Proposed Linked Data Signatures Working Group Charter

DRAFT

This is a draft text, under development by the community. The goal is to, eventually, submit this draft charter proposal to an official W3C AC review.

Any text rendered like this refers to content that must be finalized before the charter is sent to AC review.

Any text rendered like this refers to content that must be updated when the final charter is published at the latest (e.g., adjusting hyperlinks).

This proposed charter is available on GitHub. Feel free to raise issues.

The mission of the Linked Data Signatures Working Group is to define a standard for uniquely identifying and securing Linked Data in use cases such as Verifiable Credentials. The work will include defining RDF Dataset Canonicalization algorithms as well as algorithms and vocabularies for encoding digital proofs, such as digital signatures, and with that secure information expressed using concrete RDF syntaxes such as JSON-LD, TriG, and N-Quads. Digital proofs apply to the RDF dataset — the underlying graphs — not the particular serialization/data file.

Start date [30 September 2021] (date of the "Call for Participation", when the charter is approved)
End date [30 September 2023]
Charter extension See Change History.
Chairs Phil Archer, GS1
Markus Sabadello, Danube Tech
Team Contacts Ivan Herman (0.2 FTE)
Meeting Schedule Teleconferences: 1 hour calls to be held weekly; extra topic-specific calls may also be held.
Face-to-face: we will meet during the W3C's annual Technical Plenary week; additional face-to-face meetings may be scheduled by consent of the participants, usually no more than 3 per year.

Scope

(For the usage of the terms “RDF” and “Linked Data", see the terminological note in the explainer document.)

There are a variety of use cases in the area of Linked Data, such as Verifiable Credentials, the publication of biological and pharmaceutical data, or consumption of mission critical RDF vocabularies that depend on the ability to verify the authenticity and integrity of the data being consumed. (See the use cases for more examples.) In order to achieve these use cases, a standard way is needed to process the underlying graphs contained in RDF Datasets that is independent of the serialization itself.

The scope of this Working Group is to define standards to canonicalize, cryptographically hash, and digitally sign an RDF Dataset. This includes the definition of a standard canonicalization algorithm, a generic algorithm for generating and verifying a digital proof using existing cryptographic primitives, an RDF vocabulary for expressing the results of digital proof generation algorithm, and a way of representing and referencing specific existing cryptographic proof algorithms and parameters in a format that can be referred to from an RDF Dataset. The Working Group will also provide preferred ways to represent this vocabulary in various RDF serialization formats. (See the separate explainer document for more detailed technical backgrounds and for the terminology used in this context.)

Out of Scope

The following items are out of scope, and will not be addressed by this Working group:

  • Definition of new cryptographic signature or encryption algorithms such as RSA, ECDSA, EdDSA, and AES. This Working Group will only define usage of, and suitable terms to identify, such algorithms.
  • Authenticity and trust issues of Web (Data) content that go beyond the exchange and the integration of simple factual data expressed in RDF. (See also some further considerations in the explainer document.)

Deliverables

More detailed milestones and updated publication schedules are available on the group publication status page.

Reference is to a (draft) specification used as a primary input to the work. Expected completion indicates when the deliverable is projected to become a Recommendation, or otherwise reach a stable state.

Note that the titles of the documents are tentative and not final. The Working Group may also decide to either split some of those documents or, conversely, merge some of them. See also a note in the explainer for some more backgrounds on the structure and content of the deliverables.

Normative Specifications

The Working Group will deliver the following W3C normative specifications:

RDF Dataset Canonicalization (RDC)

This specification defines an algorithm to produce a canonicalization function of an arbitrary RDF Dataset.

Reference: RDF Dataset Canonicalization, eds. Dave Longley, Manu Sporny, W3C Draft Community Group Report, 2019.

Expected completion: WG-START + 24 months.

See also the mathematical basis for RDF Dataset Canonicalization:

  1. RDF Dataset Canonicalization, Rachel Arnold, Dave Longley, W3C Credentials Community Group, 2020.
  2. Canonical Forms for Isomorphic and Equivalent RDF Graphs: Algorithms for Leaning and Labelling Blank Nodes, Aidan Hogan, ACM Trans. Web, vol. 11, no. 4, p. 22:1-22:62, 2017.
RDF Dataset Hash (RDH)

This specification details the processing steps of a hash function for an arbitrary RDF Dataset. These step include (1) the generation of a canonical form using the algorithm specified in the “RDF Dataset Canonicalization” deliverable, (2) sorting the N-Quads serialization of the canonical form generated in the previous step, and (3) application of a cryptographic hash function on the sorted N-Quads representation.

Reference: Linked Data Proofs 1.0, eds. Dave Longley, Manu Sporny, W3C Draft Community Group Report, 2020.

Expected completion: WG-START + 24 months.

Linked Data Integrity (LDI)

This specification defines a framework for expressing, in an RDF Graph, proofs of integrity of RDF Datasets. Since RDF follows the Open World Assumption, it is recognized that 'proof of integrity' cannot apply to arbitrarily large RDF Datasets in all contexts. Nevertheless, there are contexts where the integrity of the data can be assessed with confidence. Verifiable Credentials are a prime example of this, where one or more assertions are made by an identified party concerning an identified subject. In contrast, asserting 'proof of integrity' over the corpus of RDF embedded in billions of Web pages would be meaningless.

The Working Group will define a framework in which meaningful proofs of integrity can be provided. The framework will use RDH although the hashing algorithm, and other constituents of proofs of integrity including the purpose of the proof, are identified as assertions, allowing the same framework to be used with other algorithms. Beyond the normative framework, this deliverable also provides a normative definition for Linked Data Signatures as a prominent approach used as a proof of integrity. The specification enables a 3rd party to verify the integrity of the data for the purpose in which it is offered and in the context in which the integrity is asserted.

Reference: Linked Data Proofs 1.0, eds. Dave Longley, Manu Sporny, W3C Draft Community Group Report, 2020.

Expected completion: WG-START + 24 months.

Linked Data Security Vocabulary (LDSV)

This specification defines an RDF Vocabulary for the terms defined in the Linked Data Integrity deliverable. The specification may also define one or more JSON-LD Context documents that may be used by a JSON-LD serialization.

Reference: The Security Vocabulary, ed. Manu Sporny, Orie Steele, Tobias Looker, W3C Draft Community Group Report, 2020.

Expected completion: WG-START + 24 months.

Other Deliverables

Other non-normative documents may be created such as:

  • A Linked Data Security Registry, containing Linked Data related cryptographic terms, including, but not limited to, the terms defined in the Linked Data Security Vocabulary (LDSV), as well as terms for the definition of other Linked Data Integrity related proof methods.

    If, during the chartered period of the Working Group, the next version of the W3C Process is adopted, incorporating the concept of a Registry Track, the Working Group will consider publishing the Linked Data Security Vocabulary Recommendation with an additional Registry Section incorporating the terms planned in this deliverable.

  • Note on additional Linked Data Integrity techniques that are not necessarily relying, or only partially, on the specifications developed by this Working Group. (See also the explainer for some examples.)

  • Test suite and implementation report for the specification.

  • Primer or Best Practice documents to support Web developers when designing applications. These documents should also contain guidance and caveats on how to securely use and combine the building blocks provided by the normative deliverables. In particular, the potential security issues related to the usage of remote JSON-LD Context documents in the context of Linked Data integrity should be addressed.

Timeline

  • WG-START +1 month: First teleconference
  • WG-START +3 months: FPWD for RDC
  • WG-START +6 months: FPWD for RDH, LDI, and LDSV
  • WG-START +15 months: CR for RDC
  • WG-START +18 months: CR for RDH, LDI, and LDSV
  • WG-START +24 months: REC for all standards-track documents

Success Criteria

In order to advance to Proposed Recommendation, each normative specification is expected to have at least two independent implementations of every feature defined in the specification.

Each specification should contain separate sections detailing all known security and privacy implications for implementers, Web authors, and end users.

There should be testing plans for each specification, starting from the earliest drafts.

To promote interoperability, all changes made to specifications should have tests.

Coordination

For all specifications, this Working Group will seek horizontal review for accessibility, internationalization, performance, privacy, and security with the relevant Working and Interest Groups, and with the TAG. Invitation for review must be issued during each major standards-track document transition, including FPWD. The Working Group is encouraged to engage collaboratively with the horizontal review groups throughout development of each specification. The Working Group is advised to seek a review at least 3 months before first entering CR and is encouraged to proactively notify the horizontal review groups when major changes occur in a specification following a review.

Additional technical coordination with the following Groups will be made, per the W3C Process Document:

W3C Groups

Decentralized Identifier Working Group
To synchronize on cryptography-related vocabularies and definitions.
Verifiable Credentials Working Group
To synchronize on cryptography-related vocabularies and definitions.
Dataset Exchange Working Group
To synchronize on the needs and requirements of dataset publications and exchange regarding canonicalization and digital signatures.
Web of Things Working Group
To synchronize on the needs and requirements of the WoT community, in particular on the subject of WoT Thing Descriptions, regarding canonicalization and digital signatures.
Credentials Community Group
Coordination on other specifications incubated and maintained the Credentials Community Group at W3C.
RDF-DEV Community Group
To synchronize on the further evolution of the RDF Standard, such as digital proofs for Generalized or RDF-star Graphs and Datasets.

External Organizations

Internet Engineering Task Force Crypto Forum Research Group
To perform broad horizontal reviews on the output of the Working Group and to ensure that new pairing-based and post-quantum cryptographic algorithms and parameters can be integrated into the Linked Data Security ecosystem.
Internet Engineering Task Force ART Area Review Team
To coordinate on the work on the work of JWS Clear Text JSON Signature Option to ensure that no obstacle should be created for further possible harmonization.
National Institute of Standards and Technology, U.S. Department of Commerce
To coordinate in ensuring that new pairing-based and post-quantum cryptographic algorithms and parameters can be integrated into the Linked Data Security ecosystem.
Hyperledger Aries
To coordinate on broad horizontal reviews and implementations related to the specifications developed by the Working Group.
Decentralized Identity Foundation Interoperability Working Group
To coordinate on broad horizontal review and integration of the specifications developed by the Working Group into the Decentralized Identity Foundation's ecosystem.

Participation

To be successful, this Working Group is expected to have 6 or more active participants for its duration, including representatives from the key implementors of this specification, and active Editors and Test Leads for each specification. The Chairs, specification Editors, and Test Leads are expected to contribute half of a working day per week towards the Working Group. There is no minimum requirement for other Participants.

The group encourages questions, comments and issues on its public mailing lists and document repositories, as described in Communication.

The group also welcomes non-Members to contribute technical submissions for consideration upon their agreement to the terms of the W3C Patent Policy.

Participants in the group are required (by the W3C Process) to follow the W3C Code of Ethics and Professional Conduct.

Communication

Technical discussions for this Working Group are conducted in public: the meeting minutes from teleconference and face-to-face meetings will be archived for public review, and technical discussions and issue tracking will be conducted in a manner that can be both read and written to by the general public. Working Drafts and Editor's Drafts of specifications will be developed in public repositories and may permit direct public contribution requests. The meetings themselves are not open to public participation, however.

Information about the group (including details about deliverables, issues, actions, status, participants, and meetings) will be available from the Linked Data Signatures Working Group home page.

Most Linked Data Signatures Working Group teleconferences will focus on discussion of particular specifications, and will be conducted on an as-needed basis.

This group primarily conducts its technical work on GitHub issues. The public is invited to review, discuss and contribute to this work.

The group may use a Member-confidential mailing list for administrative purposes and, at the discretion of the Chairs and members of the group, for member-only discussions in special cases when a participant requests such a discussion.

Decision Policy

This group will seek to make decisions through consensus and due process, per the W3C Process Document (section 3.3). Typically, an editor or other participant makes an initial proposal, which is then refined in discussion with members of the group and other reviewers, and consensus emerges with little formal voting being required.

However, if a decision is necessary for timely progress and consensus is not achieved after careful consideration of the range of views presented, the Chairs may call for a group vote and record a decision along with any objections.

To afford asynchronous decisions and organizational deliberation, any resolution (including publication decisions) taken in a face-to-face meeting or teleconference will be considered provisional. A call for consensus (CfC) will be issued for all resolutions (for example, via email and/or web-based survey), with a response period from one week to 10 working days, depending on the chair's evaluation of the group consensus on the issue. If no objections are raised on the mailing list by the end of the response period, the resolution will be considered to have consensus as a resolution of the Working Group.

All decisions made by the group should be considered resolved unless and until new information becomes available or unless reopened at the discretion of the Chairs or the Director.

This charter is written in accordance with the W3C Process Document (Section 3.4, Votes) and includes no voting procedures beyond what the Process Document requires.

Patent Policy

This Working Group operates under the W3C Patent Policy (Version of 15 September 2020). To promote the widest adoption of Web standards, W3C seeks to issue Recommendations that can be implemented, according to this policy, on a Royalty-Free basis. For more information about disclosure obligations for this group, please see the W3C Patent Policy Implementation.

Licensing

This Working Group will use the W3C Software and Document license for all its deliverables.

About this Charter

This charter has been created according to section 5.2 of the Process Document. In the event of a conflict between this document or the provisions of any charter and the W3C Process, the W3C Process shall take precedence.

Charter History

The following table lists details of all changes from the initial charter, per the W3C Process Document (section 5.2.3):

Charter Period Start Date End Date Changes
Initial Charter [dd monthname yyyy] [dd monthname yyyy] none