Re: Credentials Task Force proposal

[Tony Arcieri]

I feel Macaroons are applicable to this problem domain as well, albeit not yet standardized:

http://macaroons.io/

http://research.google.com/pubs/pub41892.html

https://air.mozilla.org/macaroons-cookies-with-contextual-caveats-for-decentralized-authorization-in-the-cloud/

https://github.com/ecordell/macaroon-compatibility

[Judson Lester]

What's the context for this? The original post didn't come through to this list that I can see.

[Tony Arcieri]

On Sun, Nov 8, 2015 at 10:24 AM, Judson Lester <nya...@gmail.com> wrote:

What's the context for this? The original post didn't come through to this list that I can see.

Whoops, sorry about that:

---------- Forwarded message ----------
From: Manu Sporny <msp...@digitalbazaar.com>
Date: Thu, Nov 5, 2015 at 8:36 PM
Subject: Credentials Task Force proposal
To: Web Payments IG <public-web...@w3.org>


Hi all,

After talking with the Credentials Community Group this week[1], I have
put together a Credentials Task Force proposal here:

https://www.w3.org/Payments/IG/wiki/Main_Page/ProposalsQ42015#Credentials_Task_Force

Could we add this as an agenda item to the call next week?

The full-text of the proposal can be found below.

WPIG Credentials Task Force
---------------------------

Goals

   Determine if a Credentials Working Group should be created at the
   W3C by analyzing and responding to concerns raised at W3C TPAC
   around the value-add that W3C could provide in the space.

Problem Statement

   There is currently no widely used standard (measured in hundreds
   of millions of people) for expressing and transacting digital
   credentials on the Web.

   Data has been gathered demonstrating a [22]desire to create an
   interoperable credentials ecosystem that is standardized around
   the expression and transmission of credentials. Namely, the
   following features have been identified by the industry survey as
   desirable:

     * A standard data format for a credential container
     * Issuing verifiable credentials (e.g. educational transcripts,
       professional licenses, digital government IDs, etc.)
     * Storing verifiable credentials at arbitrary identity
       providers/vaults
     * Requesting verifiable credentials from people and
       organizations
     * Revoking issued credentials
     * Web Browser APIs for issuing, storing, and consuming
       credentials
     * User-centric credentials (credential holder is in control of
       their own credentials)
     * Privacy-enhanced credentials (ensuring privacy when sharing
       certain credentials)
     * Credential portability (credential holder should be able to
       easily move credentials from one provider to another)

Deliverables

     * Create comparison between Identity Credentials and OpenID
       Connect
     * Create comparison between Identity Credentials and SAML
     * Reach out to Brad Hill, Richard Barnes, and see how they'd
       solve the problem
     * Create comparison between Linked Data Signatures and JOSE
     * A Credentials Vision document
     * A Credentials Use Cases document
     * A Credentials Roadmap document
     * Create Credentials WG charter if W3C value-add is clear

Success criteria

   Either

     * Clear documentation demonstrating that W3C cannot add value in
       this area, or
     * A well-socialized W3C Credentials Working Group charter (and
       supporting documentation) that would go to a W3C AC vote.

Task Force Operation

   If formed, the WPIG Credentials Task Force will:

     * be composed of representatives from the Financial sector,
       Education, Healthcare, and Government
     * Have weekly calls on Tuesdays at 11am ET on a to-be-determined
       teleconference bridge
     * Work on completing the deliverables outlined above
     * Will have an answer around whether to create a Credentials WG
       to the WPIG by early February

Dependencies

     * Coordinate with Credentials CG
     * IETF Identity initiative
     * Chairs of security groups in various organizations
     * IMS Global and other education initiatives
     * Verisys and other healthcare initiatives

Milestones / Timelines

     * 2015-11 - Discussion of Credentials Task Force Proposal and if
       all goes well, the creation of the Task Force
     * 2015-12 - Perform background research listed in deliverables
     * 2015-01 - Start drafting charter for feedback, start
       finalizing input documents to future WG
     * 2016-02 - Publish background research findings, finalize draft
       charter, finalize input documents
     * 2016-03 - Co-locate face-to-face meeting to discuss path
       forward (AC review, WG creation, etc.)

-- manu

[1] http://opencreds.org/minutes/2015-11-03/

--
Manu Sporny (skype: msporny, twitter: manusporny, G+: +Manu Sporny)
Founder/CEO - Digital Bazaar, Inc.
blog: Web Payments: The Architect, the Sage, and the Moral Voice
https://manu.sporny.org/2015/payments-collaboration/

-- 

Tony Arcieri