---
# System prepended metadata

title: Untitled

---

## Agenda bashing

- Profiling of OpenID for Verifiable Credentials
    - OID4VC is flexible and allows multiple credential formats
    - how to use OID4VC with SD-JWT
    - how SD-JWT-VC looks like

- What is the roadmap of the standards?
    - for implemeneters to understand how they may develop?

- How the OIDF test suite could be leveraged or integrated with EC tooling in that area
    - Interoperability
    - Version selection

- Web API
    - being developed by Google/Apple
    - for cross device 

- Timelines & Priorities
    - Any consideration for small group discussions
    - Perhaps separate briefings

- Challenges EC would forsee

- Paulo would like to understand SD-JWT better

- We want to cover timelines

Constraints:
 - Mark, Joseph nad Gail need to leave at 15:00
 - Torsten needs to leave at 16:30

## Profile discussion

Quick overview High Assurance Profile
OID4VC Editors have started a document that profiles will provide a stack that meets requirememnts of ARF

This is not a new concept FAPI is a previous example that has been wildly successful and defines a reduced set of very specific options for implementers that chose to use them.

Scope of profile is SD-JWT for now - what is the 

after that the document will extend to SD-JWT-VC - reducing optionality.

Cleanest way we have discovered to enable interoperability.

We need help - the current authors can't do this as quickly needed so collaboration is strongly desired

Also the specific decisions need input and discussion on various topics - like - "how do we maintain the key?"

In the case of FAPI, the OIDF collaborated with Open Banking UK, 9 Banks, several TPPs , civil society, regulators and industry bodies.

- Proposal to show slide decks from IIW and EIC events in recent weeks

Insert "How to Build Interoperable Decentralised... " Slide deck

"Are we doing Decenralised" - this came to an agreement that it was a terminology question

=======

Dr Torsten Lodderstedt presented the slides 
- These slides will be shared later


Question from Paolo
 - We have realised it is really a 4 party model where the Wallet is split into "Wallet" and "Wallet Provider"
 - Answer from Torsten was that the protocol at this level is not affected
 - Nat Sakimura stated that the posture of the wallet and wallet provider can really have a privacy impact
 - Paolo: "It may be that the wallet can be checked and some options for wallet attestation may be needed"
- Concept is that  the wallet provider is responsible and can create a wallet attestation that can themn be re-used in multiple issuer flows

** Note to Torsten to reach out to missing participant about "wallet attestation"**

Broad discussion that led to arguement supporting keeping the complexity away from the verifier.  This enables scaling of the ecosystem. - this leads to flexibility relating to credential format.

Also Need to be able to consider scalability of the issuer side and in particular with EEAs that will be very diverse.

======

## OIDF Conformance Testing & Certification Tooling

Joseph Heenan presented slides
- these will be made available 

Question: Conformance suite currently tests OpenID Connect & FAPI? - YES
Details of tests of OpenID for VC are not yet available, It is a work in progress

=======

## Web API

- being led by Big Tech
- for cross device 

When presenting credentials

Either Mobile OS OR Browser will be in the middle of the interaction and there may be constraints imposed by either of those components.

It is awkward if two digital platfroms create artificial barriers (technical or business) in relation to the delivery of credentials.

Are there are a couple of key asks in this area that providers should take into account?

Paolo: Lets define some requirements from the community - are the platform providers restricting things that we have an interest in?

Paulo: We have seen a strong polarization of what the Web API could do - around privacy, among other topics


=========

## Roadmap





## Timelines & Priorities

- Any consideration for small group discussions
- Perhaps separate briefings

We just published the second Implementer's Draft for OpenID4VP

We want to start the OpenID4VCI voting in about two months
We want to add implementation considerations to OpenID4VCI
We think the High Assurance Profile is a higher priority than the OpenID4VCI Implementer's Draft

Then we plan for a second Implementer's Draft of SIOPv2

Torsten: There are product vendors actively looking into it.  There are existing implementations of OpenID4VCI.

Vangelis: Interoperability across issuers matters. People are going to deliver products in Europe.
Torsten: There are implementations you could test against.
Vangelis: I am focused on production services and products that member states could buy. He's getting feedback that some don't want to start until the standards are done.
Paulo: Right now, people could focus on PID

Kristina: There are two ecosystems - a global OpenID4VI ecosystem and the European ARF ecosystem
Paulo: Each member state will issue their PIDs in a different way.  It's not like there's a product now.
Konstantin asked who's done it already.

Oliver: There have been multiple interops for OpenID4VCI already.  They successfully interoperated using multiple credential formats.
Oliver: Spruce is working with federal agencies in the US.

Kristina: The next profile can be based on the Implementer's Draft
Kristina: Early feedback is really important
Torsten: We can share early drafts with you

Kristina: For SD-JWT, we plan to add multiple signatures for JAdES
Kristina: We also plan to add disclosure of subsets of values within arrays
Kristina: These are additions, not breaking changes
Torsten: There are open source projects for SD-JWT
Torsten: There's work underway in the Open Wallet Foundation to spin up more projects in this space

Oliver: We're working on an SD-JWT VC specification

Oliver: There are Rust, GoLang, and native code implementations

Kristina: Another component we have is Verifiable Credentials.  The deadline for final VC 2.0 specs is next year.  We plan to stop additional changes in 1/2 year.

Kristina: The VC Data Model defines mandatory conceptual fields that most be present.  The VC Data Model is not the only way to represent VCs.
Kristina: A simple representation became possible in 2.0. Other representations can map to the VCDM when desired.

Kristina: You don't have to do linked data proofs to use Verifiable Credentials.

Oliver showed an example credential format using JWTs
Kristina pointed out the use of explicit typing.
Oliver described the addition of the "type" claim.
Kristina: The profile says how to use pre-registered JWT claims
Oliver: IANA registered claims can be used as well as other claims
Torsten: We are using the same JWT claims that are used in billions of transactions per day. It's much simpler than VC 1.1.

Paulo asked whether claims are in a flat namespace. Kristina said that structured claims can be used as well.
Paulo said that ISO uses CBOR claims with namespaces
Torsten said that the eKYC-IDA claims are namespaced

Oliver showed an example VC-SD-JWT claims set.
He described the SD-JWT and its disclosure.
The spec defines processing and verification rules.
The status of a credential can be determined.
Mike called attention to the use of .well-known/jwt-issuer to be able to retrieve the issuer's keys.
Oliver said that x5c can be used for X.509 certificate chains

Torsten: Another thing we're working on is a status list JWT
Torsten: For the high-assurance profile, it's important to specify key resolution. Both JWK Sets and x5c can be used.

Paulo: The more things we can keep in common, the more interoperable things will be.  The fewer snowflakes we create, the better.

Kristina: I plan to clean up the high-assurance profile early next week.
Torsten: We plan to document the rationale for the choices made in the high-assurance profile.
Torsten: We intentionally stopped short of specififying the trust establishment mechanism.

Torsten and Paulo asked about establish a communication channel between them. Paulo said that the expert group is one channel.

Torsten described the different relevant documents
Torsten: It would be great if you could do a review of the VCI spec
Vangelis: It can take time for member states to provide feedback
Torsen: I'm hoping that you or your team can do a review

We closed the meeting at this point
