Re: [VoT] Vectors of Trust I-D feedback

2015-08-04 15:12 に Rainer Hoerbe さんは書きました:
> Am 04.08.2015 um 00:31 schrieb Jim Fenton <fenton@bluepopcorn.net>:
>> 
>> To be entirely consistent with ISO/IEC 29115, we would need to rename 
>> Identity Proofing as Enrolment, and Credential Usage as 
>> Authentication.

Actually, renaming it as Enrollment may have some merit. Identity 
Proofing is only a process within Enrollment.
There are whole bunch of other stuff that has to happen then.
Even if the Identity Proofing was done perfectly, if the act of creating 
the record to the identity register is broken, it is broken.

>> 
>> But ISO/IEC 29115 refers to these as phases: they occur at different 
>> times (or, in the case of Credential Management, over a long period of 
>> time) and have different threat models. But I would like to ask under 
>> which circumstances a Relying Party would act differently to an 
>> indication of less secure Credential Management vs. less secure 
>> Authentication.
> For a targeted attack the weak credential recovery will lower the
> adversary’s effort significantly, whereas in large numbers a 2F AuthN
> combined will still reduce the overall risk.

+1. That is one of the reason I feel it is worthwhile to differentiate 
them.

> 
>> There are credential management practices that would make a credential 
>> unsuitable for highly secure authentication, but why not just 
>> represent that as less secure authentication? VoT should be only as 
>> complex as required; it should not represent aspects of the process 
>> that the relying party does not need.
> 
> +1. However, I remember a discussion at IIW where someone argued that
> an important use case for VoT is the combination of C4 (U2F) with  P1
> (self-asserted) for social ids. But social networks are prioritizing
> usability over security with a weak recovery mechanism.

In private sector, there are lots of cases where identity proofing in 
the traditional sense does not
matter but the secure authentication matters. I actually co-authored a 
paper on it last month.

> 
> - Rainer
> 
> _______________________________________________
> vot mailing list
> vot@ietf.org
> https://www.ietf.org/mailman/listinfo/vot