-
Notifications
You must be signed in to change notification settings - Fork 0
FAPI_Meeting_Notes_2026 07 01_Atlantic
Date: 2026-07-01
Time: 14:00 UTC
Location: Zoom
Chair: Nat Sakimura (NAT.Consulting / Authlete) — acting chair for this call
Co-Chair: Dave Tonge (Moneyhub) — regrets
| Name | Affiliation |
|---|---|
| Nat Sakimura | NAT.Consulting / Authlete |
| Gail Hodges | OpenID Foundation (OIDF) |
| George Fletcher | Practical Identity |
| Kosuke Koiwai | KDDI |
| Matthew Murphy | Mastercard |
| Robert Gallagher | Mastercard |
Regrets: Dave Tonge (Moneyhub), Mike Leszcz (OpenID Foundation)
The agenda as posted was adopted without additions:
- Roll Call (Nat)
- Adoption of Agenda (Nat)
- Events (Mike L.)
- External Orgs & Liaisons (Mike L.)
- PRs (Nat)
- Issues (Nat)
- AOB (Nat)
Nat noted at the outset that this would be a light call: regrets had been received from Dave Tonge and Mike Leszcz, the Bitbucket-to-GitHub migration was about to begin, and there were no standing PRs. The call therefore focused on items 3, 4, and AOB. Gail Hodges, who joined after agenda adoption, subsequently requested discussion of the FAPI 2.0 / ISO PAS publication next steps under AOB.
Nat reposted the existing event schedule. No additions or material updates were raised.
| Date | Event | Location |
|---|---|---|
| 2026-07-18/2026-07-24 | IETF 126 | Vienna |
| 2026-09-01/2026-09-03 | Global Digital Collaboration Conference 2026 | Geneva |
| 2026-09-14/2026-09-17 | ISO/IEC JTC 1/SC 17 Plenary | Chengdu, China |
| 2026-10-19/2026-10-21 | FIDO Authenticate 2026 | Carlsbad, CA |
| 2026-11-02 | OIDF Workshop (prior to IIW Fall 2026) | Mountain View |
| 2026-11-03/2026-11-05 | IIW Fall 2026 | Mountain View |
| 2026-11-14/2026-11-20 | IETF 127 | San Francisco |
| 2026-12-07/2026-12-09 | Gartner IAM US | Las Vegas |
Nat reported that the ISO/IEC JTC 1/SC 27 Working Group 5 meetings had recently taken place. Age assurance was among the subjects discussed, together with several other topics. No other substantive liaison updates were raised.
Nat confirmed that there were no standing pull requests to review.
The issue tracker migration from Bitbucket to GitHub was beginning. Migration work was expected to take place during 2026-07-02/2026-07-03.
Members were asked not to file new Bitbucket issues or change or comment on existing Bitbucket issues during the migration. Activity should resume on GitHub after the working group receives confirmation that the migration has completed.
Domingos Creado or Mike Leszcz was expected to announce completion to the mailing list. Nat noted that the start announcement had either not yet been sent or had not yet appeared in the mailing-list archive.
No individual issues were reviewed during the migration freeze.
Gail raised concern about the time taken to return the working group's feedback for the FAPI 2.0 / ISO PAS publication process. ISO had previously expressed concern about the delay, and the expected turnaround period had passed. Gail asked whether OIDF staff needed to take over the remaining work to avoid further delay and reputational risk.
Nat said his most recent discussion with Mark Verstege had taken place on 2026-06-22. His understanding was that there was no outstanding action for the FAPI Working Group and that the feedback had already been captured. The current action was understood to be with Mark to convey that feedback to ISO.
Gail had not received a recent update from Mark and had joined the call to establish the current status. She agreed to follow up with him directly. If the work was already progressing, no staff intervention would be necessary; otherwise, staff could consider taking up the remaining action.
Gail gave advance notice that the OIDF Strategic Task Force would request feedback from the FAPI Working Group about post-quantum cryptography (PQC) readiness. The request would seek information about:
- The working group's existing plans and intended actions.
- Possible tactics under consideration by the Strategic Task Force.
- Areas where a coordinated, Foundation-wide approach would be useful.
- Possible external guidance, such as a white paper or blog post.
Any proposal for a Foundation white paper would need to reach the Board in time for a decision in 2026-09. Gail agreed to send a written request, with relevant supporting information, to the working-group mailing list through the co-chairs.
Gail noted that she had already sent a parallel request about SAML-to-OIDC migration. That topic sits primarily with the AB/Connect Working Group and, following Karl's suggestion, may also involve the iPSIE Working Group.
Nat noted that the previous meeting had briefly flagged U.S. Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks," signed on 2026-06-22, but had not discussed it in detail.
Current state of FAPI PQC work.
Nat explained that the FAPI specifications had already removed dependencies on particular cryptographic algorithms and instead referenced the relevant IANA registries. This should allow newly recommended and registered algorithms to be incorporated by reference without requiring normative changes to the specifications themselves.
The group had also previously discussed retiring older algorithms. Nat understood that a retirement policy existed, but that there was not yet a sufficiently robust mechanism for:
- Monitoring the progress of new PQC algorithms through NIST and related standards work.
- Detecting when relevant algorithms are added to IANA registries.
- Deciding when newly registered algorithms should be implemented in the conformance test suites.
Gail recalled that earlier collaboration with Mastercard had aligned the specifications and test suites with the registry-based approach. She suggested that ongoing guidance might also need to cover warnings, implementation recommendations, and the point at which use of an especially risky algorithm should cease to be considered compliant.
Nat distinguished the existing policy for retiring algorithms from the unresolved operational question of tracking incoming PQC algorithms and incorporating them into testing.
Foundation-wide coordination.
Nat and Gail agreed that registry monitoring and PQC readiness would benefit from Foundation-wide coordination rather than duplicated work in individual working groups. Other groups, particularly those dealing with longer-lived digital credentials, could be affected more directly than FAPI, whose credentials are generally short-lived and whose transport security inherits from TLS.
Gail suggested that OIDF staff could help monitor progress across working groups, ensure that identified work receives timely attention, and coordinate guidance that extends beyond individual specifications or test suites.
Nat proposed that the OIDF certification team could take the lead on the operational aspect because the principal FAPI impact would likely be timely updates to conformance tests rather than changes to the specifications. This could also reduce duplicated effort across FAPI, AB/Connect, Digital Credentials, iPSIE, and other working groups. Gail saw no staff-level objection to that approach, but no formal assignment or decision was made during the call.
Test-suite and standards considerations.
George Fletcher suggested an optional PQC-compliance mode or flag in the conformance test suite that could identify relevant results when tests are run. Nat and Gail considered this a useful implementation-oriented idea.
Robert Gallagher cautioned that the PQC work associated with TLS 1.3 remained technically difficult and contentious, including unresolved discussion of hybrid approaches. He advised against assuming that the standards process would produce a single clean or immediate result.
Gail observed that implementers might ultimately need to choose among several credible algorithms rather than wait for one universal winner. In that case, registry and test-suite policy might need to recognise multiple acceptable PQC-resistant choices.
The discussion produced useful proposals but no final decision on ownership, algorithm selection, or test-suite design.
Nat thanked participants for their contributions and closed the call at approximately 14:37 UTC, looking forward to the new GitHub issue tracker being available by the next call.
| # | Action | Owner | Due Date |
|---|---|---|---|
| 1 | Do not file or comment on Bitbucket issues during the migration freeze; use GitHub after completion is announced | All members | Until migration completion is announced |
| 2 | Notify the mailing list when the Bitbucket-to-GitHub issue migration is complete | Domingos Creado or Mike Leszcz | After migration, expected after 2026-07-03 |
| 3 | Follow up with Mark Verstege on the status of the FAPI 2.0 / ISO PAS feedback to ISO and determine whether OIDF staff intervention is needed | Gail Hodges | TBD |
| 4 | Send a written request, with supporting context, to the FAPI mailing list seeking working-group feedback on PQC readiness | Gail Hodges / OIDF Strategic Task Force | Before any related Board proposal in 2026-09 |
| 5 | Consider raising a GitHub issue about monitoring new PQC algorithm registrations and establishing a conformance-test adoption timeline | FAPI Working Group / Nat Sakimura | After the GitHub migration |