FAPI_Meeting_Notes_2025 02 05_Atlantic

FAPI Working Group Meeting Notes - February 5, 2025

• Date: 2025-02-05 14:00 UTC
• Location: Zoom

Participants

• Dave Tonge (Chair)
• Peter Stanley (OBL)
• Imran Ulghar (OBL)
• Robert Gallagher
• Craig Borysowich
• Nat Sakimura
• Peter Wallach (Mastercard)
• Chris Wood
• Joseph Heenan (OIDF & Authlete)
• Hideki Ikeda

Agenda

1. Roll Call
2. Adoption of Agenda
3. Active Polls
4. PRs
5. Issues
6. Additional Discussion Points
7. AOB

Active Polls

1. Proposed Second Implementer's Draft of OpenID for Verifiable Credential Issuance Specification

   • Closes Monday, February 10th at 12pm PT
   • Link: https://openid.net/foundation/members/polls/349

2. Proposed FAPI 2.0 Security Profile and Attacker Model Final Specifications

   • Closes Saturday, February 15th at 12pm PT
   • Link: https://openid.net/foundation/members/polls/352

Pull Requests

1. PR #531: Fixing naming conventions for FAPI 1 errata

   • Has received multiple approvals
   • Ready to be merged

2. Cross-to-flow device flow work PR

   • Still in progress, not ready for merge

3. CIBA-related PR

   • Agreement to resolve in underlying specs rather than FAPI CIBA

Issues Discussed

1. Issue #720: FAPI 2 Acknowledgement Updates

   • Joseph Heenan raised concern about missing acknowledgments
   • Action: Dave to handle spec admin publishing and updates

2. Issue #716: FAPI 2.0 Message Signing

   • Working Group Last Call has concluded (January 31st deadline)
   • RFCs now available for introspection response
   • Action: Editorial changes to be made and specs to be sent

3. Issue #212: FAPI CIBA ID Token

   • Resolved during the meeting

4. Issue #506: Explicit Security Target

   • Needs review of security analysis text
   • Action: Review and potentially lift relevant text

Additional Discussion Points

1. Security BCP Updates

   • Need to update references in both security profile and attacker model
   • Joseph to create an issue for tracking

2. Documentation Request

   • Suggestion to create write-up of differences between FAPI 2 Security Profile Implementers Draft 2 and Final
   • Useful for blog post and implementer questions
   • Action: New issue to be created for tracking this task

Next Steps

1. Dave to:

   • Update acknowledgments section
   • Process editorial changes for message signing
   • Chase charter updates
   • Work on preparing PRs

2. Joseph to:

   • Create new issues for tracking security BCP updates
   • Create issue for documenting FAPI 2 Security Profile changes

Next Meeting

The next meeting will be held in one week's time.

The meeting ended early to allow time for PR preparation work.