Re: [VoT] Feedback on new Draft

[Justin Richer <[e-mail]>]

Joanne, thanks for the comments. Replies inline.

> On Sep 9, 2015, at 12:38 AM, Joanne Knight <[e-mail]> wrote:
> 
> Hi Justin
>  
> The document is looking great. I picked up some things that might be hiccups or just me needing more explanation.
>  
> Last 2 sentences in introduction – ‘… while the vector itself can be folded into an assurance category. As such the vectors of trust seeks to complement, not replace, these other identity and trust mechanisms.’  Given the problems we are having with ISO/IEC29115 and the fact that I think this model solves many of them, I would like to see that a technology agnostic version of this does in fact replace LoA.

I agree that it might replace the way that LoA is getting used in many places, and that’s a good thing indeed. It won’t, however, replace every need for LoA, which does have use in some circumstances. 

> Federated Credential – as yet this is not used in the document. If it were I am unsure that based on the description that the credential is necessarily federated. I am thinking of a privacy centric system where the assertion is unique every instance. Colin may be able to clarify this better than I can. I am pretty sure in our product RealMe our Primary Credential is federatable but not the Assertion….but I may have  the wrong end of the stick.
> 

The terminology does need to be better aligned, thanks for that. We’re trying to differentiate between the primary credential — what the user presents to the IdP — and the federated credential — the assertion carried across the network to the RP. 

>  
> 2.1 Identity proofing – in 1.3 it is stated that no aspect of a component should overlap. Given the last sentence of the first para of 2.1 is from my view the correct statement, is the use of ‘..a particular credential set’ out of place? If this refers to a leveraged credential then this may need further explanation.

I think you’re right in that seems to have been subsumed by the new credential management (M) component. 

>  
> 3 P0-P3 align nicely with thinking in ISO/IEC 29003, many thanks. The others C0-A3 have been written explicitly from the aspect of the Internet, which is understandable given the scope of this document – nicely stated up front. I am interested to see what impact lifting these up to a technology agnostic level will have on the number and description of the component descriptions. This would be a highly valuable exercise that I would dearly like to be involved in ;-)

Definitely interesting work! I think that VoT really does sit in the middle as something that’s technology-focused and sitting between higher descriptive frameworks and detailed attribute-set descriptions.

>  
> You have nicely given me confidence that my FRAGGLE is not wingy and can be applied. Great read.
> 
>  
> On a totally random (or not) note, I have been playing with an idea I think someone in the VoT mailing group started. I can’t remember who it was but when I remember, I will be in touch. Anywho I replaced ‘identity’ throughout the document with ‘attribute’ and barring a few grammar issues everything still works. Makes me now question what I do for a living ;-)

The problem that I have with that is that it works best if the attributes are clearly bundled, and without that it tends to be extremely difficult to cross security domain boundaries. Basically, it’s not wrong but it can lead to the wrong extremes very quickly.

 — Justin


>  
> Cheers
>  
> Joanne
>  
> From: Justin Richer [mailto:[e-mail]] 
> Sent: Saturday, 5 September 2015 12:50 p.m.
> To: [e-mail]
> Subject: [VoT] New Draft
>  
> Hi All,
>  
> I’ve just published a new draft of VoT, incorporating many of the comments that have come in so far. The basic structure and premise is still there, but hopefully a bit clearer this time around. I’ve added the shell of an IANA registry for vector components. I’ve also added a “credential management” vector component, which is separated out from the “credential strength” component.
>  
> The new draft is here:
>  
> https://tools.ietf.org/html/draft-richer-vectors-of-trust-01 <https://tools.ietf.org/html/draft-richer-vectors-of-trust-01>
>  
>  — Justin