CR Request for VC Data Integrity, EdDSA and ECDSA Cryptosuites, and JSON Schema Specification

[iherman]

Document title, URLs, estimated publication date

• Verifiable Credential Data Integrity 1.0
  • https://www.w3.org/TR/2023/CR-vc-data-integrity-20231107/
  • 07 November 2023
  • Editors' draft: https://w3c.github.io/vc-data-integrity/
• Data Integrity EdDSA Cryptosuites v1.0
  • https://www.w3.org/TR/2023/CR-vc-di-eddsa-20231107/
  • 07 November 2023
  • Editors' draft: https://w3c.github.io/vc-di-eddsa/
• Data Integrity ECDSA Cryptosuites v1.0
  • https://www.w3.org/TR/2023/CR-vc-di-ecdsa-20231107/
  • 07 November 2023
  • Editors' draft: https://w3c.github.io/vc-di-ecdsa/
• Verifiable Credentials JSON Schema Specification
  • https://www.w3.org/TR/2023/CR-vc-json-schema-20231107/
  • 07 November 2023
  • Editors' draft: https://w3c.github.io/vc-json-schema/

Abstract

• https://www.w3.org/TR/2023/CR-vc-data-integrity-20231107/#abstract
• https://www.w3.org/TR/2023/CR-vc-di-eddsa-20231107#abstract
• https://www.w3.org/TR/2023/CR-vc-di-ecdsa-20231107#abstract
• https://www.w3.org/TR/2023/CR-vc-json-schema-20231107#abstract

Status

• https://www.w3.org/TR/2023/CR-vc-data-integrity-20231107/#sotd
• https://www.w3.org/TR/2023/CR-vc-di-eddsa-20231107#sotd
• https://www.w3.org/TR/2023/CR-vc-di-ecdsa-20231107#sotd
• https://www.w3.org/TR/2023/CR-vc-json-schema-20231107#sotd

Link to group's decision to request transition

• https://www.w3.org/2017/vc/WG/Meetings/Minutes/2023-09-14-vcwg#resolution1
• https://www.w3.org/2017/vc/WG/Meetings/Minutes/2023-09-14-vcwg#resolution2
• https://www.w3.org/2017/vc/WG/Meetings/Minutes/2023-09-14-vcwg#resolution3
• https://www.w3.org/2017/vc/WG/Meetings/Minutes/2023-09-14-vcwg#resolution4

New publication date plus reaffirming the publication after some post TPAC changes:

• https://www.w3.org/2017/vc/WG/Meetings/Minutes/2023-10-11-vcwg#resolution1

Changes

• https://www.w3.org/TR/2023/CR-vc-data-integrity-20231107/#revision-history
• https://www.w3.org/TR/2023/CR-vc-di-eddsa-20231107#revision-history
• https://www.w3.org/TR/2023/CR-vc-di-ecdsa-20231107#revision-history
• https://www.w3.org/TR/2023/CR-vc-json-schema-20231107#revision-history

Requirements satisfied

Yes.

Dependencies met (or not)

For the "Verifiable Credentials JSON Schema document": there is a dependency on JSON-Schema. This is related
to the discussion on W3C's Strategy team, see:

• JSON schema strategy#108

The WG's judgement is that a normative dependency is appropriate in this case.

All documents have a dependency on the following WG specification:

• Verifiable Credentials Data Model v2.0, https://www.w3.org/TR/vc-data-model-2.0/

this document is planned to go to CR by the end of 2023 or very early 2024.

Wide Review

Issues processed:

• https://github.com/w3c/vc-data-integrity/issues?q=is%3Aissue+is%3Aclosed
• https://github.com/w3c/vc-di-eddsa/issues?q=is%3Aissue+is%3Aclosed
• https://github.com/w3c/vc-di-ecdsa/issues?q=is%3Aissue+is%3Aclosed
• https://github.com/w3c/vc-json-schema/issues?q=is%3Aissue+is%3Aclosed

PRs processed:

• https://github.com/w3c/vc-data-integrity/pulls?q=is%3Apr+is%3Aclosed
• https://github.com/w3c/vc-di-eddsa/pulls?q=is%3Apr+is%3Aclosed
• https://github.com/w3c/vc-di-ecdsa/pulls?q=is%3Apr+is%3Aclosed
• https://github.com/w3c/vc-json-schema/pulls?q=is%3Apr+is%3Aclosed

Horizontal reviews:

• TAG: Specification review request for Verifiable Credential Data Integrity w3ctag/design-reviews#850, VC JSON Schema w3ctag/design-reviews#859
• PING: Verifiable Credential Data Integrity (and vc-di-eddsa and vc-di-ecdsa) 2023-06-15 -> 2023-07-31 w3cping/privacy-request#120, Verifiable Credentials JSON Schema Specification 2023-06-13 w3cping/privacy-request#119; see also TPAC PING Session
• Security: Verifiable Credential Data Integrity (and vc-di-eddsa and vc-di-ecdsa) 2023-05-27 -> 2023-07-31 security-request#55 (request timeout), Verifiable Credential Data Integrity (and vc-di-eddsa and vc-di-ecdsa) 2023-06-15 -> 2023-07-31 w3cping/privacy-request#120, Verifiable Credentials JSON Schema Specification 2023-06-13 security-request#57 (request timeout)
• a11y: Accessibility Self-Review for VC Data Integrity (and vc-di-eddsa and vc-di-ecdsa)  vc-data-integrity#97 (request timeout), Accessibility Self-Review for VC JSON Schema vc-json-schema#163, Verifiable Credentials JSON Schema Specification 2023-06-13 a11y-request#64
• i18n: Internationalization Review for VC Data Integrity (and vc-di-eddsa and vc-di-ecdsa) vc-data-integrity#96 (request timeout), Internationalization Review for VC JSON Schema vc-json-schema#164 (request timeout)

Issues addressed

• https://github.com/w3c/vc-data-integrity/issues?q=is%3Aissue+is%3Aclosed
• https://github.com/w3c/vc-di-eddsa/issues?q=is%3Aissue+is%3Aclosed
• https://github.com/w3c/vc-di-ecdsa/issues?q=is%3Aissue+is%3Aclosed
• https://github.com/w3c/vc-json-schema/issues?q=is%3Aissue+is%3Aclosed

Formal Objections

None.

Implementation

7 independent implementations for the existing test suites:

• https://w3c.github.io/vc-data-integrity/implementations/#test-suite-reports (7 independent implementations)
• https://w3c.github.io/vc-di-eddsa-test-suite/ (4 independent implementations)
• https://w3c.github.io/vc-di-ecdsa-test-suite/ (3 independent implementations)
• https://w3c.github.io/vc-json-schema-test-suite/

Patent disclosures

None, see

• https://www.w3.org/groups/wg/vc/ipr/

---

cc: @msporny @seabass-labrax, @dmitrizagidulin @Wind4Greg @decentralgabe
cc: @brentzundel @Sakurann

[plehegar]

There are open issues, in particular around data integrity:

• https://github.com/w3c/vc-data-integrity/issues
• https://github.com/w3c/vc-di-eddsa/issues?q=is%3Aopen+is%3Aissue+label%3A%22before+CR%22
• https://github.com/w3c/vc-json-schema/issues?q=is%3Aopen+is%3Aissue
• Remove references to MULTIBASE and MULTICODEC vc-di-ecdsa#39

Please, remind your group participants to NOT put *-needs-resolution label on issues. Those labels are meant to be used solely by the horizontal groups. Your participants should use *-tracker instead. I'll need to do some clean-up to figure which issue is actually blocking.

It's not clear if the loop with the TAG was closed. @ylafon is checking on it.

[iherman]

(The Issue template does not make it clear that comment is needed on the state of various liaisons. But I just saw #571 (comment)...)

Adding information on liaisons:

• There are participants' overlap with the following groups:

  • RDF Canonicalization and Hashing Working Group
  • Decentralized Identifier Working Group
  • Credentials Community Group
  • Internet Engineering Task Force
  • Internet Engineering Task Force Crypto Forum Research Group
  • Hyperledger Aries
  • Decentralized Identity Foundation Interoperability Working Group
  • IMS Global
  • ISO/IEC JTC 1/SC 17/WG 10
  • ISO/IEC JTC 1/SC 17/WG 4

• Web of Things Working Group

  • Joint meeting at W3C TPAC 2023

• APA Working Group

  • See horizontal reviews

• National Institute of Standards and Technology, U.S. Department of Commerce

  • DHS actively engaged w/ NIST over VCWG + Justin Richer NIST SP 800-63-C work

• The American Civil Liberties Union

  • Presentations given to ACLU and CDT over the years via PING and other venues
  • ACLU, EFF, CDT, and EPIC paper speaking positively about VCs:
    https://www.eff.org/document/10-16-2023-aclu-eff-epic-comments-re-tsa-nprm-mdls

• European Telecommunications Standards Institute

  • EU Digital Wallet cites/uses VCWG output + ARF + EBSI

[aphillips]

VC did not request review of either vc-data-integrity or vc-json-schema from I18N. The former has a self-review that was labeled with i18n-tracker. The latter has a self-review which as no i18n label. No request was submitted (that I can find) in the w3c/i18n-request repo. Therefore you cannot say that there was a "request timeout": there was no review done. Please request one before proceeding with CR transition. See here: https://www.w3.org/Guide/documentreview/#how_to_get_horizontal_review

(Note: you did later request review of other VC docs. If the process is unclear, please help us make it clearer.)

[msporny]

Therefore you cannot say that there was a "request timeout": there was no review done.

sigh, dammit.

This issue states: "Internationalization Review for VC Data Integrity (and vc-di-eddsa and vc-di-ecdsa)" and it's in the i18n-activity tracker, which I thought was the tracker for i18n reviews:

w3c/i18n-activity#1717

... @aphillips did a review for VCDM v2.0, which I thought also covered the data integrity specs, which I guess it did not.

If the process is unclear, please help us make it clearer.

Yes, the new process makes it difficult to understand when you're requesting a review... and if all of the horizontal review groups follow the same process (they don't -- e.g. TAG requests different things, PING/Security requests different things, etc.). When processing a lot of documents through the system, as VCWG is doing, and given the new process (I've been doing this for years, but clearly got tripped up with the new changes), it becomes difficult to understand when the review was actually triggered. I thought w3c/i18n-activity#1717 would have done it, but clearly it didn't.

I've raised an i18n-request issue here:

w3c/i18n-request#219

In any case, we've set a CR-entry date of November 7th. At this point, all we can do is throw ourselves at i18n WG's feet in mercy and ask if there is any possibility that an i18n review could be done before then given that these are cryptography enveloping formats and thus have very little to no i18n considerations?

[aphillips]

I'll do my best to get these through our process to meet your schedule. If, as you note, it's mostly crypto stuff then there's a good chance we won't find anything of note.

Data-Model v2 was requested by awoie using our process in June. vc-jose-cose was requested by awoie (and we will complete the review in our next call). FWIW, Data-Model v1 was reviewed in 2019, also from a proper request.

... @aphillips did a review for VCDM v2.0, which I thought also covered the data integrity specs, which I guess it did not.

We have limited resources and have to review every specification, so only docs actually in a request are covered by the request. It's okay to include multiple specs in a request, by the way.

We love self-reviews (which is what 1717 was) and we love early engagement. I know VC has put a lot of effort into getting the I18N right, which is why I was fairly sure this was a gap in conveying the process.

Yes, the new process makes it difficult to understand when you're requesting a review... and if all of the horizontal review groups follow the same process

Actually, except for TAG, all of the horizontals have copied I18N's process, which requires "request a review via github". What differs are any preliminary steps (which makes it look more diverse). In case you didn't already, you might want to check A11Y and security (showing timeout above) to ensure that you filed requests with them too (sorry).

[aphillips]

(I have just now done a quick-and-dirty review. I have created one minor issue for consideration by the WG and will schedule this in our 2023-10-19 call along with JOSE-COSE issues)

[msporny]

I have just now done a quick-and-dirty review.

Thank you, you are a saint. 👼

I see w3c/i18n-activity#1771 and am tracking it in as a pre-CR issue here w3c/vc-data-integrity#211

I will add text to address your concern, ideally by the end of the upcoming weekend.

[decentralgabe]

@aphillips I apologize for not following the process correctly and forcing you into this last minute position. I've just opened a review here w3c/i18n-request#220