Re: [VoT] Foundational questions of principle

[Ken Dagg <[e-mail]>]

Steve,

As we have communicated in the past, I am a strong believer the an LOA
designation is an indication of the processes/mechanisms that an IdP has
undertaken. In other words, it is a communication tool. The choice is the
RPs. That is, an assertion at a specific LOA by an IdP/CSP/AP is one of the
mechanisms a RP should use to offset the authentication risk it has
identified for the service it wants to deliver. In other words, it is the
risk of the RP that is paramount not the claims of
an identity/credential/attribute/token provider.

Like you, I am a strong believer that the determination of whether or not
an identity is good enough is the responsibility of the RP. In my
experience, they make that determination based upon a set of attributes
they believe are necessary. If they trust that an IdP's assertion of
identity covers the attributes they believe are required them they can
accept the assertion. If it doesn't then that have to implement additional
mechanisms to offset the residual risk.

With respect to vectors of trust, I am interested in exploring what they
are and how they can be applied.

Ken

On Thursday, October 9, 2014, <[e-mail]> wrote:

>
>
> First, to introduce myself, I am an identity and privacy researcher,
> analyst and consultant.  I've been involved in this since 1995, when I cut
> my teeth in PKI and smartcards (with the early companies that became
> Baltimore Technologies). Since then I've worked on identity management
> frameworks, regulations and standards.
>
>
>
> I subscribe to the old Italian proverb: "it's nice to trust but better not
> to".  Words matter and I wonder if we shouldn't be using the word trust so
> much.
>
>
>
> More pragmatically, I note the very strong "Attributes" push of the past
> 18 months.  Andrew Nash, Anil John, myself and others have written about
> this.  The FIDO Alliance is all about authentication and attributes, and
> they purposefully leave "identity" as a matter for others to work out
> further up the stack. The OID Foundation is promoting an Attributes
> Exchange Network "AXN" architecture.  New entrants like id.me (an NSTIC
> pilot participant) talk about attributes and avoid "identity".
>
>
>
> I mention all of this as a prelude to suggest that "vector of trust" is
> synonymous with "attribute". I wonder if it would be clearer to use plain
> and current language rather than carry forward the fuzzy and I think overly
> ambitious idea of "trust"?
>
>
>
> Finally, I'd like to throw in my abiding concern that LOAs have foundered
> simply because it's difficult to pigeonhole risk. One party's idea of
> "medium" risk for instance will rarely map precisely to another's. I think
> people have been misled into thinking that an "LOA 3" identity should be be
> able to be used on its face (i.e. will "interoperate") at any "LOA 3" RP.
> Risk management is not so simple.
>
>
>
> The LOA paradigm borrows from Risk Management standards like ISO 31000
> which organisations use to plot their own risks internally typically on a
> five scale (eg Negligible / Low / Medium / High / Grave). But risk
> management standards require that each organisation calibrates risk in its
> own business context and according to its own risk appetite. The risk of a
> firewall breach for example at a startup social media company will be
> assessed differently by a big listed healthcare company. So organisation
> A can say the risk of event X is Low but B can say the risk of the same
> event is Medium.  As a result, LOAs do not inter-operate. They are based on
> standards meant for intra-organisation risk management, not
> inter-organisation communication of risk assessments.
>
>
>
> So far with VoT we are adding more dimensions to the RPs' generic risk
> management decision making, and that's great.  But we are still
> pigeonholing the dimensions.
>
>
>
> I'm afraid the reality is that risk management will always be done
> locally.  And so it should be.  When an RP is making the decision to accept
> or reject a given subject, they will evaluate a range of attributes
> or signals.  The set of attributes that matters varies from one RP to the
> next.  I think it's a great idea indeed to create guidance for evaluating
> attributes, and to coach RPs to look at all sorts of dimensions.  I just
> don't think it helps anyone to pigeonhole the risk ratings, because across
> organisations, arguments about the boundaries between LOA 1/2/3/4 (that is,
> policy mapping) will undo any efficiencies gained from the categorization.
>
>
>
> Cheers,
>
>
>
> Steve.
>
>
>
>
>
> Stephen Wilson
> Managing Director
> Lockstep Group
> http://lockstep.com.au
> Lockstep Consulting provides independent specialist advice and analysis
> on digital identity and privacy. Lockstep Technologies develops unique
> new smart ID solutions that enhance privacy and prevent identity theft.
>
>
>
>
>
>
>