FAPI_Meeting_Notes_2025 07 23_Atlantic

FAPI Working Group Meeting Notes

Date: July 23, 2025
Time: 14:00 UTC
Meeting Type: Virtual
Chair: Nat Sakimura

Attendees

• Nat Sakimura (Chair)
• Peter Stanley
• Takahiko Kawasaki
• Dima Postnikov
• Bjorn Hjelm
• Imran Ulghar (OBL)
• Peter Wallach (Mastercard)
• Robert Gallagher (Mastercard)
• Hideki Ikeda
• Kosuke Koiwai
• Chris Robbertse (OB)

Agenda

1. Roll Call
2. Adoption of Agenda
3. Events
4. External Orgs & Liaisons
5. PRs
6. Issues
7. AOB

Meeting Summary

Events Update

Current and Upcoming Events

• IETF 123 - Madrid (July 19-25, 2025) - Currently ongoing
  • OAuth working group sessions tomorrow and day after
  • Identity and authentication sessions held on Monday
  • Workload identity sessions held yesterday
• Finance of Tomorrow Conference - Rio de Janeiro, Brazil (September 8-10, 2025)
  • Brazil has significant FAPI adoption
  • Seeking FAPI working group representative to attend and report back
• FIDO Authenticate - Carlsbad, CA (October 13-16, 2025)
• OIDF Events - San Jose (October 27, 2025)
  • After lunch workshop prior to IIW
  • Likely to be held at Cisco facility
• IIW Fall 2025 - Mountain View (October 28-30, 2025)
• IETF 124 - Montreal (November 1-7, 2025)
• Web Conference - Lisbon (Week after IETF 124)
  • Large conference with significant industry participation

External Organizations & Liaisons

Ecosystem Support Community Group Launch

• First Meeting: Monday, July 28, 2025 at 6 PM Sydney time (1 AM PT)
• Meeting Schedule: Two meetings per month
  • First meeting: European timezone friendly
  • Second meeting: US/Australia timezone friendly
• Objective: Share best practices, concerns, and identify how OIDF can support ecosystems across working groups and standards
• Scope: Not limited to FAPI - covers all OIDF specifications
• Background: Addressing the gap left by OIX closure for ecosystem rules and governance
• Blog announcement: In review, to be published shortly

Member Reminders

• Vote on JARM Errata: Open until Monday, August 4, 2025 at 12 PM PT
  • Vote to approve proposed errata corrections to JWT Secured Authorization Response Mode for OAuth 2.0

Pull Requests Status

PR #529

• Owner: Dave (absent)
• Status: Deferred due to owner absence

PR #549

• Status: Approved but has merge conflicts
• Action Required: Resolve conflicts before merging
• Assigned: Dave

PR #541

• Status: Has conflicts and requires content review
• Action Required: Community review requested

Issues Discussion

Issue #739 - Collective FAPI 1 Issues (Peter Stanley)

• Background: Request to consolidate all issues impacting FAPI 1 specification
• Motivation:
  • Live ecosystem requires clarity on upcoming changes
  • Need comprehensive view of all FAPI 1 impacts and their status
  • Required for ecosystem communication and vendor coordination
• Specific Concerns:
  • Security vulnerability fallout and required changes
  • Cipher suite removals and BCP 195 references
  • Timeline for conformance suite updates
  • Impact on yearly attestation requirements for UK banks
• Proposed Resolution: Dedicated agenda time to review all FAPI 1 impacts collectively
• Potential Outcomes: May result in FAPI 1.1 or 1.5 release
• Next Steps: Discussion scheduled for next week when more team members available

Issue #706 - HTTP Signature Component Identifiers (Takahiko Kawasaki)

• Problem: Current FAPI 2.0 HTTP signing specification requires including signature-req and signature-input-req component identifiers, causing technical issues
• Proposed Solution: Update provided in issue to resolve the technical problem
• Status: Requires review from specification authors (Dave, Daniel, Joseph)
• Next Steps: Seek input from Justin Richer (RFC 9421 author) for HTTP Message Signature expertise

Issue #728 - Client Public Key Retrieval (Takahiko Kawasaki)

• Problem: No standardized method for resource servers to obtain client public keys for HTTP message signature verification
• Current Solutions: Require complex specifications like OpenID Federation
• Proposed Solution:
  • Use client public key embedded in DPoP proof JWT or X.509 client certificate
  • Leverage fact that FAPI 2.0 requires either mTLS or DPoP
  • Establish binding between access token authentication and HTTP message signing keys
• Benefits:
  • Eliminates dependency on Federation specifications
  • Uses only existing standardized specifications (mTLS, DPoP)
• Status: Requires working group consensus and specification update
• Implementation: Takahiko preparing demo for next week

Issue #736 - Post-Quantum Cryptography (Dima Postnikov)

• Proposals:
  1. Add guidance notes to FAPI security profile regarding post-quantum considerations
  2. Label existing certified implementations that support TLS 1.3 for easier ecosystem reference
• Certification Impact:
  • Could provide warnings (not failures) for implementations lacking TLS 1.3 support
  • Similar to existing TLS checkers that warn but don't fail
• Next Steps: Requires consultation with certification team

Issue #734 - Private Key Handling Recommendations (Dima Postnikov)

• Proposal: Reference OWASP or NIST guidelines rather than specifying detailed crypto implementation requirements
• Rationale: Leverage existing authoritative sources for cryptographic best practices
• Foundation: All FAPI security analysis assumes sound cryptography and key management

Issue #738 - FAPI2 ID2 Test Deprecation

• Status: Two homework items pending (Dima and Joseph)
• Timeline: Keeping deprecation timeline open until readiness confirmed

Issue #733 - JARM Downgrade Attack

• Background: Issue raised by Jaron, arrived too late for JARM errata process
• Proposed Interim Solution: Add guidance to implementation advice document
• Next Steps:
  • Change component designation from JARM to implementation advice if no objections by next week
  • Dima to provide supporting comment

Technical Deep Dives

HTTP Message Signing Implementation Details

• DPoP Integration: DPoP header contains proof JWT with client public key in JWS header
• mTLS Integration: Client certificate provides public key directly
• Signature Requirements: HTTP signing specification mandates including DPoP header in signature base when present
• Canonicalization Concerns: Discussion on handling special characters and internationalized domain names in target URIs
• Demo Availability: Complete implementation demo ready for next week's presentation

Action Items

1. Peter Stanley: Create issue for FAPI 1 collective impacts discussion (✅ Completed during meeting)
2. Working Group: Review PRs #541 and other pending pull requests
3. Dave: Resolve merge conflicts in approved PRs when available
4. Takahiko: Prepare HTTP message signing demo for next week
5. Nat: Reach out to Justin Richer for HTTP signature specification input
6. Dima: Provide comment supporting JARM downgrade issue migration to implementation advice
7. All: Review Issue #728 client public key retrieval proposal
8. Certification Team: Consult on post-quantum cryptography guidance proposals (when available)

Meeting Logistics Notes

• Attendance: Better than expected (10 people) despite IETF week and European summer vacation timing
• Key Absences: Dave, Michael, Joseph (due to IETF commitments)
• Next Meeting: July 30, 2025 - expecting higher attendance
• Duration: Meeting concluded at 53 minutes past the hour

Decisions Made

• Issue #739 approved for creation and future discussion
• Consensus to proceed with client public key retrieval discussion
• Agreement to reference external standards (OWASP/NIST) for crypto guidance
• Support for migrating JARM downgrade to implementation advice

Open Questions

• Timeline for FAPI 1.x updates and their impact on conformance testing
• Post-quantum cryptography implementation timeline and ecosystem readiness
• Resource allocation for HTTP signing specification updates
• Coordination with certification team on various proposed changes