-integrity/issues/344 15:41:28 ... Greg is involved in this one 15:41:50 ... Greg has taken on the unenviable task of refactoring all the algorithms across all the specs to look for commonalities 15:41:58 ... and then move those into the core Data Integrity spec 15:42:12 ... such as selective disclosure ones 15:42:27 ... many of these are in cryptosuite sub-specs 15:42:41 ... and in issue 344 Greg's working on mapping that out 15:43:00 ... and now that we have FPWDs, he's going to move a bunch of stuff around that is purely editorial 15:43:16 ... that is in prep for the post-quantum work coming into the group 15:43:24 ... anyone have concerns with any of that? 15:43:40 phila: my understanding of what you say, is that it should be a good deal easier to follow what's going on 15:43:46 and reusability of all the algorithms across specs 15:43:55 ... and an improvement in readability and consistently 15:44:21 manu: yes, we have others making new cryptosuites, and this should let them reference existing stuff vs. copy/pasting or recreating it 15:44:33 ... Greg would love help if anyone is interested/able 15:44:46 +1 to this being an excellent editorial upgrade 15:44:53 ... I will note there are a number of "future" issues 15:44:58 ... and I think we're in the future now 15:45:09 ... should we process those today? or put them on a future call? 15:45:21 phila: if there are one or two you want to look at, we can now 15:45:23 subtopic: https://github.com/w3c/vc-data-integrity/issues/340 15:45:29 manu: yes, issue 340 15:45:44 ... this is about cryptographic primitives used on existing mobile phones 15:46:04 ... there is a question around how much we should speak to existing tech 15:46:37 ... there are not secure enclaves on phones today--and I haven't heard of any coming in the next year--that handle post-quantum cryptography 15:46:45 ... so, Apple, for example only support ECDSA 15:47:12 ... we could warn people that current mobile phones when a quantum computer shows up 15:47:39 ... and these existing folks will not be able to safely do a presentation with any of the existing cryptography available on those phones when that happens 15:47:43 q+ 15:47:51 q+ 15:47:51 ack brent 15:47:52 ... we'd have to quickly shift things to newer cryptography 15:48:00 q+ 15:48:08 brent: large tech companies rarely share explicit timelines 15:48:21 ... however, Google said they're planning a fell post-quantum rollout by 2029 15:48:38 ... and they do explicitly mention Android being prepared for that 15:48:50 ... so future phones should be more PQ capable than current ones 15:48:56 ... and perhaps those show up sooner than later 15:49:02 q+ to note "not future" but "present day" 15:49:15 ack ivan 15:49:20 ... for example, I work for a hardware company and we've got an alpha device that is post-quantum ready 15:49:21 q+ to note more about people not upgrading, and not "it will be available" 15:49:43 ivan: how does this effect our specifications, because that is what we're really responsible for 15:49:48 ack phila 15:50:07 phila: I think that's related to my question. I translate what's being said to wonder how much it matters 15:50:23 ack manu 15:50:23 manu, you wanted to note "not future" but "present day" and to note more about people not upgrading, and not "it will be available" 15:50:29 ... are we talking about exclusively smart phones? there are certainly other things out there 15:50:49 manu: +1 to what brent said, there is new stuff coming 15:51:04 ... however, what about the people who don't upgrade 15:51:21 ... it's far less of a concern for large companies using cloud-based HSMs 15:51:28 ... but consumers will suffer 15:51:47 ... if they get into self-sovereign wallets on their current phones 15:52:05 ... and don't upgrade--for financial reasons or any other reason--they'll be at risk 15:52:21 q+ 15:52:30 ... so, should our specifications state that wallets should be prepared to do software-based post-quantum 15:52:56 ack KevinDean 15:53:17 KevinDean: I don't think we do this in a spec 15:53:25 ... this is a very broad problem 15:53:42 ... we can mention it, but really this would be in a threat model doc 15:53:50 phila: is that the answer you needed manu ? 15:53:54 Topic: Overview 15:53:58 -> https://www.w3.org/TR/vc-overview/ 15:54:00 manu: yeah, sound like "write threat model text" 15:54:18 phila: ivan wrote an Overview document awhile back 15:54:25 ... and I'm keen to get more folks involved 15:54:34 ... this doc is our primer / start-here / etc. 15:54:52 ... and I wonder if people in this group who are not the "usual suspects" who talk a lot 15:55:01 q+ 15:55:03 ... could look to contribute to this Overview document 15:55:14 ... and to see if you might write some new text for this document 15:55:16 ack bigbluehat 15:55:29 ack ivan 15:55:34 ... it would help everyone 15:55:56 ivan: I'm very supportive of what you said 15:56:01 ... but it might be a bit early 15:56:22 ... we could get a unified architecture of the whole thing into this document...eventually 15:56:38 ... but right now there are a high number of satellite documents 15:56:43 ... and those need to settle down 15:56:53 ... so, 3-4 months from now, that would be great 15:56:57 phila: so, TPAC? 15:57:02 ivan: yeah, that would be better 15:57:17 phila: following our face-to-face will be in October in Dublin 15:57:27 ... 2027 will be in December in Panama 15:57:38 ... thank you everyone! 15:57:39 rrsagent, draft minutes 15:57:41 I have made the request to generate https://www.w3.org/2026/05/13-vcwg-minutes.html ivan