14:19:30 RRSAgent has joined #vcwg 14:19:35 logging to https://www.w3.org/2026/08/19-vcwg-irc 14:19:35 RRSAgent, make logs Public 14:19:36 please title this meeting ("meeting: ..."), ivan 14:19:38 Meeting: Verifiable Credentials Working Group Telco 14:19:38 Agenda: https://lists.w3.org/Archives/Public/public-vc-wg/2026Aug/0019.html 14:19:38 chair: brentz 14:19:38 ivan has changed the topic to: Meeting Agenda 2026-08-19: https://lists.w3.org/Archives/Public/public-vc-wg/2026Aug/0019.html 14:28:34 bigbluehat has joined #vcwg 14:52:29 brent has joined #vcwg 14:57:35 Carolynn has joined #vcwg 15:01:02 phila has joined #vcwg 15:01:28 present+ 15:01:35 present+ carolynn 15:01:39 wes-smith has joined #vcwg 15:01:43 present+ 15:01:52 present+ saad 15:01:59 JennieM has joined #vcwg 15:02:02 present+ brentz 15:02:08 present+ 15:02:09 saad has joined #vcwg 15:02:25 present+ phila 15:02:27 JoeAndrieu has joined #vcwg 15:02:41 present+ bigbluehat 15:02:41 pdl-asu has joined #vcwg 15:02:41 present+ 15:02:43 present+ TallTed 15:02:43 present+ 15:02:50 present+ joe 15:02:52 present+ 15:03:27 present+ 15:03:39 present+ 15:04:33 JimR has joined #vcwg 15:04:39 scribe+ 15:04:46 scribe+ 15:04:51 present+ jimr 15:04:55 brent: Welcome everyone, we'll get started in a bit 15:04:59 present+ 15:06:00 brent: This is the primary telecon for the week, we are meeting under the W3C following the IPR , code of conduct, and process of W3C. 15:06:24 exe has joined #vcwg 15:06:30 present+ exe 15:06:42 brent: Our agenda for today -- we will start with a brief look at the digestSRI issue, we will go into task force updates, we'll talk briefly about relationship between DPP and RecognizedEntities, a bit about TPAC and GDC, and then the primary focus is a conversation about threat models. 15:07:01 brent: please feel free to provide changes/additions to agenda 15:07:01 q+ 15:07:09 q+ 15:07:10 ack manu 15:07:26 ack ivan 15:07:30 manu: There is an internationalization issue we should cover. 15:07:46 iherman: Perhaps we should have Jim introduce himself? 15:07:55 q+ 15:08:29 JimR: I am Jim Richards, CISO for ONEPROOF, doing digital IDs and ISO and OpenID harmonization. Prior to thsi work 20+ years work in government, security architect of Wisconsin RealID, worked a lot in physical ID speace, some in digital ID space. 15:08:46 JimR: I have experince for European manufacturing company, UK, and Germany, dealt with privacy laws there. 15:08:57 ack Carolynn 15:09:09 Carolynn: I have a question, can we ask about Recognized Entities work? 15:09:18 brent: Yes, we have a RE and DPP item coming up, would it fit in there? 15:09:30 brent: if it doesn't fit in that conversation, make sure to mention it. 15:09:35 brent: Let's take the i18n issue first. 15:09:37 q+ 15:09:40 Topic: Internationalization issue 15:10:14 subtopic: https://github.com/w3c/vc-data-model/issues/1641 15:10:29 ack manu 15:11:55 q+ 15:12:21 present+ will 15:12:23 Wip has joined #vcwg 15:12:26 present+ 15:13:41 present+ 15:14:16 manu: Re: 1642, the internationalization group gave feedback during the horizontal review, that we were being inconsistent in ou use of string values , and we need to be specific about when strings are localizable. 15:15:00 s/1642/1641/ 15:15:01 manu: the current proposal is to add a new term for a localizable value in the verifiable credential data model. 15:15:15 s/ou use/our use/ 15:15:33 manu: I can raise the pull request unless there is an objection, or if someone has a better way to address this issue. 15:15:40 ack ivan 15:15:56 q+ 15:16:34 q- 15:16:40 michaelshea has joined #vcwg 15:16:46 present+ 15:18:19 Ivan: I have no objection, there is separate vocab specification. The tool has been upgraded to address the features Manu expressed, but the work needs to be done 15:18:22 ack JoeAndrieu 15:19:15 q+ 15:20:21 scribe+ 15:21:04 q? 15:21:08 ack manu 15:21:31 JoeAndrieu: +1 to management proposals, coming up with a term for what is localizable. How do we deal with images, because it is not covered and there may be no solution. 15:21:36 manu: +1 to that Joe, I think this one is specific to string values, hyper focused, trying to solve the hyper focused thing, we're vague when we say string, need to fix that 15:22:07 q+ 15:22:30 manu: other can of worms problem, absolutely struggling with that in Render Methods spec, tag render template with thing - images, audio, everything covered, person viewing has said they have arabic as localization, I'll go to arabic template . . . 15:22:36 q- 15:22:48 +1 that "within the template" using the HTML render method might solve a lot 15:22:50 ... other alternatives as well, active points of discussion in render method if you want to help there 15:23:10 Brent: sounds like we have a path forward, plus additional conversation . . . 15:23:18 Topic: DigestSRI/DigestMultibase 15:23:34 subtopic: https://github.com/w3c/vc-data-model/issues/1628 15:24:42 Brent: issue recommends deprecating DigestSRI as related resource . . . 15:25:25 ... right now the VC Data Model supports two options, DigestSRI and DigestMultibase, issue recommends deprecating to rely on Data model, significant pushback from dev is Japan making use of DigestSRI . . . 15:25:34 q+ 15:25:52 ... happy to take comments, Shigeya's schedule making it difficult to attend call, may be channeling his thoughts, and may need to put off to TPAC . . . 15:25:56 ack phila 15:26:23 Phila: what to help group move forward, came up in our F2F in June, noted at the time Shigeya's response, which was impassioned . . . 15:26:53 ... if I wear GS1 hat, no skin in game, approaching purely as Brent's co-chair, what I see is one very influential company pushing for something, and I see another member of the group, eminent professor in Japan, arguing against . . . 15:28:01 ... mentioned those features of Digital Bazaar and Shigeya, had one-to-one with Shigeya recently, thinks deprecating would be real problem, doesn't want it to happen. Others want it to happen, what would be middle ground, not forcing anyone to implement anything they don't want to, unless you get to a spec . . . 15:28:39 present+ denkeni 15:28:50 ... would Shigeya be willing to add open source code, he said yes, and in the last 24 hours has argued his case with evidence, Dave has responded, seems to me it is a feature in VCDMII, would cause harm if deprecated . . . 15:29:10 q+ 15:29:12 ... personal view is that DigestSRI should stay . . . 15:29:21 I have made the request to generate https://www.w3.org/2026/08/19-vcwg-minutes.html TallTed 15:29:33 ack manu 15:30:12 manu: thank you for the summary, only part I disagree with is the framing that this is coming from one org, discussed this in great depth during recognized entities call, +1s from lots of people on the call, deprication doesn't mean removal, just stop using it . . . 15:30:40 ... technical issues if we keep using it, more than one company weighing in on this, don't know anyone else fighting hard for this feature except for one org in IETF . . . 15:30:58 q+ to ask about profiling 15:31:04 present+ JoeAndrieu 15:31:36 q+ to say we still need guidance for other specs and to note the need to fork for stability 15:31:42 s/iherman/ivan/g 15:31:50 ... concern I have is that we are not making a technical decision if we keep it in the spec, making a political one, don't think it is a good thing to do. Will world explode if we keep it in the spec? no, and not a good thing to use too much of the group's time, but it will keep coming up if there is push to use DigestSRI, will just move into the task forces. 15:31:51 q+ 15:32:02 I have made the request to generate https://www.w3.org/2026/08/19-vcwg-minutes.html TallTed 15:32:08 ack brent 15:32:10 ... I'm happy to leave it alone if we should be making a political decision over a technical, but we should move on 15:32:37 q+ to note it's perfectly possible to profile. 15:32:49 Brent: just in general, the way we have tended to do things in the working group is to support people in the things they need to do their work, as long as it doesn't keep others. historically having more than one option to do things has been the way we've done things 15:33:53 ... I think it is technically better to choose one, but our path forward is to error correct, or to continue on. In other cases, for this spec we are using VC Data model, and must use DigestMultibase, is this an option, would this alleviate some of the difficulties 15:33:59 ack dlongley 15:34:00 ...spend 5 more minutes 15:34:40 Dave: that might alleviate some of these things, some may need their own guidance in what they should pick. Don't think it would be good to leave it open and have this come up with every other spec, would prefer us to say in VCDM to recommend one over the other... 15:35:20 ...that being said, DigestSRI may have a problem, linking to a spec in working draft status that is in perma-working draft status... 15:35:55 I have made the request to generate https://www.w3.org/2026/08/19-vcwg-minutes.html TallTed 15:36:14 ...just incidental fact that hash algorithms in spec have been historically stable, if one removed, we'd have a gap. More or less what I made in my comment, really only have the appearance of compatibility because we don't use processing rules, will have this gap, won't work right... 15:36:52 ack phila 15:36:54 Brent: would help to adjust to say that DigestMultibase is recommended, significant issues relying on DigestSRI 15:37:53 Phila: Shigeya has volunteered to write more 15:37:58 ack manu 15:38:38 manu: +1 brent, do think profiling is the way we've done it, we should do it this time, what we tried to do in recognized entities spec; +1 to what Phil said, don't want to make decisions without people in the room... 15:39:08 phila: Also noted that the Rec Ent TF call is at 05:00 Tokyo time so an issue that is of particular interest to anyone in Japan can't be resolved at that time. 15:39:35 ...not consensus to add DigestSRI, profiling may work, don't want to spend much time in the group talking about it, but if we don't come to a decision, it will continue 15:39:37 q+ 15:40:21 ack manu 15:40:23 Brent: timing-wise for spec, chair hat off, personally, I'm fine, and Phil is fine putting this off until TPAC when we can solve in a room together, but that feels like that may impact timelines, so final question is - is putting this off until TPAC an option? 15:40:43 manu: we can put it off until TPAC, editors can say we haven't quite figured this out, but can go into candidate rec stating that... 15:40:48 +1 to manu 15:40:53 ...most fair thing to do is wait until we have everyone the room 15:41:09 Topic: Task Force Updates 15:41:47 q+ 15:41:52 ack wes-smith 15:41:54 q+ for VCALM update 15:42:27 ack kezike 15:42:31 wes-smith: brief update for barcodes and data integrity, call for horizontal review is now out, data integrity is progressing at good clip, ongoing work on selective disclosure. Work also going on with ??? hope to get the call out in the next few weeks 15:42:37 q+ to note "we're trying to figure out how to publish threat models the right way" 15:42:48 s/???/forgery defence/ 15:43:21 kezike: main two things to note are that we've submitted requests for review for accessibility and internationalization, security and privacy in the next couple weeks, after resolution last week able to submit registration for that, should resolve soon. After which, we should have URIs reserved for us 15:43:38 Brent: possible request for Ivan to check on ianna 15:43:44 q+ 15:43:56 q- later 15:44:00 ack ivan 15:44:01 kezike: asked for a personal contact to use, seems like Ivan is best choice, only things outstanding for URIs to be reserved 15:44:13 q+ 15:44:14 q+ for confidence method update 15:44:28 +1 to get the registration and then make contact adjustments as needed 15:44:36 Ivan: fine to use my name, or mine with Manu's, but not a long-term solution. once registered, we should put contact name back to working group. 15:44:48 Brent: is there a W3C liaison address we can use? 15:45:01 kezike: this is just for the request 15:45:01 ack manu 15:45:08 q- 15:45:52 manu: a number of us working on threat models are trying to figure out the right way to publish those, just a heads up to the group, trying to figure out publication process. Trying to make it easy on everyone, stay tuned 15:45:54 ack dlongley 15:45:57 ack denkeni 15:46:34 denkeni: confidence methods, task force decided to keep original name, add assurance ? as well, and to keep short URL names. Almost finished with first draft, will hopefully start in to discuss threat modeling at the next meeting 15:46:40 q+ to ask for agenda time before we wrap (about TPAC scheduling) 15:47:02 Topic: DPP + Rec Entities discussion 15:47:55 s/assurance ?/assurance levels/ 15:48:07 Carolynn: so, Monday, in DPP task force, Ivan told us about the work going on in Rec Entities, discussed it, Ivan curious what is the relationship between the two... 15:48:32 q+ to note that there is overlap, but not replacement -- it is very much related work. 15:48:43 ...turns out the two examples provided in Rec Entities are very close/relevant, Ivan wanted to know if it would make sense to add a DPP specific example in spec... 15:49:06 ...don't have an opinion, would it make sense to add a DPP specific example... 15:49:06 q+ 15:49:16 ack manu 15:49:17 ...have one on GS1 and one on trade documents 15:50:13 manu: yes, we should do this. I think we should add a DPP use case to appendix, would love to get input on what it should be. Overlap, but it is not a replacement overlap. Related, but Rec Entities is focused on chain of entities to top root of trust. Would love to put examples in, just let us know how... 15:50:33 ...some of us are happy to come to DPP group, just let us know when to do that 15:50:57 Carolynn: I was reading the spec from Rec Entities, chapter 4 is on discovery algorithms, which may be a better name for the title of the chapter ... 15:51:06 q+ to speak to discovery algorithms and illustration of discovery algorithms. 15:51:52 ...examples in appendix B illustrate to discovery algorithms, but real question is - is there a plan/discussion on the pros and cons of the two discovery algorithms? way to have the conversation, or place in the document? spec recommending two... 15:52:21 ...have working relationship with people working on SDJot, asked them how they do discovery in their context, started to get some reactions from them... 15:52:34 ...could be interesting as we are considering pros and cons of different approaches 15:52:41 ack phila 15:53:29 ack manu 15:53:31 Phila: carolynn, let's chat offline, certifications certainly the big use case, I think an example in there... 15:54:26 s/after resolution last week able to submit registration for that/after resolution last week able to submit IANA registrations for “interaction” and “web+interaction” URI schemes/ 15:54:39 manu: two discovery algorithms, yes different appendices point to each one, trying to get implementers to tell us which they prefer and why, benefits and drawbacks in both. Afraid to say something to early as people are still figuring it out. Not an expert in SDJot, know in implementations we've had to do they tend to just depend on x509 15:54:39 certificates, do speak to a bit of that in spec... 15:56:02 ...vc data model, group exists because x509 certs have limitations, seeing these as they are deployed in trust infrastructure in mdoc and mdl, not going super great, but tends to be what sdjot and mdl rely on. Danger of putting a this is what is good and this is what is bad on it is that we end up in endless discussion and that burns a lot of time 15:56:38 ...things have shifted, don't think anyone enjoyed the process, drove a wedge between the groups and I'm reticent to do that. Here are the reasons to use each, and mark that implementors decide, rather than picking a fight 15:56:51 Brent: sounds like we have steps forward, last topic is TPAC 15:56:52 ack JoeAndrieu 15:57:11 q+ 15:57:12 q+ 15:57:15 q- 15:57:31 JoeAndrieu: my request is short, is there a way we could get the calendar to remove cancelled meetings? duplicate meetings, unsubscribed and resubscribed, get conflicts. Can we get the adjustment? 15:58:07 Brent: option when you are importing by URL if subscribing to W3C calendar to not include cancelled events, my calendar hasn't quite figured out what is going on, but in theory, if you do that, cancelled things won't show up 15:58:48 Ivan: the way I found it a while ago, go to your own calendar page, go to very end, then it will give you an ICS link with feature. checkbox is new 15:59:01 JoeAndrieu: i bet this will work 15:59:09 ack ivan 16:00:04 Brent: GDC is in a couple weeks, quite a few members of working group will be there, W3C official organizer. Opportunities to talk with governments and organizations looking to modernize digital identity infrastructure, both corporate and personal. If people from this group are going and would like to coordinate, please reach out... 16:00:47 ...signal group called GDC Standards Track, I can add you to the group. and we are at time, so we will talk about TPAC and Threat Modeling next time 16:00:59 fwiw, command-down gets you *straight* to the bottom of `my calendar` page 16:01:17 ...grateful to scribes, and to all the work being done in task forces, moving forward quite efficiently and it is great to see 16:01:33 rrsagent, draft minutes 16:01:34 I have made the request to generate https://www.w3.org/2026/08/19-vcwg-minutes.html ivan 16:01:49 rrsagent, bye 16:01:49 I see no action items