Subject: Re: [VoT] Three things...

From: "Cantor, Scott" <[email-masked]>
Date: Wed, 12 Nov 2014 15:33:22 +0000

On 11/12/14, 12:16 PM, "Robin Wilton" <[email-masked]> wrote:
>
>(Nat makes the point, below, that most RPs don’t care about identity 
>proofing. I’m sure he is right, but since we’re trying to tease out all 
>the things that underpin the reliability of an identity assertion, I 
>think we need to be more explicit; RPs don’t care because they will 
>assume either that proofing has been done adequately, or that if they 
>rely on a valid credential that has been incorrectly issued, the 
>liability will rest with the issuer. But I’d argue that those are trust 
>factors too.)

The most common reason is that proofing is done by somebody else, either a 
user of the service or the RP operator itself. It's outside the scope of 
the identity assertion/exchange.

The by-far most common case in the world today is that resources are 
authorized on the basis of identifiers which only the users of an 
application actually connect to real people. The application (or the RP if 
you like) has no interest in who people are whatsoever, only that the 
users of that system have enough information to connect identities to the 
rules they create.

The most pressing problem with 800-63-derived schemes is that they 
over-emphasize identity proofing and over-emphasize passwords. The most 
critical need today is to have a way to express "no proofing, 
stronger-than-password authentication". The effort here was primarily to 
tease out how to express that simply without losing the capacity to 
address other cases.

-- Scott

---

From: Robin Wilton <[email-masked]>
Date: Wed, 12 Nov 2014 15:45:24 +0000

> the identity assertion/exchange.

Right… it’s outside the scope, but it’s a trust factor that’s upstream of any subsequent authentication. If it is faulty, the downstream pollution needs to end up in someone’s risk assessment.

> users of that system have enough information to connect identities to the 

OK - understood… and I think this goes to the remarks Joanne made about the different perspective when one comes at this from a background of “government” credential issue.

> tease out how to express that simply without losing the capacity to 

That’s a very useful requirement to tease out [and pin to the cork-board…].

When you say “no proofing”, then, do you mean none at all, or proofing which is not reflected in any way in the authentication request?
I think the former corresponds to the way Dick Hardt *originally* described the OpenID concept (in about 2007… i.e. no prior relationship between an IDP and an RP, just the passing of an authentication token), and the latter corresponds to “authentication with no LoA expressed or implied to the RP”.

---

From: "Cantor, Scott" <[email-masked]>
Date: Wed, 12 Nov 2014 16:03:36 +0000

On 11/12/14, 3:45 PM, "Robin Wilton" <[email-masked]> wrote:

>Right… it’s outside the scope, but it’s a trust factor that’s upstream of 
>any subsequent authentication. If it is faulty, the downstream pollution 
>needs to end up in someone’s risk assessment.

It's internal to the RP, it has nothing to do with the ecosystem of actors 
that the concept of "assurance" deals with.

>OK - understood… and I think this goes to the remarks Joanne made about 
>the different perspective when one comes at this from a background of 
>“government” credential issue.

That would be more persusasive to me if I hadn't had dealings with 
government agencies. I know what most of them actually do.

>When you say “no proofing”, then, do you mean none at all, or proofing 
>which is not reflected in any way in the authentication request?

It doesn't matter for our purposes, but the latter if you like.

>I think the former corresponds to the way Dick Hardt *originally* 
>described the OpenID concept (in about 2007… i.e. no prior relationship 
>between an IDP and an RP, just the passing of an authentication token), 
>and the latter corresponds to “authentication with no LoA expressed or 
>implied to the RP”.

The relationship between the RP and IdP is not about proofing 
specifically, but about accepting *anything* the IdP says. Whether the 
"anything" includes just authentication or has some other component is a 
matter for specific use cases to address.

Again, LOA != proofing.

-- Scott

---

From: Nat Sakimura <[email-masked]>
Date: Wed, 12 Nov 2014 18:25:13 +0000

+1

We could as well start from distributing strong credential at seven-eleven
without any identity proofing in the conventional sense and rely on it.

On Thu Nov 13 2014 at 1:04:06 Cantor, Scott <[email-masked]> wrote:

> _______________________________________________
> vot mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/vot
>