SD-JWT-JS: initial proposal

[aceshim]

No description provided.

[tkuhrt]

Thanks, @pensivej for the project proposal. For our next TAC meeting on the 18th, we will most likely have a full agenda already with the Android Identity Library proposal and a discussion about project technical charters. If these both go quickly, we may be able to squeeze you in, but I am just not sure.

[skounis]

Should we wait for the dependencies list before evaluating this proposal, or does this TBD refer to the future?

Are we aware of the licenses of these dependencies and their compatibility or possible collision with Apache 2.0?

[skounis]

Is it OK if we use the LFEU code of conduct (found at https://linuxfoundation.eu/en/policies)

[skounis]

I believe here goes OWS's GitHub repository

[skounis]

Same as for the "source control". Will we use GitHub?

[skounis]

We should clarify better what TBD means as part of this process. Are tasks that should be finished before the evaluation of the project by the TAC, or tbd refers to tasks the maintainers will handle after the adoption?

[tlodderstedt]

I think we need more information, especially pointers to the existing code, in order to form an opinion.

[tkuhrt]

I think we need more information, especially pointers to the existing code, in order to form an opinion.

If this is a brand-new project with no code, this is okay too. Just provide that information in the proposal. We can always create the repository within OWF to allow for the project to be started.

[aceshim]

@tkuhrt Yes, this is a brand-new project with no existing code. I will add that information in the proposal.

[skounis]

How this library compares to the rest JS implementations already available:

• https://github.com/oauth-wg/oauth-selective-disclosure-jwt#sd-jwt-implementations

[davidejalexander]

I am trying to understand the proposed project. We use a series of questions internally when evaluating projects. Apologies if it sounds formal but I know OWF keen to drive discussion between meetings so we all have a clearer understanding of the scope and intent of a project.

On the call today was Scott nicholas from Linux Foundation Europe. He went through project set up and top tips to get the basic things in place. An example was the Technical Charter Template https://docs.google.com/document/d/1Sxnktu3d_xLFSZmAmSFbUp1Y1s1E36YvNDupY2AmigU/edit and the IP clauses in Governance documents.

My questions if you could help me understand

• WHY starting from scratch on javascript offering
• Are there no existing open source components / libraries that can be used?.
• Are you trying to mirror the approach in the other implementations currently in place or being developed?.
• Do you have any specific use cases for this now that is creating the demand and priority for this for the project?
• What timescales are you hoping to work to and do you have a roadmap to implementation?
• Do you have existing supporters with relevant skills and knowledge to deliver a successful outcome?
• What are the outcomes and ambition for this specific?

Many thanks

[aceshim]

Hi @skounis ,
There are 4 implementations listed in the repository you mentioned. However they are all either not production-ready, or hard to believe it's going to be properly maintained. We need a production-ready SDK by end of this year.

• https://github.com/christianpaquin/sd-jwt : This is not production ready and since 7 months ago, there is no update.
• https://github.com/chike0905/sd-jwt-ts : This is an implementation of SD-JWT (I-D version 02), which is out of date. The latest version is I-D version 06.

For other two, there are commits up-to date but I think having production-ready and actively maintained sd-jwt-js (or ts) within OWF is important.

[aceshim]

Hi @davidejalexander ,

• WHY starting from scratch on javascript offering

Because we didn't have time to investigate other existing implementations in depth and it's only a month of work (based on other existing repositories). So better build from scratch than discover if we can start from somewhere else.

• Are there no existing open source components / libraries that can be used?.

Yes, there are 2 existing open source libraries. One is https://github.com/berendsliedrecht/sd-jwt-ts which has 0.1.0 released today, and another is by Meeco https://github.com/Meeco/sd-jwt. Both seems available for basis, but as I mentioned above, we chose build over investigate (and get permissions maybe?).

• Are you trying to mirror the approach in the other implementations currently in place or being developed?.

I don't think there are many ways to implement this differently since it's reference implementation. We are not going to.

• Do you have any specific use cases for this now that is creating the demand and priority for this for the project?

Yes. We have a project that is due Feb 2024. We plan this to be fully implemented in production ready state by end of this year. We used did-jwt and did-jwt-vc before for our wallet but plan to change this time.

• What timescales are you hoping to work to and do you have a roadmap to implementation?

We will start working on from mid-November and release 0.1.0 by mid-December.

• Do you have existing supporters with relevant skills and knowledge to deliver a successful outcome?

We are the team who built the wallet used by government, with 43 million users daily, and using did-jwt and did-jwt-vc. We know how to build wallet and its components. Also we have dedicated resource for providing building blocks for OWF.

• What are the outcomes and ambition for this specific?

We will provide open-sourced react-native wallet project containing this by mid 2024. We will continuously maintain this in production level and make sure this works at scale by providing exhaustive test cases. We will keep our eyes on any updates in IETF or W3C standard updates and make sure this stays up-to-date.

[tkuhrt]

APPROVED with six yea, one absent at November 1, 2023 meeting

[tkuhrt]

@pensivej : Can you rebase this branch so that we can merge it?

[tkuhrt]

I have created a Discord channel #sd-jwt-js, as well as a GitHub repo for the project: https://github.com/openwallet-foundation-labs/sd-jwt-js. I have added a couple of initial issues for repository setup of required files.