[VoT] VoT Identity Proofing and individual claims

Phil Hunt <phil.hunt@oracle.com> Wed, 13 September 2017 17:01 UTC

Return-Path: <phil.hunt@oracle.com>
X-Original-To: vot@ietfa.amsl.com
Delivered-To: vot@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id 836651323B8 for <vot@ietfa.amsl.com>; Wed, 13 Sep 2017 10:01:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.999
X-Spam-Status: No, score=-6.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id gLiXniOFFdBm for <vot@ietfa.amsl.com>; Wed, 13 Sep 2017 10:01:16 -0700 (PDT)
Received: from userp1040.oracle.com (userp1040.oracle.com []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B455713292D for <vot@ietf.org>; Wed, 13 Sep 2017 10:01:16 -0700 (PDT)
Received: from userv0022.oracle.com (userv0022.oracle.com []) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v8DH1G9u015304 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for <vot@ietf.org>; Wed, 13 Sep 2017 17:01:16 GMT
Received: from userv0121.oracle.com (userv0121.oracle.com []) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v8DH1GH4019086 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for <vot@ietf.org>; Wed, 13 Sep 2017 17:01:16 GMT
Received: from ubhmp0019.oracle.com (ubhmp0019.oracle.com []) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v8DH1G2M017932 for <vot@ietf.org>; Wed, 13 Sep 2017 17:01:16 GMT
Received: from [] (/ by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 13 Sep 2017 17:01:15 +0000
From: Phil Hunt <phil.hunt@oracle.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_601DE6A5-5CD9-4DA8-88BE-5C0A9186C6BB"
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Date: Wed, 13 Sep 2017 10:01:14 -0700
Message-Id: <B53E1180-E1F8-47F8-AE94-CC55FA46AA77@oracle.com>
To: vot@ietf.org
X-Mailer: Apple Mail (2.3273)
X-Source-IP: userv0022.oracle.com []
Archived-At: <https://mailarchive.ietf.org/arch/msg/vot/jA82HrnCvkuPycVaZKK0U9MoruM>
Subject: [VoT] VoT Identity Proofing and individual claims
X-BeenThere: vot@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Vectors of Trust discussion list <vot.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/vot>, <mailto:vot-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/vot/>
List-Post: <mailto:vot@ietf.org>
List-Help: <mailto:vot-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/vot>, <mailto:vot-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 13 Sep 2017 17:01:23 -0000

Section 3.1

Does 3.1 apply to the identifier issued, to the whole assertion? 

An Identity is usually an identifier and a set of claims.

So what about claims?   Some claims may be issued by a provider (and thus are P3) while others may be provided as self asserted by the subject.  Some, as in banking may have involved a physical documents or other mechanism and thus all claims are not equal.

I have trouble determining the affect of P0-P3 and worry that privilege escalation will occur since not all claims are equal.  There isn’t really a way to say “We’re confident this is Justin, we’re just not so sure about his medical degree”.

Consider a university knows student numbers and degrees and courses completed. Is it authoritative over nationality, residence, addresses?  Maybe. Maybe not.

Consider a social network. In many cases they can be considered authoritative over the social network identity (P3) but know nothing about most users.

I’m just not sure identity proofing as expressed is actually useful.


Oracle Corporation, Identity Cloud Services Architect
www.independentid.com <http://www.independentid.com/>phil.hunt@oracle.com <mailto:phil.hunt@oracle.com>