IIW week, the 3 week of a whirlwind 2-week series of events that began with SIDI Hub Tokyo the previous week, has concluded.
OpenID Foundation Workshop
First up was the OpenID Foundation Workshop on Monday afternoon.
As usual, Mr. Fujie has already written an article, so there is not much for me to add.
» IdM実験室: OpenID Foundation Workshopクィックレビュー https://t.co/918adtcuhk
After that came the board meeting and board dinner. I will at least share the dinner menu.
IIW 39
IIW ran for 3 days, from Tuesday through Thursday. This also overlaps substantially with Mr. Fujie’s coverage, so reading the IdM Laboratory articles should give you a good overview.
» IdM実験室: IIW 39 Day1クィックレビュー https://t.co/ctz2oJkkpQ
» IdM実験室: IIW 39 Day2クィックレビュー https://t.co/1otMtixF8d
» IdM実験室: IIW 39 Day3クィックレビュー https://t.co/2cDZE4JFre
The sessions not covered there were roughly as follows:
- (1-B) OAuth 101 (Aaron)
- (2-B) OpenID Connect 101 (Mike) 1
- (3-A) SD-JWT VC over proximity/offline (Lee, Cam, Torsten, John, Oliver, Kristina Yasuda)
- (6-N) FAPI 101 #openbanking #opendata(Daniel, Joseph, Nat)
- (8-I) Why is the OpenID Foundation hopping right now? An overview of the 14 work groups and community groups on now. (Nat Sakimura + Gail Hodges)
- (9-A) RP Authentication & Authorization (EUDIW) (Torsten Lodderstedt, Giuseppe, Dima)
That is about it. I do not think there is any need for me to write about 101 or (8-I), so I will briefly cover only (3-A) and (9-A).
(3-A) SD-JWT VC Proximity and Offline Presentation (Lee, Cam, Torsten, John, Oliver, Kristina Yasuda)
SD-JWT VC over proximity/offline
The issue: there is no method for presenting an SD-JWT VC when the wallet is offline.
| Offline (wallet) | Over the internet | |
| mdoc | 18013-5 | OID4VP (incl. Browser API) |
| SD-JWT VC | What do we do here? | OID4VP (incl. Browser API) |
The possible options appeared to be as follows.
| Extend ISO 18013-5deviceRequest | Extend ISO 18013-5OID4VP request | OID4VP over BLE | OID4VP with CTAP | |
| Standard body | ISO? | ISO? | OpenID? | FIDO |
| Device engagement / Channel establishment | QR or NFC | BLE? | QR or NFC | |
| Changes required | Extend deviceRequest / Response | Add OID4VP request / response | None? | NFC needs to be added (Happening anyway for cross device flows) |
| Deployment considerations | Aligned with 18013-5 existing deployments Not aligned with OID4VP online presentation | Aligned with 18013-5 existing deployments Not aligned with OID4VP online presentation | Aligned with OID4VP online presentation and existing CTAP deployments. Not aligned with 18013-5 existing deployments | |
| Feature parity betwen online and offline | N | N | Y | |
| Live implementations | Y Y | Y Y? | ? | Y growing VERY fast |
| Format | CBOR | JSON | JSON | |
| Built at | App level | App level | App level | OS or app level |
| Migration | Not required | ? | Required | Required |
| Reliability | Y | Y | N | Y |
| Standard extension in can be done in ISO or outside of ISO | Standard extension in can be done in ISO or outside of ISO | Couldn’t use ISO | Secure tunnel between 2 devicesCan send arbitrary Invocation:QR code goes through the cloud; NFC is possible but was teken outQR code + BLE?Future UWB is possibleCTAP is available on almost all Android devices |
OID4VP with CTAP appears fairly promising.
Considerations included:
- Bluetooth’s lack of security and stability
- IPR issues when extending an ISO protocol
among other matters.
(9-A) RP Authentication and Authorization (EUDIW) (Torsten Lodderstedt, Giuseppe Di Marco)
RP Authentication & Authorization
Why Authentication of the RP (Relying Party) Matters
In a digital identity system, establishing a secure relationship with an RP is essential for the following reasons:
- Ensuring legal transparency (as required by law)
- Enabling communications and legal proceedings when necessary
- Confirming that the scope of a data request is appropriate
Authentication and Authorization Mechanisms
Handling PID (Person Identification Data) and EAA (Electronic Attestations of Attributes)
- Providers manage data access through disclosure policies
- Policies must be consistent with the RP’s role and proof of authority
- Supporting users in making informed decisions
Implementation Options
- X.509 certificates
- OpenID Federation
- Attestation using SD-JWT (Selective Disclosure JWT)
The Italian Example: Using OpenID Federation
Italy uses the following hierarchical trust model:
- Each entity declares its own configuration
- A hierarchy from the Italian federation to the EU federation
- Real-time policy management through a trust chain
- Authentication using trust marks
Distinctive Features
- Verifying trustworthiness through entity IDs
- Standardizing the query language through DCQL
- Trust conferred by a third party
Challenges to Consider
A particularly noteworthy reality is that not every RP has legal personality. Examples include:
- International research collaboration projects
- Organizations spanning multiple jurisdictions
Other Activities
Naturally, there were side meetings as well.
- Confidential matters that cannot yet be made public (Wednesday evening)
- The EUDIW sub value and related matters (Thursday)
- Meeting with Anoop Saxena, FAPI co-chair, concerning the CFPB response (Thursday evening)
- Dinner meeting about BGIN (Thursday night)
- Meeting with Drummond Reed about the Global Acceptance Network (Friday breakfast meeting)
- Meeting with Edmund Jay (Friday lunchtime)
- And so on.
Incidentally, I was the last person to leave IIW this time. Here is photographic evidence.
Everyone went out for beer while I was meeting with Anoop remotely.
See you again next week!
You must be logged in to post a comment.