2024-11-06 Meeting notes - Draft

Chaudhury, Atef

Jones, Thomas

Yes

Krishnaraj, Venkat

Thoma, Andreas

Yes

Wunderlich, John

Yes

Williams, Christopher

Yes

Auld, Lorrayne

Aronson Mark

Balfanz, Dirk

Brudnicki, David

D'Agostino, Salvatore

Yes

Davis, Peter

Dowtin, Jazzmine

Dutta, Tim

Flanagan, Heather

Fleenor, Judith

Glasscock, Amy

Graaf, Irene

Gropper, Adrian

Hodges, Gail

Hughes, Andrew

Jordaan, Loffie

LeVasseur, Lisa

Lopez, Cristina Timon

McBride, Adam

Yes

Pasquale, Jim

Snell, Oliver

Stowell, Therese

Sutor, Hannah

Tamanini, Greg

Vachino, Maria

Whysel, Noreen

• Start the meeting.

• Call to order

• Approve minutes

• Approve agenda

@John Wunderlich

Called to order: 14:05

Quorum reached: Yes

Minutes to approve: Approved

Open Tasks Review

All

Link to Recommendations (Commenter Link): Recommendations for Privacy Enhancing Mobile Credentials

Comment Dispostion

@John Wunderlich

Discussion

1 Comment has been received and has been addressed.

Loffie notes that the draft has been circulated to ISO SC 17/WG 10 so more comments may be forthcoming

Tom has a wording comment that will be added for comment dispostion.

Brainstorm

All

Comment Period for report ends in two weeks. If all goes well, will be published in December.

Brainstorm what to do next. Possibilities include:

1. Update the implementor’s report to reflect the published recommendations

2. Working with Kantara to train third parties to ‘certify’ vendors against PEMC

3. Start working on Version 2 of the PEMC to include online transactions

4. Discuss the Credential Exchange Protocol from FIDO. Is this in the scope of the PEMC?

5. Other ideas?

Discussion:

• Updating the Implementor’s Guidance Report

  • @John Wunderlich will initiate this work and report back next meeting

• Following the Implementor’s Guidance Report should be a guidance document for assessors, which is somewhat dependent on the updated Implementor’s guidance report.

  • What documents should be normally expected to be provided to an assessor? @Andreas will talk to his team, and possibly with @Atef Chaudhury to determin what documentation would their compliance teams would expect to provide for conformance purposes

• We should plan to start work on updating and extending the PEMC requirements to completely online use cases in the new year.

Adjourn

Next meeting in two weeks