• Start recording
• Welcome & antitrust notice
• Introduction of new members
• Agenda review

• Antitrust Policy Notice: Attendees are reminded to adhere to the meeting agenda and not participate in activities prohibited under antitrust and competition laws. Only members of ToIP who have signed the necessary agreements are permitted to participate in this activity beyond an observer role.
• New Members:

• Sam Smith to create a semantic naming document in the code - call it NAMING.md and check it in. (Almost done)
  • https://github.com/WebOfTrust/keripy/pull/603/files
  • https://github.com/WebOfTrust/keripy/blob/development/docs/naming.md
• Philip Feairheller to add rotation script demo and "How to create IPEX message to perform a "presentation"" to dev meeting agenda
• Philip Feairheller to follow up with Karla from GLEIF on updates to vLEI EGF to account for QVI partial rotation.

News or events of interest to members:

• None

Reports

• KERIpy / ACDC
  • None
• Trust Spanning Protocol / SPAC
  • Restructuring of the SPAC paper plus new short-hand notation, published
  • https://github.com/SmithSamuelM/Papers/blob/master/whitepapers/SPAC_Message.md
• Signify/KERIA
  • Looks like we will be naming the protocol between a client and the server "Signify"
  • Outstanding PR for performing GRANT with chained credentials
• CESR
  • Draft of proposed codes for CESR 1.1 almost complete.
  • Review new code proposal next week
• Specifications:
  • More PRs inbound for the ACDC, KERI and CESR specifications
• KERISSE
  • Have created a template for an issue
  • https://github.com/WebOfTrust/WOT-terms/issues/new?assignees=&labels=feedback%2Cquestionnaire&projects=&template=keri_suite_dev_questionnaire.yml&title=KERI+Suite+Feedback%3A+
  • Call to action: Could 2 or 3 people fill out this form and give us feedback on what should be done differently in the form>

• Why KERI is more resistant to phishing than other authentication mechanisms
  • "No Shared Secrets"
  • Phishing is an attack BECAUSE of shared secrets
    • To gain access to remote systems with shared secrets, you become trained to share your secret to gain access.  That opens you up to Phishing.
    • Passwords, OIDC Bearer Tokens (MGM/Okta compromise), VPN Configurations or Portals that use client side certificates. 
    • Key Compromise Impersonation Attack - In DHKE, any attacker that gains access to a client-side private key can impersonate a server and man-in-the-middle any other client.  
  • How is KERI different:  KERI has no Shared Secrets.  
    • Access and authentication are based on signing.
  • FIDO not using shared secrets, but no rotation solution.  So you can attack passkeys when they rotate their keys.

• How vLEIs can delegate authority instead of simply specifying "role"
  • vLEI specifies a role but is not specific about what authority goes along with that role...  how is authority expressed?
  • How does a verifier understand semantically what is being expressed?
  • The vLEI does not answer either of these questions because the semantics are use case specific.
    • There must be an ecosystem EGF to define these semantics
    • There is no way to define a universal meaning
    • Context is King.  
• How does AID delegation relate / differ to ACDC delegation?
  • See recording

• Review decisions/action items
• Planning for next meeting