September 2016 - DG-BSC - mailman.kantarainitiative.org

Agenda for BSC telecon Tuesday, August 30 (shortly -- sorry for the late note!)
by Eve Maler 01 Nov '16

01 Nov '16

http://kantarainitiative.org/confluence/display/BSC/2016-08+%28August+2016%… We meet *Tuesdays* for 30 minutes at 7:30am PT / 10:30am ET / 3:30pm UK / 4:30pm CET. We use Kantara Line A (US +1-805-309-2350, Skype +99051000000481, international options <https://www.turbobridge.com/international.html>, web interface <https://panel.turbobridge.com/webcall/>, more info <https://www.turbobridge.com/join.html>, code 4022737) and http://join.me/findthomas for screen sharing. See the DG calendar <http://kantarainitiative.org/confluence/display/BSC/Calendar> for our full meeting schedule. Previous meeting minutes are here: July <http://kantarainitiative.org/confluence/display/BSC/2016-07+%28July+2016%29…> . Agenda: - Confirm timeline, scope, and approach, or revise in specific - Assign action items for report next steps *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *London and Paris!*

5 11

FYI
by John Wunderlich 30 Sep '16

30 Sep '16

https://medium.com/@bsuichies/why-blockchain-must-die-in-2016-e992774c03b4#… This is the posting that contains a"Do you even need a blockchain" flowchart that fits into discussions of scope etc. Sincerely, John Wunderlich @PrivacyCDN <https://twitter.com/PrivacyCDN> Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

4 3

ONC/NIST blockchain papers
by Scott Shorter 29 Sep '16

29 Sep '16

Hi all, As mentioned on the call, here’s the link to the submissions to the NIST/ONC healthcare blockchain challenge: https://oncprojectracking.healthit.gov/wiki/display/TechLabI/Blockchain+Cha… Enjoy! - Scott Scott Shorter - Vice President, Security sshorter(a)kimbleassociates.com<mailto:sshorter@kimbleassociates.com>

2 1

Notes from BSC telecon Thursday, September 29
by Eve Maler 29 Sep '16

29 Sep '16

http://kantarainitiative.org/confluence/display/BSC/2016-09+%28September+20… Agenda: - Report <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> writing Attending: Eve, Thorsten, Andrew, Scott S, Kathleen, Matisse We did a lot of report writing work, directly in the report. *AI:* Eve: Ask Scott D if he will take an action to write the "Legal Contracts" section of the report, providing a definition, a short discussion of strengths and weakness of the current way of doing things, and pointers to the other technology and technique sections as appropriate for starters. Bringing in the ethics perspective would also be awesome. *AI:* Eve: Ask Thomas if he will take an action to write the "IPFS" section along the lines just above. *AI:* Eve: Ask John W if he will take an action to write the "Consent Receipts" section along the lines just above, and either write or find a designee for the "User-Submitted Terms" section. Others took AIs to fill in other similar report sections on the call; see the report for those. Everyone please review the report for the latest! *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *London and Paris!*

1 0

Sovrin
by Thorsten H. Niebuhr [WedaCon GmbH] 29 Sep '16

29 Sep '16

Definitly worth a look: https://www.sovrin.org/ Thorsten

1 0

Fwd: Trying to explain BSC to HL7 Security and Privacy WGs
by Eve Maler 29 Sep '16

29 Sep '16

For posterity, please find below Kathleen's "matrix" table and 3D diagram that we'd been discussing in the last couple of weeks. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *London and Paris!* ---------- Forwarded message ---------- From: Kathleen Connor <kathleen_connor(a)comcast.net> Date: Tue, Sep 20, 2016 at 5:21 AM Subject: RE: Trying to explain BSC to HL7 Security and Privacy WGs To: Eve Maler <eve.maler(a)forgerock.com>, Thomas Hardjono <hardjono(a)mit.edu>, john(a)wunderlich.ca, james.g.hzard(a)gmail.com Cc: Kathleen Connor <kathleen_connor(a)comcast.net> Hi Maybe a picture works better than words in this case. Visually, what I’m wishing for is something like this graph against which BSC protocols/schemes could be plotted. I.e., could any of you plot Stellar and Ethereum, or other types, on this graph? If not, what needs to change. It’s somewhat difficult to clearly delineate economic and governance paradigms, so maybe that’s the first step. Public/Private may be easier. -K *From:* Kathleen Connor [mailto:kathleen_connor@comcast.net] *Sent:* Tuesday, September 20, 2016 12:54 AM *To:* 'Eve Maler'; 'Thomas Hardjono'; john(a)wunderlich.ca; ' james.g.hzard(a)gmail.com' *Cc:* 'Kathleen Connor' *Subject:* Trying to explain BSC to HL7 Security and Privacy WGs Hi – I’m at HL7 cochairing Security and Financial Management WGs – and BSC is a “hot topic”. During the last couple of BSC calls, we’ve talked about the different governance/control/risk vectors related to the several BSC protocols. I just wish I had enough of an overarching view that I could convey this to those interested, large scale communities who are interested in deploying for healthcare. I have a few breadcrumbs, but know I’ve heard more from our DG. Seems to me that if there were such a multi-axel grid for others to quickly gauge where a particular BSC player/community/protocol lived in relation to the rest, that it would be a “goodness” that we could contribute as a DG. So, it’s too late for me to get enough done by tomorrow’s presentation other than hand waving over a matrix – and I’m going to miss all of this week’s calls, but wanted to know if this sort of approach [raw] makes sense to the this group, and if so, to the larger group as a “cheat sheet” contribution, if only to gather our own thoughts on the BSC taxonomy. E.g. Purpose, how do I best explain the difference between MedRec and the Alice/Bob Research use cases. Or Ethereum and Stellar for preservation of Governance Principles? If this has already been done – please let me know. Scott seemed to be way ahead of us on the ethics/governance front. Is there a simple way to make this clear to ourselves and others? If not, could we put this on the work list as a possible taxonomy for the BSC use cases? Below are just guesses on columns and entries for discussion purposes. -K BSC Protocol Public / Private De/Centralized Consensus/Dictator Data Owner Control Data Subject Control Community Economic PRO Community Economic CON Risk Mitigation Comments Pure Public D Anarchy Ethereum Public Vetted D Ranked voters Stellar Private Vetted D Vetted Voters

2 1

FYI: Blockchain art exhibit in NYC
by John Wunderlich 27 Sep '16

27 Sep '16

http://www.petzel.com/exhibitions/2016-09-08_simon-denny/ Sincerely, John Wunderlich @PrivacyCDN <https://twitter.com/PrivacyCDN> Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 2

A definition for "Digital Identity"
by Andrew Hughes 27 Sep '16

27 Sep '16

Hi folks - I'd like to test out a variation on the typical definition of 'identity'. If it gets traction in this group, it could possibly be a way to express the "requirements" that this digital identity thing has of the blockchain and smart contracts capabilities (which is one way to view the mandate of the DG). You will probably notice a mash-up and blending of several different well-known concepts and definitions to try and adopt those aspects of the other representations (user-centric, VRM, OpenNotice/Consent/Information Sharing, myData, privacy principles, self-sovereign and many more) *tl;dr* *By describing digital identity in terms of information records that may contain 'identity' information, we can talk about actors and services that use the information assets rather than a more abstract notion of identity as a right or embodied characteristic of an entity. NB: Other works can deal with credentials and authentication - this is not that - this is about the information itself.* So: I'd appreciate your observations and comments directly or to the list. I'm not really looking for word-smithing advice but rather: is the following a reasonable working definition? A secondary thought is: given the capabilities and features of blockchains and smart contracts, do the descriptions of 'self-sovereign' and 'administrative' identity information (records) lead to obvious and useful explorations of requirements? I await the deluge of critical thought and advice ;-) andrew. =============== Digital Identity: - The identifiers, credentials and the credentials’ authenticators that an Entity uses to claim that they are the Subject of a Digital Identity Information Record. - The Digital Identity Information Records in any storage location. There are many schools of thought about what a digital identity represents and the uses for digital identities. Each has a different taxonomy to describe the different types and characteristics of those identities. The school of thought related to the personal data ecosystem, personal data stores, and self-sovereign identity (see Searls, Windley, Blakley, Cameron, et al) uses at least two major categories, paraphrased and expanded below: Administrative identity information: labels used to keep track of entities, their information records and the services they use. These labels are controlled by the issuer. A common example today are email addresses used as login identifiers. Self-sovereign identity information: information about the entity that is controlled by the entity and released on the authority of that entity. Self-sovereign identity information may include identifiers or attributes. Self-sovereign identity information can be used to assert facts about the self without subservience to a central authority. *Digital Identity Information Record:* - The information records containing information about an Entity that can be used to attempt to identify or distinguish the Entity from other Entities in a population - The Digital Identity may or may not enable unique distinguishment of an Entity in a population - Can contain personal information, personally identifiable information, identity attribute information. - The record may also contain, secondarily, non-personal or non-identity information. It is uncommon to see ‘pure’ Digital Identity Information Records because the records contain information related to the purposes of the record holder. The main point being that the record has a direct association to the Entity. - Can also contain information about relationships and bindings =============== *Andrew Hughes *CISM CISSP Independent Consultant *In Turn Information Management Consulting* o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com ca.linkedin.com/pub/andrew-hughes/a/58/682/ *Identity Management | IT Governance | Information Security *

1 0

Notes from BSC telecon Tuesday, September 27
by Eve Maler 27 Sep '16

27 Sep '16

http://kantarainitiative.org/confluence/display/BSC/2016-09+%28September+20… Agenda: - Report <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> writing Attending: Eve, Thomas, Thorsten, Andrew, John W, Jim H, Matisse We have a LOT of new information sources, including some comparative material, to help us complete our thematic introduction in the report. (One new source shared on the call: Stellar info <https://www.stellar.org/developers/guides/concepts/scp.html>.) Is it meaningful to achieve "transactional empowerment" use cases if you are some way down the path of decentralization, or must you reach 100% decentralization? Andrew suggests that where perfect decentralization can't be achieved, transparency and accountability can shore up the necessarily centralized parts of the system. Having "an authority" (vs. "your peers") detect a transgression requires traditional controls. But, speaking of roles here, depending on what sort of blockchain technology *and* governance model *and* blockchain contents are involved, are they really "your peers"? There seem to be a lot of ways that the node miners' interests may not be strictly aligned with yours. Matisse believes the main value of choosing blockchain for "transactional empowerment" would be smart contracts – being able to withdraw your consent from a contract and, say, get your money back from a smart vending machine. Jim notes that smart contracts are really a different technology from blockchain – based on blockchain technology but a specific application that requires "contract semantics" at the nodes. Regarding economic efficiencies, a big attraction of Bitcoin use cases has been to make transactions more efficient by removing intermediaries. However, the world has been finding that technical inefficiencies (performance challenges) have arisen. Specific use cases: currency (a la Bitcoin), certification (a la notary services), smart contracts (a la vending machine, land registry, drone control)... Jim has made the case that smart contracts need to connect to the legal world through both format and semantics. A transactional system presumably must take into account the "business/legal" environment in some fashion, even if just implicitly (say, by referencing certain jurisdictional laws, terms, and concepts). So either a smart contract is a non-contract (the way a contract with a killer would be – though perhaps with consequences less dire!) or it is a true contract precisely by taking into account its surrounding business/legal environment through a standardized format and semantics. It had better be possible for a true "smart contract" to have parties who have the proper rights and responsibilities. AIs: - Jim: Share his draft Kantara blog post on the list - Eve: Take the latest notes and try and squeeze them into the report for review on Thursday - All: Please review all the resources shared on the list and in the notes before Thursday *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *London and Paris!*

1 0

Fwd: link to some blockchain papers
by Eve Maler 26 Sep '16

26 Sep '16

Matisse has kindly assembled the following materials to help us with our efforts to analyze and document the tensions/themes. Please see below. Separately, John W sent me the following link, which contains some comparative analysis: https://docs.google.com/presentation/d/11WwKRK8RrGokPvrm3APshHY_DlyYOKz_ipc… I suspect the best way for us to make progress is for those with keen analytical and writing skills to do some homework *before* the next meeting, perhaps with a glass of wine handy. :-) *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *London and Paris!* ---------- Forwarded message ---------- From: mat perugini <mat.perugini(a)gmail.com> Date: Mon, Sep 26, 2016 at 1:11 AM Subject: link to some blockchain papers To: Eve Maler <eve.maler(a)forgerock.com> Dear Eve, here is the paper list you have been asking for. The historical part covers from 1982 to 2009. The ethereum blog expalins in a very linear way the issue of concurring blockchains. Paper: Smart Contract a Preliminary evaluation, exposes the state of my reasarch at the end of 2015. Even though there are things I have reconsidered (and that will be better explained in my fnal essay), it exposes some of the main concepts I am working on. Kind regards Matisse ************************** history •David Chaum, Blind signatures for untraceable payments, 1982 *http://www.hit.bme.hu/~buttyan/courses/BMEVIHIM219/2009/Chaum.BlindSigForPayment.1982.PDF <http://www.hit.bme.hu/%7Ebuttyan/courses/BMEVIHIM219/2009/Chaum.BlindSigFor…>* •David Chaum, Online Cash Cecks, 1989 *https://w2.eff.org/Privacy/Digital_money/?f=online_cash_chaum.paper.txt <https://w2.eff.org/Privacy/Digital_money/?f=online_cash_chaum.paper.txt>* •Timothy C. May, The Crypto Anarchist Manifesto, 1988, *http://www.activism.net/cypherpunk/crypto-anarchy.html <http://www.activism.net/cypherpunk/crypto-anarchy.html>* •Nick Szabo, Contracts with Bearers, 1998, *http://szabo.best.vwh.net/bearer_contracts.html <http://szabo.best.vwh.net/bearer_contracts.html>*: •Wei Dai, B-money 1998, *http://www.weidai.com/bmoney.txt <http://www.weidai.com/bmoney.txt>** <http://www.weidai.com/bmoney.txt>* •Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System, 2008, http://bitcoin.org/bitcoin.pdf ethereum blog on public and private blockchains - https://blog.ethereum.org/2015/08/07/on-public-and-private-blockchains/ my papers on SSRN - http://papers.ssrn.com/sol3/results.cfm

1 0