W3C home > Mailing lists > Public > public-webpayments-ig@w3.org > February 2017

Verifiable Claims Telecon Minutes for 2017-02-14

From: <msporny@digitalbazaar.com>
Date: Tue, 14 Feb 2017 12:23:52 -0500
Message-Id: <1487093032195.0.15821@zoe>
To: Web Payments IG <public-webpayments-ig@w3.org>, Credentials CG <public-credentials@w3.org>
Thanks to Dave Longley for scribing this week! The minutes
for this week's Verifiable Claims telecon are now available:


Full text of the discussion follows for W3C archival purposes.
Audio from the meeting is available as well (link provided below).

Verifiable Claims Telecon Minutes for 2017-02-14

  1. Introduction to Abbas Ali from R3
  2. Status of Verifiable Claims WG Creation
  3. Sandbox for the implementers to work on
  4. Action Item Review
  5. Face to Face Meeting Opportunities
  6. Portable Reputation Kit
Action Items:
  1. Manu to create github repo for Verifiable Claims Playground.
  2. Christopher Allen to introduce Portable Reputation Toolkit 
    use cases (first party vs. second party claims)
  Manu Sporny
  Dave Longley
  Dave Longley, Matt Stone, Manu Sporny, Richard Varn, Jonathan 
  Holt, Christopher Allen, Abbas Ali, David Ezell, Nathan George, 
  John Tibbetts, Joe Andrieu, Adrian Gropper, Rob Trainer, David I. 
  Lehn, Adam Lake, Eric Korb, Matthew Larson

Dave Longley is scribing.
Matt Stone: Our agenda for today: 
Manu Sporny: +1 To Agenda...
Matt Stone:  Any changes to the agenda?
Richard Varn: +1 On agenda
Jonathan Holt: +1, But quick review of 1-5
Christopher Allen:  I'd like to talk about some questions related 
  to the portable reputation kit and being able to talk about 
  evidence or the source of your attribution in some fashion. The 
  main thing I want to figure out is if it's a future item, not 
  figure out how to do it.
Christopher Allen:  It's fairly short so add as convenient.
Matt Stone:  Let's throw it in around #3.
Christopher Allen:  Great.
Matt Stone:  Any other changes?
Manu Sporny:  Yeah, we have at least one, maybe two new people 
Manu Sporny:  Getting intros would be good.

Topic: Introduction to Abbas Ali from R3

Abbas Ali:  I just joined, this is my first call. I work at a 
  company called R3, we're a distributed ledger tech company 
  focusing on financial services. Looking at KYC on our Corda 
Abbas Ali:  Based in NY, looking at using the work you've done 
  around Verifiable Claims for use in product and curious to learn 
Matt Stone:  Great, welcome to the group.
Abbas Ali:  Thanks.

Topic: Status of Verifiable Claims WG Creation

Matt Stone:  Status of the VCWG?
Manu Sporny:  It's still slow going, mostly because W3C staff are 
  trying to work through some of the formal objections, but ... 
  Dave Raggett is pretty much on the case. For those that don't 
  know him, he's been involved with W3C from the beginning, 
  author/lead editor of HTML4. Wrote a good response on the current 
  state of affairs that was very fair. Been emailing behind the 
  scenes to deal with the sticking points. As the weeks go on the 
  formal objections are being whittled away at. Still no idea when 
  the group will be created but it should be real soon now.
Matt Stone:  Is addressing the formal objections ... is there a 
  process for the objectors to say "Ok" or does W3C just make a 
  decision and moves on?
Manu Sporny:  W3CM just makes a decision and moves on, they 
  modify the charter to address the objections and there's nothing 
  in the process to allow new objections to be raised. They get 
  addressed in the charter and you move on. In general, there has 
  been far too much support for the group to not start it (my 
  personal view); most votes in support for any work at W3C.
Manu Sporny:  We had a handful of large orgs dig their wheels in 
  and say "Don't start the work, full stop." Those types of 
  objections take more time to deal with, they didn't outline what 
  would make them happy.
Manu Sporny:  We're good for the most part.
Nathan George: +1
Matt Stone:  Phil had made a couple of edits to the charter some 
  weeks ago and called out privacy as an issue. Recognizing that 
  was the topic of some of the objections. I'm not sure who's seen 
  that, he edited the charter directly. He called out U-Prove as a 
  technology to look at. From the chairs, we were a little 
  uncomfortable with the language that was put in and we're working 
  to use some alternative content and positioning so we're not 
  going down the path of naming a tech like U-Prove.
Matt Stone:  Richard Varn had put together a note we'll send out 
  in the next day or tomorrow on that topic with some the language 
  we like better that's in this area.
Christopher Allen:  This is something I would definitely like to 
  take a look at in the sense that I agree and I think it's a 
  requirement that we are able to support selective disclosure 
  approached and future proof ourselves, but it's very very unclear 
  which ones are the appropriate ones to use. And even exactly how 
  what will be required of us to even have that flexibility. There 
  are a number of approaches where U-Prove is more of the more 
  interesting ones because it's been around a while but it also 
  says it's been around a while and it hasn't gotten momentum and 
  there have been improvements in this area since then.
Matt Stone:  I think the way we're positioning the content in the 
  charter is that we don't want to pick a winner and U-Prove has 
  been around a while and hasn't won and we shouldn't call it out 
  in the charter.
Matt Stone:  This will be a topic over the next year or so as we 
  build the spec.
Richard Varn: This is what we are considering saying:  It will 
  further include privacy impact and mitigation in the design and 
  development of the use cases, requirements, and specifications.
Varn quotes from the charter.
Varn quotes from notes.
Manu Sporny:  We want to be open and transparent but we need to 
  make sure we keep member-confidential discussions confidential so 
  we can't say more here.
Manu Sporny: +1 To getting back to just the mailing list.
Matt Stone:  I'm adding another topic; our agenda today goes out 
  to a W3C mailing list and some individuals. I'd like to just get 
  back to that being just a list. If you're one of the ones that's 
  outside of the list, please join the group and the mailing list 
  and reach out to us off line if you don't so we know why you 

Topic: Sandbox for the implementers to work on

Matt Stone:  In other projects like JSON-LD there is a sandbox 
  online where you can submit docs and validate them in real time. 
  We've had some discussions about that for VC and I know the 
  acclaim team has a VC example and we are looking for a way to 
  test it.
Matt Stone:  Implementers want to make sure they are producing 
  the right stuff.
Matt Stone:  I'd like to get some thinking about it and some 
  volunteers for putting something like that online.
Christopher Allen:  I've commissioned and contracted with Noah 
  (and one other) -- and had them do some work with bitcoin 
  signatures and to begin work on a VC playground. They are doing 
  it as they can at this point. I've also been talking with Markus 
  Sabello who did one for XDI and that's some Java playground -- 
  there's some work there and I welcome other participation and 
  hopefully multilanguage.
Manu Sporny:  This is something that the group desperately needs. 
  The good news is that there has been some recent revamp to the 
  JSON-LD playground integrating bitcoin signatures with Harlan and 
  Noah and that's great. There's an initiative for further digital 
  signature work and there's a playground for them. Christopher and 
  Noah are working on Linked Data Signatures for the bitcoin curve 
  and Digital Bazaar is working on some stuff with Javascript and 
  python implementations and Gregg Kellogg is working on a Ruby 
  implementation potentially. And others have worked on various 
  playgrounds. We have all the ingredients coming together, someone 
  just has to sit down and do the work. It only took one person a 
  weekend or two to do the first cut of a playground, so not a lot 
  of work. It's something we really need to do, we at least have 
  the base libraries to have a VC playground with RSA and bitcoin 
  curve signatures. Just a matter of getting a team together and 
  working on code for a week.
Matt Stone:  Should we make, in the github, VCTF repo, a 
  playground project or series of projects and collect the code 
Manu Sporny:  Yes, and we could publish through github pages 
  that's the playground and it would let us manage and contribute 
  to it through github. We know how to do all that stuff and it's a 
  good way to do it. We can get Christopher, Noah, Harlan, etc. 
  everyone working on that, hosted on github. We should have a 
  separate repo and I can create that if folks are ok with that on 
  the call today. The other thing we want to do  that Christopher 
  mentioned is having a repo for VC and we want the spec to support 
  education, financial, healthcare, etc. and collect examples of 
  claims so we can put those in and use them.
Manu Sporny:  I don't know where those go (in the playground or a 
  separate place) that's another topic to discuss. If the group 
  wants this, we can move to put it together.
Matt Stone: +1
John Tibbetts: +1
Christopher Allen: +1
Matt Stone: +1 To make playground on github
Dave Longley: +1
Nathan George: +1 From me as well
Jonathan Holt: +1

ACTION: Manu to create github repo for Verifiable Claims 

Matt Stone:  Christopher if you're looking for other volunteers, 
  I think we have some Ruby skills on the Acclaim team so we may be 
  able to contribute there. I'm not sure how to engage.
Christopher Allen:  Maybe an implementers mailing list, just for 
  people who are focused on writing the code and sharing. One of my 
  main things is ... as I'm talking with various customers and such 
  and we need as many languages as we possibly can that serve 
  enterprise and Ruby is definitely one of them.
Matt Stone:  I like the idea of an implementers mailing list.
Manu Sporny:  This is the implementers discussion and mailing 
  list. W3C likes to have discussions and code grounded stuff, etc. 
  this is that group.
Matt Stone:  So move away from philosophy and into implementation 
Manu Sporny:  Yes.
Matt Stone:  Anything more on the playground?

Topic: Action Item Review

Matt Stone: Running action items: 
Manu Sporny:  I think everyone should be able to see the task 
  list (my personal opinion).
Manu Sporny:  Anyone with the link can access and comment.
Joe Andrieu:  I closed the one that was mine (1/31), I just want 
  to make sure I understood the use case. I wasn't clear if this 
  was meant to be an ongoing thing where I keep updating issues as 
  we keep going.
Joe Andrieu:  https://github.com/opencreds/vc-use-cases/issues/38
Joe Andrieu:  The language in the action is very open; I 
  understood the action to be able the specific notes for that 
Manu Sporny:  I think you did the right thing but this is a good 
  example of an issue where it's unclear when it's closed. This is 
  a note to folks that raise issues, make sure the issue you raise 
  is actionable and we know when it needs to be closed.
Matt Stone:  That's a good reminder, evidence of success and know 
  "when we're done".
Matt Stone:  If we got this content in the use case document, 
  then we should close the issue in github as well and stop 
  tracking it there as well.
Joe Andrieu:  I'd like to clarify; I took the action item to 
  about getting my notes from the meeting. I would not have closed 
  it if the issue was done.
Manu Sporny: +1 To closing issues quickly, we don't want issues 
  standing out there for a long time.
Matt Stone:  If we get to the point where an issue in github can 
  be closed, I'd like to. We have a long list of issues already 
  running, some have quite a lot of activity on them and others 
Matt Stone:  Let's drive towrads getting issues closed.
Manu Sporny: (As long as the issue has been resolved, of course)
Joe Andrieu:  I think this action item is closed, I don't think 
  the issue is closed.
Joe Andrieu: The issue 
  https://github.com/opencreds/vc-use-cases/issues/38 still 
  deserves some work
Matt Stone:  Ok.
Matt Stone:  That's fine, as we see activity on the issue ... in 
  our chair meetings we'll add new action items and discussion 
  topics. That's ok to me.
Joe Andrieu:  Ok, great.
Joe Andrieu:  There was an action I took last week that I haven't 
  made much progress yet but I just added to the list.
Matt Stone:  I'd like to move on through the rest of the agenda, 
  I don't think we'll get through everything today.

Topic: Face to Face Meeting Opportunities

Matt Stone:  I sent a note out last week for F2F activities.
Matt Stone: 
Matt Stone:  We don't have a F2F scheduled; we're on hold until 
  the WG is created before we can book that. We'll go to this list 
  when the WG is created to see if there's a convenient event we 
  can coordinate with. If you have any others that you can add, 
  that would be great.
Christopher Allen:  RWoT on April 19th will be discussing VC 
  implementations. It is a work item at that group. It's not a 
  recommendation as far as an official F2F, but if you're 
  interested in VC and want to meet other implementers it's an 
  important part of the gruop.
Matt Stone:  Anyone else planning on going to Paris for that?
Manu Sporny:  DB is going.
Adrian Gropper: I'm going
Joe Andrieu:  I'll also be there
Jonathan Holt:  I'm trying to.
Matt Stone:  We'll look for an update on that, sounds like a 
  great opportunity.

Topic: Portable Reputation Kit

Christopher Allen:  There are two different things that have 
  emerged that may be related or not. The first has to do with ... 
  it feels that there's two classes of broad classes of assertions. 
  I've run into this multiple times now. The first class of 
  assertion has to do with somebody who has total authority over 
  something. The simple example is twitter as an org has total 
  authority over the fact that I hold `@ChristopherA`, it's theirs. 
  That's different from say, keybase, who says that Christopher has 
  possession of `@ChristopherA`, but we're not the party that has 
  ultimate control of that.
Christopher Allen:  This has come up in other cases, there's a 
  company in Paris that will be at RwoT that basically has the 
  right to be able to create VC based on some French databases. 
  They themselves are not the controllers of the data, they are 
  just allowed to say "Yes, this person is associated with this 
  data and we've validated it second hand."
Nathan George: So perhaps the idea of an authority vs a notary?
Christopher Allen:  That's one area. The reason I bring up the 
  Portable Reputation Kit is that they ran into something similar. 
  They want these reputation statements and such where various 
  parties could evaluate the evidence in different ways. Someone is 
  making a claim then someone is making an eval of that claim. They 
  separated the assertion from the eval and had the ability to link 
  the evidence. "Here's the proof outside my assertion and where to 
  go for that."
Christopher Allen:  I didn't want to solve that problem in that 
  short time. Is this out of scope, is it something I've missed 
  somewhere in the spec or what?
Manu Sporny:  Two things, first is to point out how this has 
  parallels with the education use cases. Like, you have orgs that 
  could verify a transcript aren't the ones that issued it. Orgs 
  can verify they checked a driver's license, but they didn't issue 
  it. It's a very important use case and class of use cases that 
  spans a variety of industries.
Manu Sporny:  The second point is that the way the current spec 
  tries to address this is that the signer asserting something, 
  based on out of band knowledge you can know if they are the data 
  provider or just a verifier of it. THat's a bad way of doing it 
  and we should be semantically clear about what is being said. 
  From DB's perspective this is very much in scope and if we can 
  have a cross industry way of doing it it would be fantastic.
Jonathan Holt:  The challenge is that the self-assert, and you 
  say who is allowed to revoke it, you're setting yourself up for 
  trouble. Within the claim you can validate and say "here's a list 
  of public keys that could revoke this" ... I understand the 
  dilemma, that's just more of a comment than a question.
Adrian Gropper:  This is a very important thing to deal with. In 
  the healthcare use case we have the medical society as a well 
  known place to verify a credential. The issue here is that the 
  medical society isn't issuing the license. The medical society 
  doesn't want to assume the liability necessarily because there's 
  a licensed professional involved, the doctor/prescriber that 
  carries all the liability. That's exactly the issue we're talking 
  about here very clearly laid out and I also agree the revocation 
  responsbility has to be factored in. We have this separation 
  where is there a well known place that's the equivalent of a CA 
  in the old world and how do they transfer and not take the 
  responsibility away from the user, in this case the prescriber.
Christopher Allen:  Any one have thoughts on the evidence and 
  evaluation side of it?
Matt Stone:  Before we jump into that I had a quick question.
Matt Stone:  Sounds like we have several use cases that imply or 
  explicitly have this need. In terms of our terminology with 
  issuer/holder/repo/service provider, how does the responsibility 
  fall? Are we talking about a service provider that is working as 
  an agent of the issuer? That is verifying these credentials on 
  behalf of the issuer? How does this fit into our architecture 
  more generically speaking?
Christopher Allen:  I've been pondering this for a while, twitter 
  is an easy case to understand. Other examples in OAuth. A party 
  being able to verify that a particular value is ... somebody had 
  possession of something at the time of oauth/or editing at 
  twitter/ at the time of editing a DNS record. Later they can 
  revoke it later if they noticed it has changed. Twitter who is 
  the ultimate authority. There is going to be a lot of stuff in 
  the transition, there will be people like twitter, small 
  companies, governments, there will be people that [missed].
Christopher Allen:  I don't know what the right word is ... 
  "first party and second party" claims is the best I've come up 
  with so far.
Jonathan Holt: In Medicine.  I can make a self claim that I am 
  licensed in TN and Board Certified by the American Board of 
  Internal Medicine. The TTP, the American Board of Medical 
  Specialties aggregates the certs of daughter boards, but they 
  themselves won't ever revoke a cert, they only point to the 
  source of truth.  So the issue is how does the State of TN sign 
  my VC and add the ability to attest that they work with certain 
  TTP the ability to revoke. My point[CUT]
Jonathan Holt: Revocation list needs to be in the signature.
Christopher Allen:  Revoking is a different thing. It's not 
  necessarily twitter's public key in the second party ... you're 
  checking to see if the second party has run into any kinds of 
Matt Stone:  Maybe we should take an action item... something 
  that's an explicit use case or a set of requirements that refer 
  to the use cases we've already identified. That requirements doc 
  has been going pretty quickly. Can we get someone to take a 
  requirements+use cases with this idea in mind and suggest a use 
  case or a requirement that would address it?
Jonathan Holt:  We have an issue about revocation.
Nathan George: The trouble with having primary vs secondary 
  authorities is that it needs some type of centralized registry or 
  inventory of which entities have such authority which creates an 
  interesting set of governance issues.
Christopher Allen:  But it's not just about revocation.
Christopher Allen:  Not specific to revocation, it impacts it. It 
  may apply to all use cases.

ACTION: Christopher Allen to introduce Portable Reputation 
  Toolkit use cases (first party vs. second party claims)

Matt Stone:  It sounds like it's a blend of endorsement and 
Christopher Allen:  Maybe, you could say there's a third 
  category. I directly absolutely control this data and this 
  authority and then there's somebody I've given agency to do so 
  and then there's just somebody that's validated it.
Jonathan Holt: I'd be happy to contribute to the medical cred 
Matt Stone:  Ok, I think we're out of time.
Received on Tuesday, 14 February 2017 17:24:23 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 19:08:57 UTC