Re: [GNAP] About the use case called "Self sovereign identity (SSI)"

On Fri, Aug 21, 2020 at 9:02 AM Justin Richer <jricher@mit.edu> wrote:

> The SSI trick is not the ticket — the SSI portion here is "She indicates
> that she is a resident of Bamberg”. We’d like Alice to be able to do that
> in a verifiable and programatic way that we can enable in the protocol flow.
>
Yes.
The purpose of SSI in this use case is to illustrate that authz flows will
have many claim origins. Flows will have many situations where GS relies on
claims produced/presented by other ASs for a compound Authz decision.
Best regards
/Francis

>
>  — Justin
>
> On Aug 21, 2020, at 8:48 AM, Denis <denis.ietf@free.fr> wrote:
>
>
> Hello Francis,
>
> This WG has not been formed to address SSI (Self sovereign identity). This
> use case can be solved without using an AS and a RS
> and without using a "Self Sovereign Identity (SSI)" approach.
>
> -          Alice visits the website of AC-Tickets.
>
> -          Alice looks up and finds "Bamberg Symphony", the concert she
> wants to attend.
>
> -          Alice is informed that she can get a discount price if she is
> a resident of Bamberg.
>
> -          Alice fills a form and enters the requested information.
>  She indicates that she is a resident of Bamberg and so she gets the
> discounted price.
>
> -          Alice makes the payment using 3D secure.
>
> -          Alice gets back a QR code on her phone that will be scanned
> when entering the concert hall.
>
> -          Alice goes to the concert at Bamberg Symphony.
>
> -          At the entrance gate, Alice presents her QR code which
> includes a unique identifier for this concert, the date and time of the
> concert,
>  her seat number reservation, her family name and her first name and the
> fact that the ticket price is a discounted price available only
>  for the residents of Bamberg.
>
> -          If the person controlling the QR-codes at the gate has some
> doubt that Alice is indeed a resident of Bamberg,
>  she asks Alice to present her ID card or her passport which includes her
> home address and even more important her picture.
> ("On the Internet, nobody knows you're a dog". Peter Steiner's cartoon,
> as published in The New Yorker on July 5, 1993).
>
> This is simple, efficient and easy to implement right now.
>
> This is roughly how train reservations are working on the French web site
> oui.sncf. Some one over 60 can request a discounted railway ticket .
> If the train controller has some doubt that the bearer of the discounted
> railway ticket is really over 60 after scanning the QR code, he will ask
> the person to show an identity card or a passport at the platform entrance
> or while in the train. Not only the year of birth will allow to make sure
> that the individual is indeed over 60 but in addition the name on the identity
> card or the passport will be checked against the name on the railway
> ticket and that picture matches with the face of the person in front of
> the train controller.
>
> Anyway, IMHO, I don't believe that this use case should be solved using
> GNAP.
>
> Denis
>
> PS. This use case has been posted here:
>
> https://github.com/ietf-wg-gnap/general/wiki/SSI-integration#alice-purchasing-a-concert-ticket-without-disclosing-her-identity
>
> --
> TXAuth mailing list
> TXAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/txauth
>
>
>

-- 
Francis Pouatcha
Co-Founder and Technical Lead
adorsys GmbH & Co. KG
https://adorsys-platform.de/solutions/