W3C home > Mailing lists > Public > public-credentials@w3.org > July 2020

[MINUTES] W3C Credentials CG Call - 2020-07-21 12pm ET

From: W3C CCG Chairs <w3c.ccg@gmail.com>
Date: Thu, 23 Jul 2020 11:51:15 -0700 (PDT)
Message-ID: <5f19dc23.1c69fb81.525da.ac01@mx.google.com>
Thanks to Markus Sabadello for scribing this week! The minutes
for this week's Credentials CG telecon are now available:

https://w3c-ccg.github.io/meetings/ 2020-07-21 

Full text of the discussion follows for W3C archival purposes.
Audio from the meeting is available as well (link provided below).

----------------------------------------------------------------
Credentials CG Telecon Minutes for 2020-07-21

Agenda:
  https://lists.w3.org/Archives/Public/public-credentials/2020Jul/0062.html
Topics:
  1. Introductions and Re-Introductions?
  2. Action Items
  3. Credentials not in JSON
  4. Updates on Secure Data Storage on DIDComm
Organizer:
  Kim Hamilton Duffy and Wayne Chang and Heather Vescent
Scribe:
  Markus Sabadello
Present:
  Wayne Chang, Markus Sabadello, Heather Vescent, Joe Andrieu, Sam 
  Curren, Geun Hyung, Simone Ravaoli, Dmitri Zagidulin, Christopher 
  Allen, Manu Sporny, Kim Hamilton Duffy, Dave Longley, James 
  Chartrand, Brent Zundel, Nacho Alamillo, Juan Caballero, Kerri 
  Lemoie, Lluís Alfons Ariño, Jonathan Holt, William OKeefe, 
  Anthony Camilleri, William Claxton, Adam Lemmon, Ganesh Annan, 
  Jeff Orgel, Nate Otto, Orie Steele, Anil John, Kaliya Young, 
  Chris Winczewski, Erica Connell, Adrian Gropper
Audio:
  https://w3c-ccg.github.io/meetings/2020-07-21/audio.ogg

Manu Sporny: Also, Kim did all of the work.
Heather Vescent: https://www.w3.org/community/credentials/join
Heather Vescent: Scribes: 
  https://docs.google.com/document/d/1LkqZ10z7FeV3EgMIQEJ9achEYMzy1d_2S90Q_lQ0y8M/edit#heading=h.ngyk8y939osi
Juan Caballero: Big thanks to markus for scribing
Markus Sabadello: Scribe+
Heather Vescent:  Thanks to the scribe on last week's call 
  [scribe assist by Markus Sabadello]

Topic: Introductions and Re-Introductions?

Juan Caballero: Nacho alamillo
Nacho Alamillo:  I'm on a team working on eIDAS, now part of a 
  legal team looking at signatures on VCs. [scribe assist by Markus 
  Sabadello]
Heather Vescent:  Jonathan_holt do you want to re-introduce 
  yourself? [scribe assist by Markus Sabadello]
Nacho Alamillo: Thanks, Chris
Jonathan Holt:  I'm a physician by training, trained in clinical 
  informatics. Worked on a series of companies. Now CMIO at 
  Consensys Health. [scribe assist by Markus Sabadello]
William Claxton:  William from Brussels, project manager on 
  project EuroPass, run by the E.U. commission. Some of my 
  colleagues are also on this call today. We are interested in 
  cooperation between EuroPass and W3C [scribe assist by Markus 
  Sabadello]
Manu Sporny: So awesome to have Nacho and William here on the 
  call today! :)
William Claxton:  EuroPass is project related to skills and 
  qualifications, building tools and standards to implement skills 
  and qualifications across the E.U. [scribe assist by Markus 
  Sabadello]
William Claxton:  Our guiding principle is that what we do should 
  be W3C compliant. [scribe assist by Markus Sabadello]
William Claxton:  Thanks for inviting us to the call. [scribe 
  assist by Markus Sabadello]
Lluís Alfons Ariño: Lluís Ariño
Lluís Alfons Ariño:  I am one of the two convenors of the diploma 
  use case. Related to what William introduced, we will use 
  EuroPass. [scribe assist by Markus Sabadello]
Heather Vescent:  Topic: Announcements and reminders. [scribe 
  assist by Markus Sabadello]
Heather Vescent: https://w3c-ccg.github.io/announcements/
Markus Sabadello is scribing.
Heather Vescent:  This is the 6th weeks of Identiverse, I just 
  recorded a video for that. It will go on for another 2 weeks. 
  Registration is free. There are a lot of really cool sessions.
Jeff Orgel: Amen to the Henry point of view!!
Heather Vescent:  We have a few recurring CCG meetings. This here 
  is our regular CCG call.
Heather Vescent:  We also have a VC for Education Task Force 
  call, headed by dmitriz and kimhd
Heather Vescent:  We also have DID Resolution calls on Mondays.
Dmitri Zagidulin: I think Heather means someone else - I am 
  merely attending the VC Edu calls occasionally
Heather Vescent:  And the third one is the Secure Data Storage 
  call, on Thursdays.
Dmitri Zagidulin: Yeah that's em!
Dmitri Zagidulin: Me
Heather Vescent:  Sorry dmitriz you are on the Secure Data 
  Storage call, not VC for Education Task Force.
Heather Vescent: 
  https://github.com/w3c-ccg/community/issues?q=is%3Aopen+is%3Aissue+label%3A%22action%3A+review+next%22

Topic: Action Items

Heather Vescent:  Kimhd do you want to give an update on Action 
  Items?
Kim Hamilton Duffy:  Regarding 
  https://github.com/w3c-ccg/community/issues/143, we closed that 
  on last week's call, chairs will act on it this week.
Heather Vescent: Issue 143: 
  https://github.com/w3c-ccg/community/issues/143
Kim Hamilton Duffy: 
  https://github.com/w3c-ccg/community/issues/142
Kim Hamilton Duffy:  Thanks to Orie_ , we got some insight into 
  community group licenses.
Kim Hamilton Duffy:  There are two take aways: 1. We have an 
  increasing amount of work items related on sample 
  implementations. The community license doesn't really cover work 
  like this.
Kim Hamilton Duffy:  This license is about specs and test suite, 
  but may not be suitable for all implementations
Kim Hamilton Duffy:  Orie_ suggested Apache2, the chairs need to 
  follow up on this
Kim Hamilton Duffy:  The default LICENSE.md we include in repos 
  is missing the full text of the W3C's recommend CG license
Kim Hamilton Duffy:  We need to update all the existing repos 
  accordingly
Kim Hamilton Duffy:  We will try to make it easier to do the 
  right thing going forward, so things are set up correctly
Orie Steele: Yes, thanks to Kim for tracking this down!
Heather Vescent:  Thanks kimhd for your diligent follow-up on the 
  licensing topic, this is hard work that gives clarity
Kim Hamilton Duffy: 
  https://docs.google.com/presentation/d/1R_vM55wQyJ5jiiD6ro3crCFIvC2TGxyZ8_B2t45RXFo/edit?usp=sharing
Heather Vescent:  We will start now with the "Credentials not in 
  JSON topic"

Topic: Credentials not in JSON

Kim Hamilton Duffy:  I will go through my slide deck quickly, so 
  we can then get everyone to contribute their part
Kim Hamilton Duffy:  Please open above link, I will walk through 
  it
Kim Hamilton Duffy:  We had subject matter expects Ignacio 
  Alamillo and Anthony Camilleri who have been very active in this 
  space.
S/expects/experts/
Manu Sporny: Slide 2
Heather Vescent: Noise?
Kim Hamilton Duffy:  We have the VC in Educations task force. One 
  of our topics is to come up with examples that can be used in 
  pilots.
Heather Vescent: Voip noise?
Kim Hamilton Duffy:  There is however a lot prior work on 
  educational data standards.
Kim Hamilton Duffy:  But for using these, one challenge is that 
  we need to work with XML
Kim Hamilton Duffy:  The goal is to try to find possible 
  solutions
Kim Hamilton Duffy:  In contrast to other use cases, in this are 
  there is a lot of precedent of Linked Data use, e.g. for 
  competencies definitions.
Kim Hamilton Duffy:  All of this work enables alignment and 
  transferability
Kim Hamilton Duffy:  One example application is Credential Finder
Kim Hamilton Duffy:  There is also a lot of precedent in the 
  European Qualification Framework, there is a lot of work on 
  alignment of different levels of achievements.
Kim Hamilton Duffy:  There is also LER Hub, which is gathering 
  resources.
Kim Hamilton Duffy:  If your degree data is outdated, it limits 
  your capabilities, so this is about empowering people.
Kim Hamilton Duffy:  The idea that records need to be portable is 
  becoming more important.
Kim Hamilton Duffy:  There is a lot of existing work in XML, what 
  do we do with it? Two examples.
Kim Hamilton Duffy:  Example 1: EDCI... Mapped the VC data model 
  to XML.
Kim Hamilton Duffy:  Currently VC has two serializations, but it 
  should be possible to support others.
Manu Sporny: Very happy that EDCI authors are on the call today 
  so we can talk about this... think there is a better solution.
Manu Sporny: (That is just a slight change from what they're 
  doing)
Kim Hamilton Duffy:  Why did they do it? There are eIDAS digital 
  signature requirements. There's a need to use XML.
Kim Hamilton Duffy:  VC data model does not currently define an 
  XML serialization.
Manu Sporny: Noooo, XML jamming!
Kim Hamilton Duffy:  Example 2: A common way to express 
  transcripts on the college and high school level. Done in XML.
Manu Sporny: I mean, XML Jamming works...
Kim Hamilton Duffy:  In our VC for Education group, what guidance 
  do we give? What's okay as a short time measure?
Kim Hamilton Duffy:  Other options we have not seen yet are 
  mapping XML to JSON or JSON-LD. We haven't seen this yet but it 
  has been discussed. This needs discussion by the standards group.
Kim Hamilton Duffy:  Given there are different requirements, e.g. 
  in the case of eIDAS, this may support one solution over another.
Kim Hamilton Duffy:  (Showing slide 8 now)
Kim Hamilton Duffy:  Say that we did support XML as a VC 
  serialization. Then what about the legal signature requirements?
Kim Hamilton Duffy:  I'd like to invite our legal experts to give 
  context.
Kim Hamilton Duffy:  NachoAlamillo and larinyo ?
Kaliya Young: Present_
Lluís Alfons Ariño: Nacho speaking
Kaliya Young: Can you please re-share the link to she slides :)
Kim Hamilton Duffy: 
  https://docs.google.com/presentation/d/1R_vM55wQyJ5jiiD6ro3crCFIvC2TGxyZ8_B2t45RXFo/edit#slide=id.g8c7bea63ca_0_68
Heather Vescent: 
  https://docs.google.com/presentation/d/1R_vM55wQyJ5jiiD6ro3crCFIvC2TGxyZ8_B2t45RXFo/edit#slide=id.g8c7bea63ca_0_68
Nacho Alamillo:  In the EU we have the regulation that supports 
  the movement of legal documents between member states. There is a 
  regulation that define the syntax formats. There are 
  specifications for advanced signatures. If you use any format in 
  the E.U. decision, any member state will recognize it.
Manu Sporny: XADES -- https://en.wikipedia.org/wiki/XAdES
Nacho Alamillo:  Right now, we have 4 technical formats which are 
  recognized.
Lluís Alfons Ariño: CADES
Lluís Alfons Ariño: PADES
Manu Sporny: CADES -- 
  https://en.wikipedia.org/wiki/CAdES_(computing)
Manu Sporny: PADES - https://en.wikipedia.org/wiki/PAdES
Lluís Alfons Ariño: I know Nacho ;-)
Nacho Alamillo:  You have a lot of freedom to use these profiles 
  with respect to content. You don't have to go through XML 
  serialization.
Nacho Alamillo:  (Discussing features of the different formats)
Nacho Alamillo:  It doesn't preclude you from using non-XML 
  formats for the signatures.
Manu Sporny: JADES
Nacho Alamillo:  We are also working in EBSI, inside the 
  technical committee, we are working on a new technical 
  specification (JADES - JSON Advanced Electronic Signatures)
Juan Caballero: !!!
Nacho Alamillo:  This specification is still non-public, but it 
  may be possible to share it in a limited scope
Manu Sporny: JADES 
  https://www.sciencedirect.com/science/article/abs/pii/S0920548919300960
Nacho Alamillo:  This is eIDAS in JSON format. We extends JSON 
  Web Signatures by defining additional header parameters.
Lluís Alfons Ariño: Jades is been work in ETSI (not in EBSI)
Nacho Alamillo:  We are doing something similar for JWS as we 
  have already done with XML.
Orie Steele: You can use JWS in LD Proofs..
Nacho Alamillo:  We can align JWS with eIDAS
Orie Steele: https://github.com/w3c-ccg/lds-jws2020 ( this used 
  detached JWS, which does support a JWS header)
Nacho Alamillo:  You can use JADES to sign the VC, without 
  transforming it to XML.
Nacho Alamillo:  You can also use JADES with a special 
  transformation method
Nacho Alamillo:  We have to wait for JADES to get approved
Nacho Alamillo:  Hopefully we will have a first version of it 
  this year.
Lluís Alfons Ariño: EBSI eIdas Bridge
Nacho Alamillo:  In the regulation, it's also possible to support 
  different methods to validate signatures. We have explored this 
  in the EBSI project, there is work happening on an eIDAS bridge. 
  I have written about this is in my legal report.
Lluís Alfons Ariño: EIdas bridge: 
  https://joinup.ec.europa.eu/collection/ssi-eidas-bridge/about
Lluís Alfons Ariño: Anthony speaking now
Lluís Alfons Ariño: EBSI: 
  https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/ebsi
Lluís Alfons Ariño:  There is a different between draft standards 
  and it actually being available to public administrations. You 
  would probably talk about 3-5 years of lag before this hits the 
  type of production we are talking about.
Lluís Alfons Ariño:  In the meantime, in the meantime, Europe has 
  built its educational infrastructure on XML, e.g. for exchanging 
  student data in XML.
Lluís Alfons Ariño:  I've been heading one of those, trying to 
  express VCs and XML
Lluís Alfons Ariño: 4 Signature formats: Digital signature : 
  XAdES, CAdES, PAdES and ASiC-S/ASiC-E
Lluís Alfons Ariño:  The reason I'm giving this information, this 
  is all standardization work. We are aiming for two things. We 
  hope to have an XML recommendation from VC Task Force that would 
  allow us to say that we can be in line using XML, but probably 
  will want to change to JSON over time.
Lluís Alfons Ariño:  We are talking about issuing credentials in 
  the millions.
Lluís Alfons Ariño:  We woud like an XML namespace dedicated to 
  VCs.
Lluís Alfons Ariño:  Second, it would be very very nice to be 
  able to have a schema definition file that says this is a 
  recommended implementation of VCs in XML.
Lluís Alfons Ariño:  I'm not technical enough to talk about XML 
  vs. RDF/XML, but a high level message is that it will be 
  preferable to have a schema definition recommended by the CG.
Kim Hamilton Duffy:  Back to you heathervescent for queue 
  management
Orie Steele:  This is really exciting work, I have done some 
  experiments converting JSON-LD VCs to XML and back. Depending on 
  your tolerance, there are mechanisms for converting. There are 
  similar mechanisms for binary representations.
Orie Steele:  We can rely on JSON-LD vocabularies, and then 
  convert to other serializations. The advantage is that you don't 
  have to repeat vocabularies in each seralization, but only have 
  to do it once.
@Orie we are seeing similar things dealing with conversions 
  between xml and jsonld in particular for supply chain and retail 
  legacy formats
Manu Sporny:  First, thank you William NachoAlamillo larinyo for 
  being here, this is very important and this group cares deeply. 
  Second, this is the right place, there is a lot of experience in 
  this group, please continue to engage with it.
Manu Sporny:  Also, work that happens here (e.g. XML 
  serialization of VCs) can then go into the VC Maintenance WG.
Manu Sporny:  Regarding what to specifically work on, I heard 
  each of you mention two primary thigns.
Manu Sporny:  One is a requirement for a clean XML 
  representation. The second has to do with digital signature 
  formats that you just outlined.
Manu Sporny:  Ideally we would provide a profile that matches 
  well with XML. One failure scenario would be to try to support 
  absolutely everything.
Manu Sporny:  There would be too many options, we should reduce 
  optionality.
Manu Sporny:  The other important thing, as Orie_ mentioned, a 
  few of us have been working on converting VCs into other formats, 
  e.g. CBOR or XML.
Nacho Alamillo: Agree. In fact, the idea of having advanced 
  electronic signature "baseline" profiles is to reduce complexity, 
  yes
Manu Sporny:  There are some common design patterns we can use 
  for full round-tripping.
Manu Sporny:  What we would need to know is feedback on the XML 
  format, what should it look like. And we need to understand the 
  exact requirements for the digital signatures.
Lluís Alfons Ariño: Europass EDCI Data model 0.9.0 
  https://github.com/european-commission-europass/Europass-Learning-Model/tree/release/0.9.0
Manu Sporny: Yes, let's keep it simple!
Kim Hamilton Duffy: I don't have anything, I was just wanting to 
  queue up Nacho and Anthony before they have to drop :)
Lluís Alfons Ariño:  If there is openness to support XML, it may 
  actually be quite simple.
Manu Sporny: For example: Go to XML, use XADES.
Lluís Alfons Ariño:  We have a lot of documentation on all of 
  this
Nacho Alamillo:  We should go for JADES for the baseline 
  standard.
Nacho Alamillo:  We don't believe in issuing VCs in PDF (using 
  PADES)
Xml .... lots of possibilities...
Manu Sporny:  Thanks a lot to kimhd for putting the slide deck 
  together
Heather Vescent: +1 Thank you Kimhd!
Juan Caballero: Baseline profiles here: 
  https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/eSignature+standards?reload=true
Manu Sporny:  If we can take PADES off the table, that's good 
  since it's one option less we need to consider.
Manu Sporny:  Did you say XADES or JADES are already a standard? 
  If we can focus on of those, it should be achievable.
Manu Sporny:  Potentially we could even get it on standard track.
Juan Caballero: XADES = standard, JADES = coming soon
Nacho Alamillo: Yes, today's solution should be based in XAdES
Juan Caballero: If i understood currently
Lluís Alfons Ariño: Right, today: XML+Xades
Manu Sporny:  I'm hearing a strong requirement to encode in XML. 
  If that's a hard requiement, then maybe what we should do is an 
  XML serialization. I'm not sure if this is the preference
Juan Caballero: (Also Manu's explicit pronunciation of X-ADES is 
  helpful :D )
Lluís Alfons Ariño:  This was my preference
Nacho Alamillo:  Mine too
Anil John:  I want to get a sense from you kimhd if there are any 
  current examples of education credentials, e.g. a university 
  degree.
Kim Hamilton Duffy: 
  https://docs.google.com/document/d/1pt-VNnjoYgl23Mlu0Tjyax5RgANPBfDijERz0SNYfSo/edit
Anil John:  We are about to come out with a prize competition for 
  a digital wallet UI, I've been talking to U.S. Department of 
  Education.
Anil John:  I'm a student looking for an employer. The employer 
  needs both a Permanent Resident Card, and a University degree.
Anil John:  We have already worked on the Permanent Resident 
  Card, but I'm looking for an example of a university degree.
Kim Hamilton Duffy: 
  https://docs.google.com/document/d/1pt-VNnjoYgl23Mlu0Tjyax5RgANPBfDijERz0SNYfSo/edit
Kim Hamilton Duffy:  Unfortunately no good examples exist yet, 
  but see this document above.
Kim Hamilton Duffy:  People from the relevant bodies are very 
  supportive and are helping us going through the data modeling 
  process. The understanding has to be that anything in here is a 
  draft.
Kim Hamilton Duffy:  The other goal is allow pilots to be 
  unblocked and get started.
Heather Vescent:  Also thank you from my part to everyone who 
  spoke and contributed today.

Topic: Updates on Secure Data Storage on DIDComm

Sam Curren: Yes
Orie Steele:  The SDS Working Group is a joint effort between W3C 
  and DIF. The purpose is to support the concept of data storage 
  that's associated with DIDs.
Orie Steele:  The use cases are things like storing wallet 
  contents, storing things associated with a DID, sharing access 
  between DIDs.
Orie Steele:  It's a generic data structure, not limited to DIDs.
Orie Steele:  The work is ongoing, there have been two primary 
  input documents. 1. Encrypted Data Vault spec at W3C CCG, 2. 
  Identity Hub spec developed at DIF.
Orie Steele:  Those are similar in some ways, different in other 
  ways. The SDS Working Group is still working through the 
  differences, the interfaces, etc.
Orie Steele:  EDVs are for storing encrypted data. Identity Hubs 
  have a lot of public data use cases.
Orie Steele:  We will eventually see deeper integration between 
  those interfaces and other standards happening out there.
Sam Curren: 
  https://docs.google.com/presentation/d/1YiL-A9YaNgQpFBraJJOLLUPyFfZ6uQ1uqtTCiDZxNqI/edit#slide=id.p
Sam Curren:  See this link for a quick overview of the DIDComm 
  Working Group
Sam Curren:  Provide secure communication with trust rooted in 
  DIDs. This originated in Hyperledger Aries.
Sam Curren:  We've made good progress. See slide 4 for a layer 
  map.
Sam Curren:  Related work includes JWM, ECDH-1PU
Sam Curren:  It's transport-agnostic, can work via HTTP, 
  WebSocket, QR Code.
Sam Curren:  Last slide, join us on our calls, we have 
  recordings.
Heather Vescent:  Thanks all for the call, next week we will have 
  a presentation by GS1.
Received on Thursday, 23 July 2020 18:51:31 UTC

This archive was generated by hypermail 2.4.0 : Thursday, 24 March 2022 20:25:01 UTC