Re: [VoT] Vectors of Trust I-D feedback

Yup. If I remember correctly, only three words are different between X.1254
and ISO/IEC 29115. X.1254 can be downloaded from here:
https://www.itu.int/rec/T-REC-X.1254-201209-I/en

2015-08-04 8:22 GMT+09:00 Ira McDonald <blueroofmusic@gmail.com>:

> Hi,
>
> And for those who forgot (I did), ISO 29115 is technically equivalent to
> ITU-T X.1254 (and the latter's available online for free download in PDF).
>
> Cheers,
> - Ira
>
>
> Ira McDonald (Musician / Software Architect)
> Co-Chair - TCG Trusted Mobility Solutions WG
> Chair - Linux Foundation Open Printing WG
> Secretary - IEEE-ISTO Printer Working Group
> Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
> IETF Designated Expert - IPP & Printer MIB
> Blue Roof Music / High North Inc
> http://sites.google.com/site/blueroofmusic
> http://sites.google.com/site/highnorthinc
> mailto: blueroofmusic@gmail.com
> Winter  579 Park Place  Saline, MI  48176  734-944-0094
> Summer  PO Box 221  Grand Marais, MI 49839  906-494-2434
>
>
> On Mon, Aug 3, 2015 at 6:31 PM, Jim Fenton <fenton@bluepopcorn.net> wrote:
>
>> To be entirely consistent with ISO/IEC 29115, we would need to rename
>> Identity Proofing as Enrolment, and Credential Usage as Authentication.
>>
>> But ISO/IEC 29115 refers to these as phases: they occur at different
>> times (or, in the case of Credential Management, over a long period of
>> time) and have different threat models. But I would like to ask under which
>> circumstances a Relying Party would act differently to an indication of
>> less secure Credential Management vs. less secure Authentication. There are
>> credential management practices that would make a credential unsuitable for
>> highly secure authentication, but why not just represent that as less
>> secure authentication? VoT should be only as complex as required; it should
>> not represent aspects of the process that the relying party does not need.
>>
>> Also, Enrolment includes aspects of the credentialing process that go far
>> beyond identity proofing and the binding of those attributes in a
>> credential. It's the reliability of that attribute assertion that's
>> orthogonal to authentication strength, and not all of the other aspects of
>> enrolment.
>>
>> Finally, I'll repeat my comment that's buried in my review of the I-D the
>> other day that Assertion Presentation should be visible to the RP already.
>> For example, if the assertion is encrypted in transit, the RP will know
>> that without being told. There may be need for the RP to specify how it
>> wants assertions to be presented to it, but that seems like more of a
>> general option to me and not part of the Vector.
>>
>> -Jim
>>
>> On 8/2/15 2:59 AM, Nat Sakimura wrote:
>>
>> I agree that we should split out the credential management and the
>> credential usage.
>> Each should have different "grades".
>>
>> Right now, -00 has:
>>
>> 3.1. Identity Proofing
>> 3.2. Credential Management
>> 3.3. Assertion Presentation
>>
>> Instead, it could be
>>
>> 3.1 Identity Proofing
>> 3.2 Credential Management
>> 3.3 Credential Usage
>> 3.4 Assertion Presentation
>>
>> Then, 3.1 - 3.3 aligns with X.1254 and ISO/IEC 29115, which is good.
>> Note: they are missing 3.4.
>>
>> We also need to define vtm.
>> I imagine that vtm uri would point to the policy documents of the trust
>> framework,
>> but that is not explicitly there.
>>
>> Best,
>>
>> Nat
>>
>>
>>
>>
>> _______________________________________________
>> vot mailing list
>> vot@ietf.org
>> https://www.ietf.org/mailman/listinfo/vot
>>
>>
>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en