Re: [Secdispatch] [saag] Interest COVID-19 'passport' standardization?

Everyone,

Good to see this conversation, and the contributions from Dirk have been
exceptionally relevant. In particular, I would put out of scope requiring
any verifier to be online and I would also put out of scope data formats
with limited real-world uptake, like W3C RDF and Verified Credentials. I
would focus on widely deployed standards, such as JOSE/COSE and TLS. In
this regard, the EU DGC has done well. I'd like to see international
comparison though, as I can imagine many other "proposals" or even working
systems are not using modern cryptography. I suspect there is definitely a
need for a privacy analysis that is more thorough than DGC has done
(surprised to see linkable signatures, centralized databases, and so on and
so forth) when we know how to build better and more in the EU
GDPR-compliant standards - although I suspect COVID-19 falls under a
national security derogation and so GDPR does not apply.

Not sure how many people are actually interested in chartering something
and the scope, but I'd be happy to host a meeting if someone is attending
IETF 111.

Although it may be rather late for some, I will be hosting a "side meeting"
virtually at the IETF 111 meeting today right after the CFRG IRTF meeting
ends. See the wiki for the link:
https://trac.ietf.org/trac/ietf/meeting/wiki/111sidemeetings

  yours,
    harry

On Fri, Jul 30, 2021 at 11:39 PM Dirk-Willem van Gulik <dirkx@webweaving.org>
wrote:

> On 30 Jul 2021, at 23:23, Eric Rescorla <ekr@rtfm.com> wrote:
>
> On Fri, Jul 30, 2021 at 2:19 PM Henry Story <henry.story@gmail.com> wrote:
>
>> The knowledge about the virus and the responses to it are evolving
>> very quickly, and so the flexibility of W3C Verifiable Credentials
>> comes in very handy here, as it is built on semantic web standards
>> built on top of first order logic, hypergraphs, and designed for
>> decentralisation, and evolvability.
>>
>
> I don't really agree with this claim. Some of the proposals here use
> VC and some do not, but they all seem roughly equally capable and
> flexible to me.
>
>
> From an implementor/designing perspective (both the NL domestic version
> -and- the EU DCC version)  — and although we tried very very hard - the
> absolute need for totally off-line use & preventing surveillance*, also, or
> especially by the issuing entities  (or blind trust in) combined with the
> inflexible state of the available semi-usable VC implementations and the
> very strong desire to have nothing ‘central’ and no ‘central trust’ - had
> us gradually evolve to something not quite VC. Despite this being the
> stated goal.
>
> So I think we have some useful lessons learned w.r.t. the importance of
> off-line / totally local validation.
>
> Dw
>
> *:  e.g. spiked certificates with something unlikely to be cached or
> requiring a very unique lookup/OCSP, etc.
> _______________________________________________
> Secdispatch mailing list
> Secdispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/secdispatch
>