Re: [EAT] Device Identity (was Re: [EXTERNAL] Re: [Rats] Attestation BoF charter updates?)

[Carsten Bormann <[e-mail]>]

On Oct 22, 2018, at 12:01, Denis <[e-mail]> wrote:
> 
> The wording "identity document" should not be used in the charter, since the most important characteristic when using attestations is to be able to know 
> the characteristics of a device, i.e. that it operates as expected, does what is required and does not do other (bad) things. Knowing the identity of a device 
> (e.g. the name of its manufacturer and a unique serial number given by that manufacturer) may certainly be useful in some cases, but it is not always necessary, 
> nor desirable (e.g. because of privacy issues).

Henk forecasted that I would say “the usual identity confusion” earlier…

This is indeed the usual identity confusion.

RFC 4949 says:

   $ identity
      (I) The collective aspect of a set of attribute values (i.e., a
      set of characteristics) by which a system user or other system
      entity is recognizable or known. (See: authenticate, registration.
      Compare: identifier.)

In other words: A set of claims.

When I buy cigarettes from a vending machine in Germany (I don’t, so please excuse inaccuracies), it needs an identity document with exactly one claim on it:  age ≥ 18 years.  For a cash buyer, that is the entire identity the vending machine cares about.  (Obviously, the asserter of that claim needs to be authorized to do so by the operator of a vending machine — that set of authorizations is probably something that is honed by a procession of court cases.)

Since even the identity of the entity authorized to make a claim may be subject to privacy, the actual identity may be mixed together through a number of verification services.  It is useful to have a protocol that can be used to convey identities through such a mixer; the actual relying party may not need to understand much about what is happening as long as it trusts the verification services.  Or, in the above example, the vending machine may use a claim from a bank card that I’m ≥ 18yo, without understanding how the bank came to that conclusion.

Maybe we should replace the term “identity” with “set of claims useful for recognizing something or somebody”, hmm, SOCUFRSOS?  “Identity” might be easier to say.

I’m not sure I understand the part about SEQUENCE — I don’t see any (ordered) sequences in the rest of your message.
What I do see is claims that have different kinds; and that is of course important.  It is also sometimes important that we can have multiple claims of the same kind, something that JWTs are not very good at yet (we could fix that in CWT).

Grüße, Carsten