The W3C Credentials Community Group

Meeting Transcriptions and Audio Recordings (2014-today)

Go Back

CCG Verifiable Credentials for Education Task Force Telecon

Minutes for 2021-10-25

<phil_long/t3/gu/csky...> Good morning everyone
<phil_long/t3/gu/csky...> Numbers are creeping up ;-)

Topic: Agenda Review

Topic: IP Note

Topic: Call Notes

Topic: Scribe Selection

<phil_long/t3/gu/csky...> Happy to scribe if no one else wants the pleasure
<phil_long/t3/gu/csky...> :-)
Phil Long is scribing.

Topic: Introductions & Reintroductions

<phil_long/t3/gu/csky...> Introductions for new people to the call:
<phil_long/t3/gu/csky...> Eric_Kuhn (Germany)
<phil_long/t3/gu/csky...> Re-intros? Anyone?
<phil_long/t3/gu/csky...> Eric Kuhn - Microsoft

Topic: Announcements & Reminders

<kerri_lemoie> regular CCG meeting time tomorrow, at 9am PT, Noon ET
<phil_long/t3/gu/csky...> TPAC is currently in progress & an update on that will be provided at the regular Tuesday VC-CCG meeting -URL in the chat
<phil_long/t3/gu/csky...> Looking for co-chairs - email Kerri at her email address (in chat).
<phil_long/t3/gu/csky...> Webinar on digital wallets at the URL in the chat.
<phil_long/t3/gu/csky...> Open Skills Network Skills Collaborative this week - see
<phil_long/t3/gu/csky...> Correction to OSN link:

Topic: Final Charter Acceptance Discussion

<marty_reed> +2
<phil_long/t3/gu/csky...> Comments on the VC Edu Charter in the doc
Marty Reed: +1
Jon St. John: +1
Deb Everhart: +1
Sharon Leu: +1
David Ward: +1
Phil Barker: +1
Valerie Thomas: +1
<phil_long/t3/gu/csky...> Charter vote: unanimous support/consent
<phil_long/t3/gu/csky...> Charter approved

Topic: Use Cases

<phil_long/t3/gu/csky...> Working on use cases at this point:
<phil_long/t3/gu/csky...> Example of Use Case structure:
<phil_long/t3/gu/csky...> Working through example use cases: starting with Issue First Aid Certificate. Not that far from what is currently done.
<phil_long/t3/gu/csky...> Walking through the use case...
<phil_long/t3/gu/csky...> Using a QR code contains the credential
<phil_long/t3/gu/csky...> Pre-conditions - instructor working for a company training first aid and Red Cross authorized
<phil_long/t3/gu/csky...> Red Cross has a website to take student info to generate a certificate that is embedded in a QR code and made available to the student
<identitywoman> Static QR Codes are dangerous as a pattern -
<phil_long/t3/gu/csky...> Instructor verifies the student; student passes the course is verified; this is uploaded and website generates the certificate with relevant detail.
<deb_everhart> the uploaded information could include the CTID for the course and the issuer for unique identifiers
<phil_long/t3/gu/csky...> Certificate could be emailed to Pat, or downloaded by the QR code.
<phil_long/t3/gu/csky...> Post-conditions - certificate received with expiry;
<dmitri_z> @IdentityWoman -- +1, good point. QR code credentials can be very useful, but it's definitely crucial to be aware of the downsides and limitations.
<phil_long/t3/gu/csky...> Points of Failure: Website must be available; Pat's gov ID not really checked and mis-issued to the wrong person.
<deb_everhart> the PDF and the VC then can also include the CTIDs and/or URI to more linked open data about the credential and issuer
<phil_long/t3/gu/csky...> How is the DID verified?
<phil_long/t3/gu/csky...> Link shared to paper ( regarding work done on covid certificates and how to get certificates on paper for those needing that.
<phil_long/t3/gu/csky...> Issue with QR codes is that the code is the credential. There isn't a differentiated verifiable presentation. Proof that sigs are there but not shared. The credential can be copied by anyone and hard to differentiate from the origina.
<phil_long/t3/gu/csky...> A bunch of problems with QR codes becoming the norm (as in the draft paper at the link above)
<phil_long/t3/gu/csky...> There isn't anyway to tell a QR code it "is" the credential, not individually verifiable at a given point in time (at presentation of it).
<dmitri_z> IIW session/slide deck on QR Codes for Wallets: . See also: TruAge program for age verification (that include QR codes)
<phil_long/t3/gu/csky...> Digital to digital interaction was the original guide for verification processes. Never designed for the instance of QR codes and the challenges that paper credentials brings.
<eric_kuhn> We use QR codes to pass a URI that starts an issuance or presentation flow through SIOPv2 and OIDC4VP
<phil_long/t3/gu/csky...> Two links put in chat, one about QR codes for wallets and some of their problems in digital credential wallets. (
<phil_long/t3/gu/csky...> Reminder Dimitri is working on DCC digital wallet using QR codes for getting credentials into the wallet and out of the wallet during presentation
<phil_long/t3/gu/csky...> Two types of QR codes. First, stuffing the entire credential in the QR code, and second, one that has just a URL, that starts a credential request flow.
<phil_long/t3/gu/csky...> The latter does address some of the static vs. interactive problems
<identitywoman> like snacks without the s! (so cute)
<phil_long/t3/gu/csky...> Dimitri is coordinator of TrueAge project, National Association of Convenience Stores (NACS), with underage purchase use case, using VCs to try and solve that.
<phil_long/t3/gu/csky...> One of the components of that does use QR codes. The use of QR codes in that program pairs with encrypted driver's licenses, photo IDs and other fraud detection methods.
Jon St. John: +1 Dmitri
<phil_long/t3/gu/csky...> Bare static QR codes can have some of the problems mitigated.
<eric_kuhn> If they don't have a wallet, the 'credential' just exists at the centralized issuer until they do.
<phil_long/t3/gu/csky...> David - nothing in the QR code in the initial use case is unique.
<phil_long/t3/gu/csky...> The notion is to pair a QR code credential is paired with other physical identity documents (driver's license, etc.)
<phil_long/t3/gu/csky...> Matthias - issue of the deadline by which VC-Edu need sthe use cases. They are needed here for VC-Edu by end of Nov.
<phil_long/t3/gu/csky...> There is a name change planned for EBCI (sp) but we'll address that another time.
<kerri_lemoie> Will follow up with Matthias re: EDCI name change
<phil_long/t3/gu/csky...> EK - use cases and QR codes discussion is being co-mingled. The later is more about the initiation of the transfer process of the issuance flows.
<phil_long/t3/gu/csky...> QR codes can be used for an use case initiation and flow.
<phil_long/t3/gu/csky...> For VC-Edu he is thinking more about what schemas are appropriate. Are we taking the schema of open badges and putting it into a QR code and leave interoperability to be solved later?
<phil_long/t3/gu/csky...> Looking to use cases to help the alignment of use cases to Verifiable Credential's data model so that edu use cases and credentials can be used as the VC Data Model requires.
<phil_long/t3/gu/csky...> PDL - Edu use cases in some examples use the data models of 'credentials' for things beyond the assertion of a capability and more in the context of providing guidance and on the progress through the achievement.
Matt Lisle: Re: picking my use cases up next week... sounds good to me
<kerri_lemoie> Thanks @matt!
<phil_long/t3/gu/csky...> Use case first aid certificate a proof of a qualification.
<phil_long/t3/gu/csky...> Occupational qualification for work.
<phil_long/t3/gu/csky...> Goal of the primary actor is to qualify for promotion/raise.
<phil_long/t3/gu/csky...> Actor has a QR cert of a VC; company needs employee with that credential issued and valid; company recognizes the VC is appropriate to meet the work requirement
<kerri_lemoie> (Link to the First Aid proof use case)
<phil_long/t3/gu/csky...> Pat presents paper cert showing that they have met std first aid qualification is valid; canned QR code is recognized as representing the valid issuance; the system would recognize this into the HR system of the company, and the HR system would qualify the person as meeting the requirement for the raise and automatically update the payroll process to bump his salary.
<deb_everhart> thank you!
<phil_long/t3/gu/csky...> Points of Failure: pat has outdated certificate; smartphone app cant' scan the QR code; HR system cannot verify the VC on the cert; HR system does not recognize the cert claimed in the VC as meeting the qualification; Pat's name in the VC is not the same as the name of the employee in the HR system.
<phil_long/t3/gu/csky...> Is this subject to the same cautions re: QR codes as the last one?
<phil_long/t3/gu/csky...> Same cautions about the use of QR codes as the last one.
<phil_long/t3/gu/csky...> (aka first aide credential issuance)