Page History

...

• Mobile Verifiers
  • We need them.
  • Flow
    • Holder displays QR, Verifier scans with mobile app and sees the result. - Common Model, assumed by those new to industry.
    • 'presenting' the QR code feels natural when 'presenting' a credential.
    • QR is best as invitation, not requiring user to know in advance what to present.
    • Verifier can also display QR.
    • Speed of transaction
      • User prepares to have transaction happen fast
        • Preselect or preauthorize set of actions
        • Can be assisted by governance / trust registry to find common targets
      • build set of 'reapprovals' after done initially.
        • save my authorization
  • Unique Features
    • Offline Verifications
      • Can't use shortened QR codes
      • BLE Verification useful offline
        • Needs framework support
      • Machine Readable Governance - cached
        • Cache schemas
        • Cache public keys for verifiers?
        • Pass file? (Interaction)
      • NFC - Needs investigation
    • Common Hardware
    • Framework support required
      • Offline aware
    • UI Supports required
    • Cache Needed
      • Speed of local assets
      • Mechanisms
        • Trust Registry Protocols - https://wiki.trustoverip.org/display/HOME/ToIP+Trust+Registry+Protocol+Specification
          • Webinar - https://www.continuumloop.com/trust-registries-webinar/
        • Machine Readable Governance
        • Hard Coded
      • TTL
    • User Experience
      • Clear for Holder
      • Clear for Verifier
      • Clear indication of where in the flow they are. Universal progress bar?
      • Particularly for non-happy paths
        • Internationalization / Localization
    • Performance
    • Auditing verifications
      • reporting verifications back to main org
      • minimal disclosure auditing
      • knowing what is stored/passed
  • Actions Items
    • Framework Support
      • Caching
      • Transport (BLE, NFC)
    • Summary of existing state - Where are we?
      • BLE
        • https://github.com/decentralized-identity/didcomm-bluetooth/blob/main/spec.md
      • NFC - how would it work? - Sebastian (Lissi)
      • Docs about Machine Readable Governance is currently being used.
        • Mike to provide overview in a few weeks, for now a presentation
        • Trust Registries from ToIP - Darrell provided, to link
        • How do verifiers get templates of presentation requests so they know what to ask.
    • UX of selecting which you want to verify and doing verifications
      • Use cases – e.g. Verifier is processing a line up going into an Event collecting Ticket+PoVaccination
      • UX for some use cases
• Device Recovery (Backup/Restore/SyncRecovery/Rotation to new keys)
  • Backup / Restore Formats?
  • https://w3c-ccg.github.io/universal-wallet-interop-spec/
  • Data Model + app specific in the same format?
  • Keep them separate?
  • Security of backups?
    • huge attack vector – e.g. family member restores backup to new device and uses data
    • Is it possible to disable an old phone when a restoration is done to a new phone?
    • Assumption is that encrypted backup goes one place, the recovery key goes elsewhere and the only come together for restore
      • Is there more that can be done?  Other protections?
        • N of M recovery mechanism – e.g. Shamir's Secret Sharing (coolest algorithm ever!)
      • Can this be done with self-service?  Is that safe enough?
      • Selective recovery – is that possible?
  • Some things that can't be backed up or restored
    • Example is a device-based keys – you can't back these up
      • If there is a credential somehow tied to a device key, that credential must be reissued (and that's OK)
  • How to do continuous backups (don't lose data)?
    • File format
      • File format for a full backup
        • Contents – connections, credentials, history
      • Will we have to do (more or less) continuous backup - full backup every time efficient enough vs. incremental?  Classic backup issues.
        • Treat this as an optimization for now
    • An RFC to define such a protocol to be used with a backup service – perhaps supplied by a mediator (but could be any connection).
      • Setup backup – location, recovery key(s) (format – e.g. passphrase? biometrics?), restoration process
      • Make backup – ongoing – data format
      • Retrieve backup for restoration
      • Restore backup using recovery key(s)
    • How can Mobile OS features help with this?
      • E.g. Backup/Restore of app data
• Secure Element usage
  • Provinces Project - diagram, markdown - decisions when making a wallet.
    • starting point for security framework oriented folks.
• SDK / Embedding Agents into existing Mobile Apps

...