2021-04-29 - Trust Registries Drafting Group Meeting Notes

Owned by Todd Gehrke
May 02, 2021
6 min read

<DAY> March <#>

Attendees

  • Co-Leads: 
  • ID2020 PM: Todd Gehrke 
Participants: 
  • Marcos Allende Lopez  
  • Stephan Baur , 
  • Steve Megennis

Agenda Items

Document review & discussion


Presentations 

Key Resources:


Notes

1. Welcome and Linux Foundation antitrust policy - http://www.linuxfoundation.org/antitrust-policy

Is the Trust registry open to the public? There is a comment in the document about verifying the verifier

[Todd]  it's not a public registry and that it's going to be controlled access, let me just do this, let me just do an assignment.

[Steve] There's going to be some sort of concept of centralization around a registry, you know I think the days I mean you mentioned, you can go down the down the road but well that that's that's a long and.

  • So somebody's gonna have to put together some kind of construct around in there will be inherently rules around that construct you know, preferably in the governance situation and, probably, one that has.

[Steve] You know why respect and is, you know recognized and all that sort of thing right so it's not just you know me and my buddy standing up saying hey important authority, you know that would be somebody with some kind of recognition. And you know with that then comes the notion of you know who can access, both in terms of.

  • [You know, putting data into the system and in terms of who can take data out, and you can easily see you know malicious actors out there saying well i'm just going to set up a loop and just suck all the bandwidth so this registry becomes effective or ineffective.
  • The allocation of usage as a resource like anything else, so, is it just free for all, can you know one organization consumed 90% of the resources is it gonna be some sort of limitation on that to have some sort of level of equity or throttling.
  • You know I view this as being less prescriptive and more descriptive of the sorts of issues that would need to be addressed and.

[Todd] But we're sort of in a chicken and egg situation where the governance framework working group is is is kind of taking the approach where they're saying hey we're on hold until we get feedback from the trust registry.

  • [and other working groups so that we can define the policies and rules that fit with what they have defined so getting those policies and rules in this document is is vital to making sure that any of your concerns get addressed at the at the governance framework level.

[Steve] yeah and it didn't mean to imply this you know, putting that off to governance.

  • [it's going to be a question of what level of detail, do we put in here, and we think it's perfectly appropriate to identify the areas that need to be addressed.
  • You know, every participant must have a contract secured by a bond. They can only have access to equal percentages - I don't think we want to get down to that level, but I think we at least need to identify that these are areas that you do need to be addressed and memorialized in a governance framework.

[Marcos] I wanted to share with you some thoughts on these because we have been having y some discussions around this but also.

  •   In the past year we have addressed the topic of governance, a lot. It's not been formally confirmed yet, but we are very close to a proof of concept in Latin America.
  •   Where we can test having a centralized by history in a decentralized by history in order to verify verifiable credential so what what has convinced.
  •  We can share with you the latest diagrams that we have our development this weekend.
  •  We need to change so we reduce the problem or the trust registry, access the first thing we are discussing is how we access an API.
  •  The response to our centralized approach should be maintained by our Ministry of Health and how do we control access.
  • Then another item for the operation is for mediation,, for example, allow different governments to run independently with validated roles and have to know th mechanism for them to.
  • access the network and at the same time, have some kind of consortium, such as the Latin America is the Inter American Development Bank, telecom, or nonprofit Internet service provider from the region, to Exchange end points so they know how to inter operate in a neutral agnostic way, that can be trusted by the government in order to set these minimum set of rules so governments know the legal entities.
  • Do we contract for relationships with all the governments that are participating, 

[Marcos] I promise I'm gonna try to put together all of this information and I'm going to try to share in suggestion mode in the document so maybe we can discuss and we can review which of these things can be useful.

[Todd] let's stop thinking about trust registries in traditional models and start thinking about them as key resolvers.

  • And, and you know it goes back to what Drummond is suggesting in that there's not there's not just going to be one trust registry.Which is in line with a lot of what Marcos said.
  •  At the end of the day, I just want to resolve keys. Resolving keys by resolving a URL to get public keys, 

[Stephan] How does that become resolving a key?  I'm blocked on that if you have done all the crypto stuff and arrives at verified, everything is okay, 

[Todd] I would I would fetch their did document, and I would make the assumption that either through that DID document or through a mechanism as Marcos described that the signing keys are in there.

[Stephan] Yes, but again Todd you're keys are in there, can I trust that I can authenticate that entity. It doesn't really it doesn't speak to the trust mechanism, we need to establish whether you can trust the issue or if that document iis trusted.

[Todd] Agreed the sequence that you're describing where I would be able to verify the authenticity of a document or a signature without from a verify the issuer is in the trust registry first. - I assume I already had and was determined to be a trusted issuer.

[Steve] The verification people might be part of the airlines, they might be independent, they might be part of the coverage, but they draw lines around those. And you talk about calling these extemporaneous trust things evolving, naturally, but really that evolved out of the context of the problem.

  •  So, in other words, there are only so many airlines in the world, there are only so many airports in the world, and you know we don't have to worry about the problem of a random airport popping, so that tend to you know it was to limit the scope of who we can trust and what assumptions, we can make so.

[Todd] The challenge is that there is some of that problem that is out of our control, like with the WHO and and the EU green pass, so you know we do get into the multiple.

  • Airlines would really like to push this problem out the door.
  • And they would rather have the verification of the credential like when you get your boarding pass. Go to a kiosk or web site and ultimately results in a check mark on your boarding pass; like you know tsa pre check it.

[Steve] I think that a lot of that occurs outside of the system. For example, if I have a third party processing, on behalf of the airlines, yes I've expanded my ecosystem, but effectively the contract that an airline has with a third party brings it back in because it's very talking about distributing liability.

[Stephan] We are, we need to prove ourselves to an immigration officer or a TSA officer scanning this thing on your phone.

  • What happens is these processes that already have called tickets and access gates only need a gateway to the source airline. The APP or whatever means, you get your electronic voting card, and now it just happens, ask you to upload that little JSON and, and they need to verify it.

[Steve] That's exactly what the rules engine is talking about and they have this concept that the rules engine is the big heavy lift stuff ready to get a bunch of credentials I apply bunch of, legal constructs and to come up the answer or creates a pass like a boarding pass them by just be a check mark on existing pass I move through the process.

  • The access control point, which is the gatekeeper to decide if you step foot on the plane is delegated to simple business rule application or those business rules, I just might have in my head, because I went to you know 30 minutes of training before he started my shift.
  • you might have to take a credential at the point of departure, like your passport just to verify that you actually physically have passed control.
  • There are two, there are different things here one is what the airline wants to say every passenger has checked in the airplane to have had the vaccination and validate people internationally

       

Action Items

  1. TBC