Skip to content

FAPI_Meeting_Notes_2026 01 22_Pacific

Jump to bottom
Nat Sakimura edited this page Jul 10, 2026 · 1 revision

FAPI WG Agenda & Meeting Notes (2025-01-22)

Date & Time: 2025-01-22 17:00 PST

Agenda

  1. Roll Call
  2. Adoption of Agenda
  3. Events
  4. External Orgs & Liaisons
  5. PRs
  6. Issues
  7. AOB

Meeting Notes

1. Roll Call & Agenda Adoption

  • Anoop
  • Nat
  • Dima
  • Mark

2. Events Update

Q1 2026 internal meetings and industry events have been added to all calendars:

  • February 2 – FIDO Paris Seminar (Paris)
  • February 3 – FIDO Alliance Member Plenary (Paris)
  • February 9-12 – TIIME Unconference (Amsterdam)
  • March 9-13 – ISO/IEC JTC 1/SC 27 WG Meeting (Nürnberg, Germany)
  • March 14-20 – IETF 125 (Shenzhen, China)
  • March 16-17 – ISO/IEC JTC 1/SC 27 Plenary (Nürnberg, Germany)
  • March 16-19 – FDX Global Summit 2026 (Washington, DC)
  • April 27 – OIDF Workshop prior to IIW Spring 2026 (Mountain View)
  • April 28-30 – IIW Spring 2026 (Mountain View)
  • May 12-15 – ID4Africa (Abidjan)
  • May 19-22 – EIC 2026 (Berlin)
  • May 27-29 – OAuth Security Workshop (OSW) (Leipzig, Germany)
  • June 2 – FIDO Authenticate APAC 2026 (Singapore)
  • June 15-18 – Identiverse (Las Vegas)
  • June 22-24 – Dice 2026 (Copenhagen)

Q2 meetings have been added to calendars; Q3-Q4 meetings to be added this week and next.

3. External Organizations & Liaisons

3.1 Ecosystem Partner Updates

End-of-year coordination calls with ecosystem partners for 2026 planning and budgeting have been completed:

  • Chile/CMF: Regulation planned for August 2026. Anticipating a few FAPI2 certifications in 2026 with ecosystem going live in early 2027. Minstait is CMF's implementation partner and may join the Foundation in place of CMF to provide directed funding.

  • SAMA (Saudi Arabia): Anticipate directed funding early 2026 to support new KSA FAPI2 Profile. Ecosystem will then certify to new profile.

  • UAE: Follow-up call scheduled for mid-January to discuss transition from FAPI2 ID to FAPI2 Final.

  • OFB & OPIN: 2026 certification confirmed.

  • Peru: Positive introductory call completed. Peruvian Monetary Authority (PMA) is adopting FAPI2 as part of Peru's Open Banking initiative and has partnered with Minstait (who is also supporting CMF in Chile). PMA will share draft profile soon.

3.2 UK FCA Request for Comment

Deadline: January 30, 2026

The UK FCA has published a feedback request on open banking/open finance. Gail Hodges has contacted Dave Tonge regarding OIDF/FAPI Working Group drafting a response. Dave has agreed to take the lead on this effort.

Link: https://www.fca.org.uk/news/news-stories/fca-publishes-feedback-call-input-open-finance

Chris Robbertse noted that while supportive, Open Banking Limited representatives will need to recuse themselves from some elements of the response drafting to avoid undue influence, but remain available for clarifications as needed.

3.3 ISO Feedback and review comments (Mark).

  • Submitted FAPI 2 Both security profile and attacker to ISO
    • Under review for comment and approval
  • Both security profile and attacker is approved.
  • Received comment for both - Editorial in nature. No technical challenge. Fairly easy to do .
  • Question
    • What is process for next steps. Will follow similar to what we done for FAPI 1 IS feedback.
  • Message signing will go thru submission - Mark will follow on this
  • Mark to create 2 issue one for each. So this can be reviewed at Atlantic call. If we need to split any individual one we can take case by case basis

4. Member Reminders

5. Pull Requests

PR #560 – Implementation Advice (Private Key Handling)

PR #541 – Add Clause on AS Rejecting Non-Source Data

PR #540 – Advice on DPoP versus MTLS

PR #542 – FAPI JARM Updates

PR #545 – Security Considerations (JARM Downgrade Attack)

6. Issues

6.1 Issue #835 – TLS Cipher Suite / ChaCha20-Poly1305

Link: https://github.com/openid/fapi/issues/835

Background: Current FAPI specification's allow-list approach to TLS cipher suites is causing false negatives with newer AEAD algorithms including ChaCha20-Poly1305.

Discussion:

Nat proposed leveraging the IANA TLS Cipher Suite Registry which includes "Recommended" and "Deprecated" flags:

Filip Skokan supported this approach and reiterated his earlier suggestion to change from an allow-list to an explicit block-list approach:

  • The spec cannot keep up with new algorithm recommendations
  • A deny-list would prevent false negatives in the future
  • He has also encountered false negatives involving ChaCha in the past

IANA Registry Guidance:

  • Recommended: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (and ECDHE variants)
  • Deprecated: DHE_RSA, DHE_PSK, and RSA_PSK versions of ChaCha20-Poly1305

Matthew Murphy (Mastercard) confirmed this approach would work for their use case and aligns with their maintained cipher list.

Concerns Raised: Nat expressed concern that a pure block-list approach might allow completely new, unverified algorithms to pass. Filip clarified that the conformance suite uses the latest Java Cryptography suite, so any supported algorithms are already vetted.

Resolution:

  • Proposed approach: Allow any cipher supported by Java Crypto Library that is not deprecated by IANA Registry
  • Nat will communicate this to Joseph Heenan for certification suite implementation
  • Issue will be tracked through the certification suite issue list

Action Items:

  • Nat to communicate proposed solution to Joseph Heenan
  • Track implementation in certification suite issue list

6.2 Issue #778 – Key Length Updates (ISO Review Comments)

Link: https://github.com/openid/fapi/issues/778

Background: ISO/IEC JTC 1 review comments requesting an update to the keylength by refering more up-to-date external document such as NIST one.

UK Ecosystem Feedback (from TDA meeting ~1 hour prior):

Chris Robbertse (Open Banking) reported fresh feedback from the Technical Design Authority meeting with CMA9 banks and TPPs:

  1. Higher key length is supportable across CMA9 and engaged TPPs

  2. Preference for BCP-195 reference: The UK ecosystem would prefer FAPI specification reference BCP-195 rather than directly referencing NIST:

    • BCP-195 already references NIST internally
    • Provides a singular reference point with established update processes
    • Aligns with the proposed approach for algorithms

  3. Processing time impact acknowledged: Higher key lengths will impact processing times, but this is not raised as a blocking issue – just flagged for awareness. No hard metrics available at this time.

  4. Current UK focus: RSA algorithms only (2048 to 3072 transition). ECC is not an immediate concern.

  5. Deprecation timeline: UK ecosystem has been primed to expect 2048-bit deprecation within approximately 4 years.

ECC Discussion:

Nat noted that BCP-195 currently states ECC less than 224 bits must not be used. The current FAPI text just requires ECC over 160 bits, so it would be a change that might impact implementations. Chris confirmed this ECC change does not affect UK (RSA-only ecosystem).

Resolution:

  • This was the last outstanding ISO comment
  • Nat and Hodari will draft updated text reflecting BCP-195 reference approach
  • Text to be shared with working group before submission to ISO

Action Items:

  • Nat and Hodari to draft updated key length text referencing BCP-195
  • Share draft with working group for review
  • Submit to ISO after approval

6.3 Issue #734 – Private Key Handling Recommendations

Link: https://github.com/openid/fapi/issues/734

Related to PR #560. Members asked to review and approve the PR or provide suggestions.

6.4 Issue #594 – JWT/JWK Concerns

Link: https://github.com/openid/fapi/issues/594

Brian and Dave have been discussing. Also related to the IETF draft:

7. Any Other Business

No additional items raised.

Clone this wiki locally