Benjamin Young: https://canivc.com/ ✪

Benjamin Young: Yeah I just uh wanted to share the announcement we posted on the ccg list about can ic.com um if you haven't had a chance to look at that we'd love to get feedback on it it's an attempt to aggregate the uh various w3c test Suites for verifiable credentials um across both the uh verifiable credentials working group and the credentials community group. ✪

Benjamin Young: And it's very much a work in progress but we'd love to. ✪

Benjamin Young: Have more folks running the test suite and and get implementations added as well as get feedback on this. ✪

Benjamin Young: Attempt to bring more visibility to um verifiable compliance basically with these test Suites. ✪

Benjamin Young: So any. ✪

Benjamin Young: Would be great. ✪

Benjamin Young: Um on the mailing list is fine or you can reach out to me directly. ✪

Manu Sporny: Sorry um yeah just a quick um update uh the uh BBS crypto Suite uh that the verifiable credentials working group is working on is uh was was you know the the vote to transition it to the candidate recommendation phase at w3c uh was successful uh it is currently going through transition review and uh if everything goes well which we think it will um will uh transition to a candidate recommendation by the end of March so that basically means it's ready for people to start implementing it uh there will be a test suite for it um uh and so if you have put any of your implementations against any of the test Suites that either the ccg or the verifiable credential working group have been working on um it should be fairly easy to integrate uh with with this uh upcoming test Suite as well um we already have multiple implementations. ✪

Manu Sporny: Which is good news. ✪

Manu Sporny: To have that. ✪

Benjamin Young: https://github.com/w3c/vc-di-bbs-test-suite ✪

Manu Sporny: We are only required to have 2 independent interoperable implementations to exit Crescent so we're pretty confident we already have that but the more the merrier when it comes to implementers um so if you are interested in implementing unlikable signatures um. ✪

Manu Sporny: And help. ✪

Manu Sporny: Out with that. ✪

Manu Sporny: Yes which is fantastic. ✪

Manu Sporny: It's very happy to to to um to have you review the BBS stuff I think that's a wonderful. ✪

Manu Sporny: Yeah this is all uh fantastic stuff um Andreas so um. ✪

Manu Sporny: I'm trying to think of which which thing to ask a question about first so the the the did documents are really interesting uh really neat that uh you were able to use the extensibility features of the did spec to add a whole bunch of different key representations in the did document um in that you know lithium was was 1 of those uh things along with BBs that was really neat to see um and then of course it was really neat to see that you're using uh you know the the data Integrity um uh proof expression mechanism to do the dilithium signature um and that looks I mean it looks very very close to what we would potentially end up standardizing right I mean it's like it's I only maybe a month at most work to go from what you have demonstrated to having a specification that we could probably take um uh standards track so that's uh really neat to see as well um I guess. ✪

Manu Sporny: The the question to you. ✪

Manu Sporny: Is uh you know where what. ✪

Manu Sporny: Where do you. ✪

Manu Sporny: What's the time. ✪

Manu Sporny: For example like you know right now the the verifiable credential working group um I think what we're planning to do is recharter the working group to go into maintenance mode and you know take the current specifications we have through to like Global standards so like the BBS suite and and that kind of stuff so dilithium you know we can't put the new dilithium work in uh just yet um but what we can do is maybe incubate that in the credentials community group and start talking to w3c about hey we can now do post-quantum signatures you know with dilithium kyber and Drew you know whatever we end up end up picking what what is your timeline like what would be what do you think is the ideal timeline what should we focus on uh with respect to post-quantum signatures um uh and like you know data integrity at at w3c. ✪

Manu Sporny: Quickly do you think we could maybe get a specification together to to incubate. ✪

Manu Sporny: Oh I was go go ahead Harrison I I can um I can follow behind you. ✪

Manu Sporny: Okay so so um so yes well the fundamentally you know crypto Suite data Integrity crypto so we just has the algorithm that you follow uh to do to do all the steps I think the good news here is that the only difference with what we all have already taken through the standardization process like so so you know the date Integrity crypto Suites have like um a couple of stages the first 1 is transforming the data uh then you hash the data and then you sign the data right and and Andrea has has demonstrated all of those you know processes and in in what he's shown today um so in the in the transform you either do like I think Andre you were just taking the Json as is in hashing it to sign is that right. ✪

Manu Sporny: Yes absolutely so so here's the good news uh we have standardized at least 2 different ways to do that already so 1 of the things that um w3c has been working on is uh data set canonicalization which is the Sorting that you're talking about um w3c standardized rdf data set canonicalization which we use for w3c uh VCS that use data Integrity but data Integrity also supports Json canonicalization so uh you know the the the the thing that you were talking about uh about you know sorting dictionaries there is a there's a a specification a ITF RFC that exists already that's the standard uh called JCS Json canonicalization scheme that does that so we we have uh syntax specific mechanisms to do that that are already standards that's JCS and we have syntax agnostic mechanisms to do the. ✪

Manu Sporny: Analyzation which is. ✪

Manu Sporny: Is rdf data set canonicalization. ✪

Manu Sporny: So the the. ✪

Manu Sporny: I'm going to assert that that's a solved problem and they're already standard you know to do that so that's the transformation phase um then once you transform that's you know it's a that's kind of the Hard 1 of the hardest parts after you do that hashing is easy and straightforward there are plenty of standards that exist for that and then finally to generate the signature and the and the proof that's really the only thing that's remaining so going back to the question that will raised um. ✪

Manu Sporny: The w. ✪

Manu Sporny: Let's say post-quantum crypto Suites specification. ✪

Manu Sporny: Would just be referring to other standards that already exist and the only new thing that that the w3c data Integrity post-quantum data Integrity crypto Suites would have to do is specify that we're using dilithium specify exactly which you know um uh signature size uh you know we'd be using we may want to also put in uh swing plus and true kyber as kind of a backup in case you know dilithium broken um but it's not a lot of work to do this like we what I'm saying is like the for the past 2 years the verifiable credential working group has created all the base Primitives that we need and those base Primitives are pretty much done at this point where we just reuse the existing base Primitives in the dilithium um specification so I I agree with Andre I mean. ✪

Manu Sporny: This this is not a. ✪

Manu Sporny: Tremendous amount of work. ✪

Manu Sporny: Put this in specification in into a crypto Suite specifically. ✪

Manu Sporny: That's it yeah and and add to that 1 of the 1 of the benefits of parallel signatures is that um you can you can have multiple different organizations put different signatures on the same payload so you know I mean it's not difficult to do a parallel signature implementation it's literally just an array of proofs like you just need to take your proof and then put it in an array and you've got a parallel signature so um it would not be you know as as Andre said it would not be difficult for them to implement parallel signatures it would you know take an hour at at most um but I think the the other thing that's really interesting is that um. ✪

Manu Sporny: We could we could experiment you know as Andrea was showing in in his example you know the crypto Suite started off with experimental Dash so it's an experimental crypto Suite um but the nice thing about you know parallel signatures is that we can put experimental signatures uh alongside you know officials approved you know ecdsa signatures today or beside you know BBS signatures today so um the other thing that we could also do is you know use the VC playground if if Andre and his um uh and and their team um uh the dine team uh could put together like a a credential issuer through Zen room um then we could just add them to the list of issuers and call out to their system to do the dial lithium signatures um in the playground which basically means like you know if we if you wanted to dial lithium signature on any of the verifiable credentials in the playground. ✪

Manu Sporny: The playground would just. ✪

Manu Sporny: Reach out to. ✪

Manu Sporny: Mentation to Zen. ✪

Manu Sporny: Room to add the. ✪

Manu Sporny: Um so we already have you know a number of really useful Primitives to pull in the good work that um Andre our Mill and their team uh is doing. ✪

Manu Sporny: Well I I don't want to hog the questions but it's it's rare to have somebody on a call that knows both BBS and and post Quantum stuff like Andre and are so um the the general question is um what are your thoughts on unlink Quantum signatures or is there any particular team that you're looking at right now um that's working on um post-quantum on linkable digital signatures. ✪

Manu Sporny: More like BBS you know something closer to BBS with the post-quantum scheme. ✪

Manu Sporny: Yes AB absolutely completely agree with that um so we could take the existing ecds ASD suite and we could apply dilithium to it and we would just get selective disclosure um uh out of it which which is great I mean you know that's that's that's beneficial uh but of course you know everyone's wondering well what about BBS BBS is not post-quantum secure um we need uh you know replacement there I know there's some work uh that that um folks are doing on post-quantum on linkable schemes but it's very very you know early days um but at the same time you know it is um. ✪

Manu Sporny: It is uh you know it's an area of Interest people want to see a post-quantum unlabel uh signature it is possible but you know research is very very new in that area and it's probably going to take you know 5 to 7 years for anything worthwhile to kind of pop out there um the other thing that's that's kind of interesting and I'm wondering if if either of you have have um looked into this is is um a hybrid selective disclosure scheme so there are um. ✪

Manu Sporny: You know the way the ecdsa SD um a signatures work is you generate an ephemeral key pair and you use that ephemeral key uh to digitally sign each selectively disclosed um uh entry um and then you use like a hardware back key to digitally sign everything the ephemeral key and all of the selectively disclose statements um uh or rather its you use you use your Hardware back key to sign the ephemeral key which is the thing that signs all the selectively disclosed statements now in in a post-quantum signature scheme um the problem is like the signature sizes like if you're using for example if you're using like Sphinx you're looking at you know 41 kilobyte signatures for each selectively disclosed statement which means that your verifiable credential is gigantic it's multiple hundreds of kilobytes for you know something like a a European. ✪

Manu Sporny: Uh pit or or something of that nature so 1 of the 1 of the other things that we were looking at is this concept of using like Watts or Watts plus um the the idea here is that you can create you know these single time pad signature schemes that are highly space efficient where the signature is space efficient and you can you can use that to generate effectively like 32 to 64 bytes signatures per selectively disclose statement. ✪

Manu Sporny: But then. ✪

Manu Sporny: Over the entire. ✪

Manu Sporny: Using a post-quantum uh scheme so you effectively what you end up with is um a efficient selectively disclosed post-quantum uh scheme that does not have any of the the uh data leaking issues that SD jot uh has have you hopefully 1 that made sense in in 2 have uh you looked into watts and and and kind of uh pad 1 Time Pad based uh schemes as like a hybrid um of of post-quantum schemes. ✪

Manu Sporny: Hierarchical deterministic key stuff. ✪

Manu Sporny: Yeah and and to be clear we would be very happy to put together a a a post-quantum um dating Integrity crypto Suite with with you I think that's the that's something that we could kind of create in incubate in ccg and get more implementers behind and then potentially take Global standards track. ✪