CR Request for Bitstring Status List v1.0 - vc-bitstring-status-list

[iherman]

Document title, URLs, estimated publication date

• Bitstring Status List v1.0
  • Final URL: https://www.w3.org/TR/2024/CR-vc-bitstring-status-list-20240509/
  • Proposed publication date: 09 May 2024
  • Editors' draft: https://w3c.github.io/vc-bitstring-status-list/CR/2024-CR1/

Abstract

• https://w3c.github.io/vc-bitstring-status-list/CR/2024-CR1/#abstract

Status

• https://w3c.github.io/vc-bitstring-status-list/CR/2024-CR1/#sotd

Link to group's decision to request transition

• https://www.w3.org/2017/vc/WG/Meetings/Minutes/2024-04-24-vcwg#resolution1

Changes

This is the first Candidate Recommendation for the first Recommendation attempt
for this specification. It does not have a changelog other than the changes
since FPWD, which can be found here:

https://github.com/w3c/vc-bitstring-status-list/commits/main/?until=2024-04-24

Requirements satisfied

Yes.

Dependencies met (or not)

The normative dependencies are on the VC Data Model which is in CR.

Wide Review

Issues processed:

• https://github.com/w3c/vc-bitstring-status-list/issues?q=is:issue+

PRs processed:

• https://github.com/w3c/vc-bitstring-status-list/pulls?q=is:pr+

Horizontal reviews:

• TAG: Verifiable Credential Status List 2021 w3ctag/design-reviews#874
• PING: Bitstring Status List v1.0 2024-01-21 > 2024-02-13 w3cping/privacy-request#127
• Security: Bitstring Status List v1.0 2024-01-21 > 2024-02-13 security-request#62
• a11y: Bitstring Status List v1.0 2024-01-21 > 2024-02-13 a11y-request#70
• i18n: Bitstring Status List v1.0 2024-01-21 > 2024-02-13 i18n-request#222

Additionally, Simone Onofri is gathering reviewers to do a more thorough review
of the Bitstring Status list specification during the Candidate Recommendation
phase.

Liaisons:

• There are participants' overlap with the following groups:

  • RDF Canonicalization and Hashing Working Group
  • Decentralized Identifier Working Group
  • Credentials Community Group
  • Internet Engineering Task Force
  • Internet Engineering Task Force Crypto Forum Research Group
  • Hyperledger Aries
  • Decentralized Identity Foundation Interoperability Working Group
  • IMS Global
  • ISO/IEC JTC 1/SC 17/WG 10
  • ISO/IEC JTC 1/SC 17/WG 4

• Web of Things Working Group

  • Joint meeting at W3C TPAC 2023

• APA Working Group

  • See horizontal reviews

• National Institute of Standards and Technology, U.S. Department of Commerce

  • DHS actively engaged w/ NIST over VCWG + Justin Richer NIST SP 800-63-C work

• The American Civil Liberties Union

  • Presentations given to ACLU and CDT over the years via PING and other venues
  • ACLU, EFF, CDT, and EPIC paper speaking positively about VCs:
    https://www.eff.org/document/10-16-2023-aclu-eff-epic-comments-re-tsa-nprm-mdls

• European Telecommunications Standards Institute

  • EU Digital Wallet cites/uses VCWG output + ARF + EBSI + EUDI Wallet

Formal Objections

None.

Implementation

• Test vectors & test suite (to be improved upon soon)
  • https://w3c.github.io/w3c/vc-bitstring-status-list-test-suite/
• Existing Experimental Implementations
  • NOTE: StatusList2021 was renamed to BitstringStatusList
  • Cheqd
  • Circle
  • Digital Bazaar
  • Mesur.io
  • Microsoft
  • Trustbloc
  • WaltId

Patent disclosures

None, see

• https://www.w3.org/groups/wg/vc/ipr/

---

cc: cc: @msporny @dlongley @mprorock @mkhraisha

[plehegar]

[[
In order to exit the Candidate Recommendation phase, the Working Group has set the requirement of at least two independent implementations for each mandatory feature in the specification.
]]

will there any tests /CR exit criteria for optional features?

[plehegar]

(checking with @npdoty on closed PING issues)

[msporny]

will there any tests /CR exit criteria for optional features?

Yes there will be tests for optional features containing MUST statements. The only feature that falls into that category for this specification is the "status message" feature.

The exit criteria for that optional feature is the same as other mandatory features: two independent, interoperable implementations.

[iherman]

Oops, I sent a reply to a wrong place... it wasn't meant for this thread. Deleting my previous comment

[plehegar]

will there any tests /CR exit criteria for optional features?

Yes there will be tests for optional features containing MUST statements. The only feature that falls into that category for this specification is the "status message" feature.

The exit criteria for that optional feature is the same as other mandatory features: two independent, interoperable implementations.

The Status of the Document will need an update then.

[msporny]

The Status of the Document will need an update then.

Fixed in w3c/vc-bitstring-status-list#170.

I believe that addresses all outstanding transition request issues, @plehegar. Let me know if we need to take any other action.

[iherman]

@plehegar @ylafon can we get a decision on this so that the publication date of May 14 could become realistic? We already missed the date of the 9th.

[plehegar]

Seems w3c/vc-bitstring-status-list#150 needs a bit more attention

[plehegar]

@plehegar @ylafon can we get a decision on this so that the publication date of May 14 could become realistic? We already missed the date of the 9th.

I regret but we need to close the loop on the privacy review first.

[msporny]

I regret but we need to close the loop on the privacy review first.

Ok, we will work with @npdoty to do so, @plehegar.

We will assume that the transition to CR is blocked until we have addressed PINGs concerns with w3c/vc-bitstring-status-list#150.

/cc @iherman @brentzundel

[npdoty]

I apologize for the delay in getting to my re-review here and the impact on the timeline: I was traveling and then ill. Happy to work closely on it now. It might be that this issue could be more fully addressed during CR, but I don't think we want to publish it with a claim that the proposed mitigation is always bad for privacy unless we're sure about that.

[msporny]

I apologize for the delay in getting to my re-review here and the impact on the timeline

No need to apologize, @npdoty -- we want to get this right. We are targetting a publication date of May 30th, so still have time to address your concern to the degree that it might allow us to keep the original schedule.

We have made an attempt at a "temporary fix" to address PING's concern. Please let us know if a merge of that PR will address your concerns enough to enter CR, where we can more thoroughly address your concerns with concrete text.

[npdoty]

I think that fix correctly describes the status and the open question to address during the CR period. (I'll mention the open issue to PING this Thursday and try to get some additional heads thinking about the mitigation question.)

[plehegar]

Assuming the PR will get merged (modulo WG approval and editorial fixes if needed), this transition is approved.

[iherman]

PR merged; publication request went out for the 21st of May

[iherman]

Document published, see https://lists.w3.org/Archives/Member/w3c-ac-members/2024AprJun/0024.html.

Closing the issue as completed.