Meeting minutes
<Ivan Herman> Date: 2026-10-29
Recognized Entities
Manu Sporny: this is about the recognized entities task force
… we'll start with a quick overview
… highlight remaining issues and talk about our plan for CR
… this can be interactive
… so, what is this about
… at some point you receive a VC
… and it states who issued it
… but now you need to decide if you trust the issuer
… that is what Recognized Entities provides
… trusting the issuer because someone else trusts it
… I am going to say "trust" more often than I mean to
… we try to say "recognized" instead
… because it is more correct
… accreditation body recognizes university, etc.
… but you could also use it among family members or friends
… recognizing that you share a relative, etc.
… so it is about recognition more that "trust"
… so the RE spec tells a verifier that an issuer is recognized in a particular way
… it's useful in education--recognizing graduate certificates, etc.
… also use cases like vital records
… and when trying to hire someone, you may need to refer to an organization to validate the issuer behind the issuance in addition to the credential itself.
swcurran: there can be a hierarchy there...and this allows for an expression of that also
… we may need a chat offline, but maybe you can clarify
… does this bind the issuer identifier with other identifiers?
… such as an "also known as"?
… because that alone won't necessarily "bind" the identifiers
Manu Sporny: as of 2 weeks ago, the answer is yes
… this came from Steve Capell's work
… you can add an arbitrary number of registrations that an org is known as
… also the scope
swcurran: excellent. That binding is crucial
Phil Archer: Hadley Beeman has joined from the TAG
Henrique Xavier: Phil Archer and I caught up a bit ago and I'm mainly here to see how they fit together
… especially where JSONata comes in...because it feels very complicated
Henrique Xavier: does this work clarify what the verifier can ask for?
Manu Sporny: it can be, yes
… there are concerns about over complicating that process
Manu Sporny: but yes Recognized Entities could be used for that
Brent Zundel: as a Verifier and I have some X.509 certs, can I use RE to express that?
Manu Sporny: yes, we have some things that could get close to that
… but we don't yet have anyone driving that exploration
… here's an example of how it works
… there's a list publisher
… publishing a list of issuers they recognize
… such as a list of universities in an accreditation body
… they make the list and issue it as a VC
… out of band they tell Verifiers to use that list
… because this is a VC, the holder can deliver it as they would normally
… which is intended to avoid "phone home" issues
… essentially, this allows the holder to determine the delivery mechanism
… as was mentioned earlier, you could have an international accreditation body
… and that list provider could point to other local/regional lists
… creating a heirarchy
… that's more common in trade orgs than education orgs, currently
… or, you as a human could create a list of recognized entities and distribute your social network of trusted identities
Ivan Herman: the fact that you used DID is because it's nice? or because it is required?
Manu Sporny: you can use whatever identifier you want
… but there are some algorithms out there that require them
Ivan Herman: not this one?
Manu Sporny: this one includes a lot of hand waving
… there are situations where the Issuer states what list they're in
… vs. the reverse where the Issuer is pointed at from the list
Ivan Herman: it's a fairly important point
… not to be derogatory, but we're adding a DID here because it looks good
… but we need to make sure we call out where it shows up as a requirement
Manu Sporny: let me put it this way
… I'm trying to work through all the specs in my head...to confirm where this applies
… all the use cases we have, GS1, UN, etc. all use DIDs
… we don't currently have anyone saying they want to use a CID or HTTP identifier
… it should be possible, but we don't have anyone doing that yet
benoit: I understand the publishing of the list
… you have a Uni that's on the list, but later falls a fowl of the group and gets removed from the list
… how do those VCs issued while they were trusted remain valid/useful?
Manu Sporny: it's possible to put date ranges on the entries
benoit: you're trusting the list provider to not delist them entirely?
Manu Sporny: yes, essentially, a watchdog group or other can also publish their own list that runs in parallel that augments the "authoritative-ness" of the "core"/original list
… we've been trying to avoid the word "trust" because trust is a relative concept
Phil Archer: if you're going to issue a list, then you sign yourself up for a large scale claim of authority
… and you'd likely have to revoke the whole list...
… we instead are planning to use smaller lists or even single VCs
Denken Chen: we plan to use RE's for cross boarder use
… Taiwan and Korea are issuing Driver's Licenses as W3C Verifiable Credentials
… and we're using Recognized Entities to provide the lists of valid issuers across those borders
Kevin Dean: each VC has a validity period
… and it's going to be hard to state a date range of "recognition"
… often those get reviewed on a time scale--every 5 years
… so it's not only revocation, it also may require "re-recognition"
… as long as my recognition happened within the list's own validity period
… my degree may still be valid because it happened while the university was on the list, but before the required expiration
… many of these questions effect VCs as a whole
Wesley Smith: lost of these use cases can encourage more involvement
… does Entity A recognize Entity B?
… there's also the question of "do I care?" that A recognizes B
… but that is perhaps out of the bound for the tech
Brent Zundel: let's talk to the TAG
Manu Sporny: agreed. quick summary of who we've been working with on RE's
… (shows list on slide deck)
… we have been talking to a lot of people about how they publish trust lists
… we have asked for horizontal reviews
… internationalization is almost done, security is done
… still waiting on a11y...so we're in "ok" shape
… here are some issue and PR stats
… we wanted to be in CR now, but we are indeed very close
… k. TAG time
… JSONata
… first is around the technology itself
… the RE specification as it stands today, is similar to a certificate authority list
… certain entities within the list are recognized to do certain things
… so, when someone receives a credential, they need to confirm both that the Issuer had the correct authorization (per the list) to issue the credential
… I can check the list, walk the chain, up to the list provider that I recognize
… currently, we're using JSONata to do that tree walking and checking
… we tried a few simpler things
… comparing identifiers--did low level match mid level, etc.
… but the more complex the chain got the harder that got
… we tried JSON Schema, but that lacks multi-level checking
… so you ended up with a massive schema attempting to check an impossibly large object to check the combined lists
… and one had to generate that
… so, JSONata simplifies that greatly
… however, it's written by 2 people
… it does have stable versioned documentation
… so there are open questions around it
… is it going to be enough? op do we need a Turing complete language--Python, etc.
… and does the spec itself need to provide that? or does it happen at the application layer only?
… right now it _seems_ like JSONata does that
JSONata
Hadley Beeman: quick intro, lola and Heather are here with me from the TAG
… we have been reviewing it...sorry it's been mostly invisible, but here we are
… we do have concerns about JSONata
… I do hear you on the limitations of JSON Schema--it's clear that's insufficient for this use case
… we do have many concerns about the JSONata community's stability, etc.
… it may be good to look at using the RDF and JSON-LD capabilities you have on hand to do the same checking
… I realize that's a different kind of complicated, but it is available to you
… and I do wonder about "why not" Python, etc.
lola: so, why not let the implementers decide how the tree is walked, etc.?
… why does it have to happen within this specification?
Manu Sporny: we've had a few participants ask to put it into the spec
… so that there's interop
… because otherwise it's unspecified and they may do it "however" and we won't know how that is done
Phil Archer: GS1 hat on
Phil Archer: my aim is that an industrial scanner, like a border control person would use
… not a point of sale one, but a border crossing one
… that VC is likely in a barcode
… and I want that scanner to be able to do the full verification
… so I need that scanner equipment to do the whole stack
… I need to ask them to put in certain code in their scanner
… vs. asking them to sort out what the thing is and how to figure it out themselves
Heather: first, I want to share a bit more of our questions
… second, I do want to giggle at the fact that JSONata calls itself "lightweight"
… maybe explore JQ Lang
Manu Sporny: mainly, the implementers already implemented JSONata
… I don't think they looked at JQ Lang
Heather: yeah, if there's a way to avoid forking something that seems un maintained, that would be good
Ivan Herman: we do have other specs that depend on JSONata
… VCALM depends on it now
… and I commented it earlier that it is not specifiable
Manu Sporny: they're already shipping it in production, so...
Ivan Herman: sure, but we're not sure we can specify it into the specs
Manu Sporny: sure, we did start with JSON Schema, but it fell over pretty quickly for this use case
<Phil Archer> The metrology use case is complicated. See w3c/
Manu Sporny: and JSONata was far simpler--and avoided running arbitrary JavaScrpit on the chain
… but that may still be where we end up ultimately
… that's the backstory
… we are using JSONata in VCALM to build matching templates
… in the VC API/VCALM work
… that one is much less likely to change
… that's a different application, but similar need
… we are not using it in Render Method--that's a typo on the slides
Wesley Smith: I wonder if there's a way to point at JSONata as an option for folks profiling these specs
… so they could use it if they want
Brent Zundel: could the spec just say "what MUST happen"
… and perhaps point to JSONata as an option for doing it
… does this specification need to require JSONata?
… or just state that "implementers MUST do these things"
… even if JSONata need to be specified as a normative dependency?
Manu Sporny: i get what you're saying, make the behavior the normative statement
… we had the same dance with JSON Schema
… it failed to get through the IETF multiple times
… but we're in a similar state
… JSONata is being used in multiple places
… but it feels like W3C process is getting in the way...
… all the implementers we know of are using it, because we can't say that because of process
Juan Caballero: so, maybe test suites drive the choice?
… as in, do the conformance requirements drive the fact that JSONata is the obvious choice?
Manu Sporny: there has to be a constraints language
… ideally expressed in the list, so it is also verifiable
… it could be JSON Schema produced via JSONata
… or raw JavaScript
… but it has to be in there
lola: you mentioned a question around JavaScript as an option. What is preventing you from using that?
Manu Sporny: people are concerned about keeping it safely runnable
… because it could be possible to introduce new attack vectors
… and the fear of DOS attacks and similar arriving in the package
Hadley Beeman: 2 questions
… why do you have to validate the entire chain at once?
Manu Sporny: there are parts in the chain that point to each other
… in the GS1 use case, the G10 points to a prefix in the chain above it
… and you have to keep walking up the tree
Hadley Beeman: yeah...at that point, you want some sort of touring complete language
Phil Archer: from our direct experience, we'd rather provide software than the 600+ page PDFs to the teams we work with
… some of these companies just use our OSS
… other's say "nice, thanks, I'll write my own based on this code"
… someone proposed a non-normative note
… the implementers generally could care less
… I don't want GS1 to have to write that Note
benoit: why does JSONata be specified exactly?
… I may just ignore it and do my own code anyway
… so maybe back to the MUSTs around how the list is validated/checked more options if we leave it out
heather: heard on the reasons why you wouldn't want to use JavaScript
… but you're also setting up a future where you're rebuilding somethin that's headed toward that complexity...
… frequently something like this can trend that way
Ivan Herman: circling back to "what's the problem"
… if we do this in JSONata, we may have a whole world of people who have no idea what it is...a bit like now
… the reason W3C requires these things is so that we can prove to the world, long term, that the things we point to are stable and understandable
… we don't have that with JSONata
… it's an individual project by a smart guy
… but there's not much more than that
… I have already had the experience of disappearing software
… the latest for me is deno
Hadley Beeman: big +1 to bot Heather and Ivan Herman
… my concerns are 10+ years from now
… what happens when there's no WG
… perhaps JSONata disappears or has major issues, and there's no group around to respecify
… but using something already specifiable would be better
… because it's more stable long term
… if JSONata ends up still being in the spec, please leave loads of notes for the future
… because it's own future is already a concern
Brent Zundel: so, TAG is recommending a known language?
Manu Sporny: I don't think JavaScript will work for implementers
Hadley Beeman: you can ignore TAG advice
Manu Sporny: I think it's good input
… no one is requiring JSONata
… this has been good input
… maybe if we talk about going to CR that will clarify things?
… we think we are largely feature complete
… we've shown that we can do all the use cases we know of
… so, we could mark the JSONata stuff as "at risk"
… and mention that a Turing complete language might be a replacement
… how does the group feel about that approach?
… k. I think we'll just try that and then check in on the language again
Hadley Beeman: we'll try to get you a response in the next two weeks
Brent Zundel: thanks all! break time. back in 30 minutes
DPP and Business Wallets
Brent Zundel: summary of the morning and moving to digital product passports and business wallets.
Ingo Wolf: introduction of recognized entities with CE marking
… explanation about who the group contains, Carolynn, Carsten are Facilitators
… This is the Verifiable Credentials working group Task Force vc-dbw
… Business wallets are a different style of wallets, for businesses
<Phil Archer> phila: For those not familiar, Ingo Wolf is talking about the CE marking use case: https://
Ingo Wolf: The motivation is that there are no common vocabulary for product and organisational credentials. And to many overlapping standards and registries
… the goal: data fusion. One product or one legal entity described by several standards
… Guidance on mapping the EU DPP data model
… the deliverables: vocabulary for: DPP and Business wallets, use cases and requirements ....
… explains about the use cases, for example the batteries
… The DPP is as trustworthy as the issuer, but the Manu Spornyfacturer identy can come from a Business Wallet credential
… The example sits where three VCWG work items meet, DPP vocabulary, Business Wallet vocabularies and Recognized Entities
… problem: Who vouches for a CE mark?
… example, a CAB is recognized twice, so a verifier may need both chains
… the issuer POV is displayed on the slide
… the circle represents the issuer of the credential in the current slide: Isuance: credentials along the chain
… the conformity assesment body needs to be accredited, on a national level
… there is a bigger hierachy, there is also a european level but also a global level
… on the bottom there is a third chain, the Manu Spornyfacturer of the battery.
… The Manu Spornyfacturer is registered as business, that is also verified
… current example: where register recognizes Manu Spornyfacturer
… the logistical register handles it for germany for example
… example: accreditation of the CAB, the CAB is also recognized,
… the action is also recognized to issue the CE mark
… we still have a discussion where to place it in the JSON
… the 2 chains meet at the CAB right now in this example
… the DID can be a subject, the notification but also the accreditation
… recognizedBy shows the recognition, not the next in line for credential
… ScopedRecognizedAction says what it can certify
… offline verification diagram
… this is the use case we have in scope
… They scan the DPP wich will go to trough the chain to Manu Spornyfacturer, the CAB, wich is recognised by the local CAB, the european CAB
… There are also needs for who recognises the CAB
… takeaways: one entitiy but with several roots we want to verify in the recognision chain
… stapled chain that can be verified offline but both brnaches must be vlaidated
… We want to have the information in the credential
Brent Zundel: There is a queue
Ingo Wolf: references are on the slide
Phil Archer: Brent Zundel will talk about document statusses. you have presented string of characters, not automated chain of authority. Do you want it automated?
Ingo Wolf: The examples we currently have is a PR, that will make it more clear.
Brent Zundel: Slide 13, like what i see, 3: there is a normative statement but why is everything a note insted of recomendation
Ivan Herman: we did not discuss this so far yet we started out as notes but we have not decided yet. It is a description
… For that application specifically you need all 3. But it is not part of a recommendation.
… We are not decided yet
… The DPP has many different DPP's in the world, we are not sure where we would go. But for the time beeing we are still discovering
Denken Chen: We also working on DPP and we also look at Business identity
… The dpp started with battery, but there a many other industries
Ingo Wolf: We have github and a lot of vocabularies are mentioned, and Carolynn is in a research with many industries where she can advice
Denken Chen: are there other organisations that will pick up?
Denken Chen: the ministry of economics issueing the did for web for the companies right?
Ingo Wolf: Correct
Manu Sporny_: There is lots of flexibility, think the expectation that the vocabulary development will be elsewhere but our job is to stay in communication with those organisations,
Ingo Wolf: Correct
Phil Archer: everything is on Github but not on the working draft, advice: put it in a working draft.
… acknowledge that the group does not have a lot of W3C experience and that he could not be at every meeting
… but we should start with the W3C process
Ivan Herman: we hit the Action property, but our problem was, we need a richer set of terms there.
… that's the reason we came up with the ScopeRecognizedAction
… this is not the only application area where it will come up
… my feeling is: this taskforce will not produce recommendations, because we don't want to produce M+1 standards
… This is an example we will put as a PR at the recognizedEntities
… These examples are more then just for recognizedEntities, it is an example for VC as an whole as an example
… The example should be published as a separate note
Manu Sporny_: "action" is just a text string
… my hope is that let us know if we can fix it if it is an issue for you
… This is another example that might not easily fit into the JSON schema
… Maybe it should be a multifield or something equivalent
Brent Zundel: how can we be most productive help this group?
swcurran: in the Did web EH we work on recognizedEntity, one of the this we talked is the verified history mechanism.
… is this the place for that?
Manu Sporny_: how can we help? we have a recognizedEntitiy example, but it would be nice to have the example in the VC playground.
… can we get some examples from the Business Wallets group? and is there alignment with the UNTP and can we help there?
… what can we do to help?
Ingo Wolf: we can work out the example
… it would help promoting it and accessible for other parties
Manu Sporny_: half of the specs is examples now. But concerned about moving the examples (or all) out of the spec)
… because people might lose the visualisation how to implement it.
Ivan Herman: We have diagrams for all of them
Manu Sporny_
Manu Sporny_: we can do that at the end of CR, look at the examples. and right before REC we split the examples from the doc
Brent Zundel: some of what described in the flow is using recognizedEntities, are there other things that needs to be defined?
Brent Zundel: do we need additional specification on other credential types?
Manu Sporny_: what are we trying to hit? And use that as a focus
… I am concerned that we don't have the same timeline
… we would like to see how the conformity certificate will look like concrete
… recognizedEntity chain and see it deployed for example in Germany
Ingo Wolf: timeline wise the European business wallet is beeing finished in 2028 and timeline wise it fits very well
Phil Archer: GS1 hat: We have a big event in Februari 2027 and hoping we can say: Here are GS1 credentials!
… acknowledges the timeframe
Brent Zundel: We can move forward with the agenda
… Next up are the chairs
Future Plans
Phil Archer: Was hoping we have documents beeing finished
Phil Archer: consious that TPAC next year is probably in december because of weather. we can't wait for the next TPAC meeting
… proposal: April, a VC meeting F2F and does anyone want to create a F2F meeting?
… We think this is helpfull for this group.
Brent Zundel: if it goes well and the F2F is fruitfull it is not concrete that we don't need another meeting F2F before december 2027
… We need at least a meeting room, not much else
… Ubico has to small of a meeting room
<Ted Thibodeau Jr.> Lucy asks (in zoom): By when do you need to know? (Sorry having to type here as my flight is about to take off)
Shigeya Suzuki: want to host but for university is impossible in april or may
Brent Zundel: What time might work?
Shigeya Suzuki: June, not March
Manu Sporny_: Digital Bazaar is happy to cover food, etc. But we need to look at work spaces. But also Lucy is looking at Montreal for a place
Manu Sporny_: +1 for April but maybe later in the year
Brent Zundel: possibility: got connections with the W3C folks in China, we can get a space maybe there
Phil Archer: maybe to fast to reject Sao Paulo, but maybe we should think about it.
Denken Chen: I also have a meeting room but i have to check,
… It is in Taipei
Brent Zundel: In Halifax there is also a AC meeting in April, so maybe combine? But looking at options
… do we have a preference?
Ivan Herman: if we take Panama and Sao Paulo, then for europeans, it is impossible because of distance and price, preference in europe.
Phil Archer: We spoke to Carolynn, she has the space but traveling is a burden. 2 hour train at the airport
… understands but Montreal is also far. But maybe not that far
Phil Archer: Aware of the work that happened and still needs to happen. We have to be at CR preferabel in April
Manu Sporny_: We are doing fine from a charter perspective but we need to move with a bit more urgency perspective
… We are ok with recognizedEntities, renderMethod should have more velocity, dataIntegritySpecs, should also have more velocity but thanks to the people that picks it up
… if you are an editor you should have a hard look at the issues
… If we are not in CR with all the specs next year F2F, we should question about this
… The horizontal review is not a simple thing to deal with. it will need a couple of months to respond
… raising that as a warning and we should raise the velocity
<George McEwan> To the Utah convo - I can say there are always possibilities...
Brent Zundel: Is there a structure for the main hall that could accelerate things
… Let us know what we can do to help
Manu Sporny_: Ask more pointed questions to the leaders of the group, for example: What is the date for this CR?
… Just ask: How many CR issues do you have and what is the closing rate? For example
Phil Archer: note: George McEwan made some comments
… Some groups need more support
Ivan Herman: What we do not get on the course: We dont hear about fundamental issues taskforces have met.
<swcurran> Manu Sporny -- turn your presentation data into a progress dashboard?
Ivan Herman: for example: JSONata, has never been mentioned in the general VC meeting
Ivan Herman: There are other examples also in other taskforces
Brent Zundel: Would it help to do more project management?
… the progress tracker is maybe not detailed enough
Manu Sporny_: +1 to that but lets not make it a progress management hellscape
… maybe update the status tracker to see the PR's
Benjamin Young: would it help if people from other taskforces join different taskforces?
… if we show up in each others spaces, maybe we ask more questions instead at a presentation meeting
Phil Archer: nobody wants more meetings, but what if you make the meeting not every week 1 hour but every other week 2 hours? specifically the wednesday working group meeting
Manu Sporny_: not a fan of that idea
Manu Sporny_: It is not a problem just yet, when taskforces are wrapping things up they could help other taskforces, but noticed that it is more work
… for recognizedEntities, maybe stop meet weekly after the CR?
Brent Zundel: Lunch is now, start at 13:30
<Kayode Ezike> present
<Kayode Ezike> Can’t hear anyone, but let me know when the group is ready for the VCALM presentation
<Kayode Ezike> This is the link to the VCALM presentation: https://
VCALM
Kayode Ezike: Going to talk today about the VCALM spec and its path to CR.
… Before VCALM was a concept we had the foundational VCDM specification, which specifies what a valid VC looks like, what properties are acceptable, and that existed in a vacuum.
… We needed a way to be able to do something with this VC, both from the standpoint of the issuer as well as the holder and the verifier.
… So we essentially needed a mechanism to enable exchanging and delivery/presentation of credentials.
… Generally, we need to manage the lifecycle of a VC under the three party model
… It would be great if we could do this in a modular and extensible way without binding clients to vendor solutions.
… VCALM stands for VC API for Lifecycle Management - it's a set of HTTP apis for the different roles in the 3 party model.
… This helps the roles to manage the VCs that relate to them and exchange these VCs with other parties.
… It supports issuance, verification, presentation, and status management.
… It supports repeated actions in a single exchange - such as multiple credentials delivered to a holder.
… It also supports verification steps before issuance steps, as a feature that is worth calling out.
… We have a notion of an administrator who is responsible for configuring the different services that will be used by the other parties
… We are careful to not put too many restrictions on what admins can do or how they set up services.
… The important part is the output - this is a key part of the specification.
… The issuer is able to leverage an issuance service that the admin sets up, whether to do issuance, deliver a credential, or respond to an exchange request.
… The verifier is able to verify credentials that the holder presents.
… A coordinator is a component of a "role" that is responsible for business logic - preparing data that needs to go into a credential, for example.
… It acts on behalf of the different parties in the three party model.
Phil Archer: overview of GS1 structure - there is a GS1 root key. No individual has access to this - but there are two sets of three people, and you need a representative of each set to access the root key.
… This is similar to the presented VCALM notion of admin role.
… The people behind the "GS1" entity are individuals - which is an implementation choice, but it is an example of how this is implementable.
… It is also an example of the complexity you get when you put this into a real organization, with a notion of an "organizational signature".
<Dmitri Zagidulin> @Phil Archer -- this is similar to the Verifiable Governance presentation we did at CCG: https://
Phil Archer: Anything signed by GS1 must be signed by someone who has the authority to sign contracts on the behalf of the organization - this is not something that would go into a spec, but gives you an idea of how "who controls a signature" maps to a real system.
<Ted Thibodeau Jr.> "business logic"
Phil Archer: We want what we issue to have the same authority as a contract.
Kayode Ezike: A good thing about VCALM is how its flexibility can map to various business logics - it seems like GS1 has a good handle on how to do this.
Manu Sporny_: +1, I think what Phil is highlighting is that that group is acting as administrators of the system - that maps cleanly to the VCALM notion of administrator. That is the administrative component of VCALM.
Dmitri Zagidulin: I think this is an important use case - it's similar to work we did in the CCG about verifiable governance. How do you sign as a group or a corporation? That touches on work we need to do in the DID WG.
… There is some dormant work in the WG related to this as well.
… Tying it back to VCALM, I think at present VCALM is flexible enough as an API to support the kind of API you need for this use case.
Phil Archer: This is largely an implementation choice.
Kayode Ezike: I felt that it's important to nod to the Interaction URL/Protocol features of the spec - this is an entry point for different parties to engage in a credential exchange. We don't specify how a URL is sent to a party - but any party that supports VCALM should understand Interaction URLs, which is a way to advertise protocols that a component
supports for credential exchange.
… VCALM uses exchange URLs for this, but we also support other protocols such as OID4*.
… Once this is advertised to a holder's wallet they can then decide what to do with it.
… Then, messages exchange against that URL will abide by the protocol that they have selected.
… VCALM responses are mostly VP/VPRs.
… The latter of which is a way to query for credentials that are desired in an exchange.
… Often times this can be presented as a QR code.
Phil Archer: Have you registered a .well-known for this?
Manu Sporny_: We have registered a protocol scheme at IETF, if that's what you are asking.
Phil Archer: Noting that the domain name there has a particular behavior.
Manu Sporny_: This is a protocol agnostic way of engaging with a digital wallet. It is the only such thing we know of that exists that doesn't try to tip the scales towards a particular protocol.
… Whatever protocol you want to use, we are happy for you to use it - and the application gets to choose what protocol or set of protocols to use.
… This is critical to how VCALM bootstraps in various use cases.
Kayode Ezike: We have received feedback from i18n, they have given us a review with three open issues.
… We have PRs that have been created to address them - some merged, some in flight.
… We heard back from TAG recently as well.
… We will be processing accessibility's review soon, and have not heard back from PING/SING.
… Most of the existing PRs are close to being resolved, and as far as issues go we need to do a pass to get a sense of which are v1 blockers.
… Some of the issues are editorial things, some are nice-to-have features, we need to process them as such.
… Topics we are still processing include JSONata and how to reference it, test suite, a final normative statement review (related to some TAG confusion about normative boundaries).
… We have made decisions editorially to trim things down, as repetition throughout the spec would cause clutter.
… We have made a lot of great progress on threat modeling - we need to process our NOTE and to refine some examples and diagrams.
… Any questions about the current state of the specification?
… The current plan for moving to CR is to merge the open PRs that we have, refine the spec as I mentioned earlier as far as statements, examples, diagrams, close out reviews, and finalizing the test suite. Q1 2027 is the target.
… Nothing is super exigent, but we need more than the final quarter.
… I turn it over to the group to decide what is top of mind.
Wesley Smith: Manu Sporny briefed on use cases - explaining VC API may not be the best choice
… Manu Sporny briefed web payments based on his experience / need to have working group members also share this kind of info during engagement with others
Phil Archer: It's good to be able to point to concrete things such as GitHub issues when we interact with other WGs. Manu Sporny's slides made clear that the obstacles to VCALM's inclusion in the DC API include not just the working group but other organizations.
Manu Sporny_: If we do not start conveying these things as a WG, we will be ignored. That is the default path that we are on. We have said these things multiple times over multiple years, and the response has been "why didn't you raise an issue/bring it up"? We should, and this is a request to the chairs, can we please coordinate the group's responses to
things. We have done this such as with a recent press release and group visibility on the fedId presentation.
… The base assumption is that we may not get traction in other groups, and need to design paths forward that are not reliant on that.
Phil Archer: Devil's advocate, how easy will it be to prove the value of VCALM by implementing it in places we do control?
Manu Sporny_: That is our current direction.
Ivan Herman: Having a PR raised with possible changes on their specification, if it is not an inordinate amount of work, would be good to have.
… This must be responded to explicitly.
<Kayode Ezike> To that point, we may need to be better about advertising/marketing the different deployment instances in the wild (re: engaging as a group).
Phil Archer: I may be optimistic, but there are good communications between the groups.
Phil Archer: going back to JSONata for VCALM, VCALM requires JSONata, yes?
Kayode Ezike: It can work without it but is used for credential templating.
Phil Archer: Where we got to earlier was that it would be ok to say "you have to be able to do this, and here is one way of doing it".
Manu Sporny_: In this case, for VCALM's use of JSONata, it's easier. We make no normative references in VCALM. There are step templates for workflows (identify yourself, present other credentials, etc) and we use JSONata to dynamically configure those steps.
… All of the examples are JSONata, but we can say "use a templating language".
… We can say JSONata is one way to do it. Kayode Ezike, do you agree with that framing?
Kayode Ezike: I remember discussion about this in the past - originally there was no explicit reference to JSONata, and there was an unspecified template type. JSONata is supposed to be optional, and we can make that clear.
… It's hard to express what we expect for most systems to be able to understand.
… Generally, +1 to Manu Sporny_.
… My understanding is that approach requires no normative language, but only expresses options - that moves us back to the open world case, where there is no central authority for template types.
… Thank you for your attention!
Phil Archer: We're glad to see the Q1 target - we are pursuing a F2F meeting in April, we aren't sure where it will be yet.
… CR is the target for that meeting across specs.
Ivan Herman: Will the presentations be added to the agenda slide set?
Kayode Ezike: I will link to my slides in the chat.
Ivan Herman: We need URLs for previous slide decks.
Phil Archer: We have render method and recognized entities.
… I don't think the ones that were just presented are there.
Barcodes and DI
Phil Archer: wes is next - barcodes and more
Wesley Smith: one of the co-heads of barcodes, data integrity, forgery defence and bitstring status list specs
… will share overview, some info about what problems specs address and some issues
<Kayode Ezike> Just posted the VCALM slides at the end of the main VCWG TPAC deck: https://
Wesley Smith: VC-> data integrity-> cbor-ld for compression -> vc barcode for issuance
… data integrity --> bitstring status list --> forgery defense / how all the specs fit together
… barcodes is about security physical document with VC
… press release was done a few weeks ago in response to leak of huge number of driver license images in the US (160 million) - threat is exactly what VC barcodes gives a defense
… image of PDF417 barcode with a VC - can achieve tamper-proof-ness for all of the data not just the VC
… road to CR - have heard back from security privacy accessibility i18n - no feedback yet from TAG / some work needed on tech boundaries
… for example, cryptosuite was designated and this probably doesn't make sense / need to update test vectors - they are correct for spec but should be useful out of spec
Ivan Herman: what about CBOR LD?
Wesley Smith: yes there's a normative issue - so both are being worked on in parallel
Dmitri Zagidulin: on behalf of Lucy - market research on use of VC barcode?
Wesley Smith: in production in California / what else is driving VC barcode? others have expressed an interest in adding VC Barcode which gives some security to an otherwise just printed piece of paper
… add cryptographic security
question by Lucy - followup question about verifier use of VC barcodes
Wesley Smith: in response to inclusion of biometric mentioned by Lucy - California has an implementation of instant ID which includes a biometric
… VC barcodes supports this and is in production
Phil Archer: no such thing as a verifiable barcode / you get a signal that there's a barcode - then use a routine to get the info
Wesley Smith: next is data integrity - this is the digital signing part of the VCs
… transform / hash / prove is the model - relies on signatures / includes selective disclosure and unlinkability - present as a barcode and use quantum resistant crypto
… recent work - how to deal with selective disclosure - there are cryptosuites that are better for this
… sign individual claims / sign a list of hashes (SHoC) / multi-claim signature (MCS) - see BBS
… road to CR - next step is horizontal review
Ivan Herman: Greg's refactorization - adding another cryptosuite became a "piece of cake" / will be a one pager to add another
swcurran: where do we need to put them? in W3C?
Ivan Herman: anywhere
Wesley Smith: next is forgery defense - started recently - response to quantum looming
… the long description of forgery defense is "secondary authenticity checks with randomized and anonymized hash witnesses"
… the mechanism is not about quantum - it deals with key compromise - which can happen with Quantum compromise
<Dmitri Zagidulin> @Phil Archer -- from Lucy: Thanks, Phil. I understood what you meant (And I should have used the full and correct term). While the barcode is standardized and can be processed by readers, if the readers can’t read VC data, the standard is not considered useful enough even if California is issuing it. It is the issue one government is facing getting their W3C-based mobile driver’s license verified in California even though it is not in a barcode
<Dmitri Zagidulin> format. At the end of the day, it is a W3C-VC adoption issue however you deliver it. I just wanted to point out and put myself on record that we are facing a lot of market challenges because most of the current readers don’t read W3C VCs and understanding where others are playing will help us better understand real adoption challenges.
Wesley Smith: check signature using key - if key is compromised then that has limited value / forgery defense creates a separate credential - a witness list - which is signed with a quantum resistant algorithm
… it's a secondary authenticity guarantee
… can piggyback on bitstring status list / can point to the witness list in the credential or standalone mode
… road to CR - address boundaries / no threat model - share with others in this group / review algorithm / haven't submitted for HR yet
Phil Archer: completion date - to CR - by end of Q1?
Wesley Smith: yes
… next is Bitstring Status List - image is more of a block than a list - if you contact the issuer it's not privacy protecting - so what do we do?
… anonymize and mix together lots of credentials / can't be massive - so make it reasonable size to process
… this is 1.1 version to update form 1.0 in order to align with the other related specs / resolving some past future issues that aren't substantive
Ivan Herman: think we should reduce the work to do on this spec to a minimum / even for horizontal review remind them that they already reviewed most of it - focus on the changed part
Wesley Smith: whoever submits this for HR - should be clear to describe what has happened and ask for focus on the changed part
… discussion of HR of the cryptosuites - propose to submit them bundled together
Ivan Herman: similar issue with HR - there has been limited (editorial) change to the three (not quantum resistant) - don't ask for technical review for them / Quantum resistant will need technical review / also have to wait for BBS
Phil Archer: since most content hasn't changed - let's write to the chairs for HR and ask them how to proceed
… crosstalk of everyone agreeing to that
Wesley Smith: this modifies the proposal from my slides
Manu Sporny: working group still has to agree (do a formal resolution) to ask for horizontal review? cross-talk results in "yes"
PROPOSAL: The VCWG requests horizontal review of Data Integrity v1.1, ECDSA v1.1, EDDSA v1.1, and Quantum-Resistant v1.0 cryptosuites.
<Wesley Smith> +1
<Manu Sporny_> +1
<Dmitri Zagidulin> +1
<ElaineX> +1
<Phil Archer> +1
<Kayode Ezike> +1
<Ivan Herman> +1
<Shigeya Suzuki> +1
<Jennie Meier> +1
<Will Abramson> +1
RESOLUTION: The VCWG requests horizontal review of Data Integrity v1.1, ECDSA v1.1, EDDSA v1.1, and Quantum-Resistant v1.0 cryptosuites.
Wesley Smith: engagement with other standards groups
<Phillip Long> +1
Wesley Smith: groups at ISO are interested in learning more bitstring status list and forgery defense
Ivan Herman: can talk to them - anything more needs more discussion
Wesley Smith: we need to represent the group not speak as individuals
Proposal: The VCWG supports the VCB/DI task force's presentation of the VC Forgery Defense and Bitstring Status List technologies to ISO groups on behalf of the WG, coordinated if necessary by the chairs and staff through the group liaison.
<Manu Sporny_> +1
<Wesley Smith> +1
<ElaineX> +1
<Kayode Ezike> +1
<Shigeya Suzuki> +1
<Ivan Herman> +1
<Denken Chen> +1
<Jennie Meier> +1
<Will Abramson> +1
<Phil Archer> +1
<Dmitri Zagidulin> +1
RESOLUTION: The VCWG supports the VCB/DI task force's presentation of the VC Forgery Defense and Bitstring Status List technologies to ISO groups on behalf of the WG, coordinated if necessary by the chairs and staff through the group liaison.
<Phillip Long> +1
ElaineX: In addition to being in W3C and ISO, I'm in the ISO spec. That group has created taskforce7, webinars, social media, to promote the standard. This group might consider something similar so people know what we're doing.
Phil Archer: Yes, W3C does not usually do that, but we should do this, it's important. If we're making material that we expect to publish that explains what we do, we might want to have the group review before we release it.
TAG review of render method
<Ivan Herman> list or resolutions
Phil Archer: anything else we want to say? if not, no VC WG meetings next week. We restart the next week.