Re: [VoT] Vectors of Trust I-D feedback

[Jim Fenton <[e-mail]>]

To be entirely consistent with ISO/IEC 29115, we would need to rename
Identity Proofing as Enrolment, and Credential Usage as Authentication.

But ISO/IEC 29115 refers to these as phases: they occur at different
times (or, in the case of Credential Management, over a long period of
time) and have different threat models. But I would like to ask under
which circumstances a Relying Party would act differently to an
indication of less secure Credential Management vs. less secure
Authentication. There are credential management practices that would
make a credential unsuitable for highly secure authentication, but why
not just represent that as less secure authentication? VoT should be
only as complex as required; it should not represent aspects of the
process that the relying party does not need.

Also, Enrolment includes aspects of the credentialing process that go
far beyond identity proofing and the binding of those attributes in a
credential. It's the reliability of that attribute assertion that's
orthogonal to authentication strength, and not all of the other aspects
of enrolment.

Finally, I'll repeat my comment that's buried in my review of the I-D
the other day that Assertion Presentation should be visible to the RP
already. For example, if the assertion is encrypted in transit, the RP
will know that without being told. There may be need for the RP to
specify how it wants assertions to be presented to it, but that seems
like more of a general option to me and not part of the Vector.

-Jim

On 8/2/15 2:59 AM, Nat Sakimura wrote:
> I agree that we should split out the credential management and the
> credential usage. 
> Each should have different "grades". 
>
> Right now, -00 has: 
>
> 3.1. Identity Proofing 
> 3.2. Credential Management
> 3.3. Assertion Presentation 
>
>
> Instead, it could be
>
> 3.1 Identity Proofing
> 3.2 Credential Management
> 3.3 Credential Usage
> 3.4 Assertion Presentation
>
> Then, 3.1 - 3.3 aligns with X.1254 and ISO/IEC 29115, which is good. 
> Note: they are missing 3.4. 
>
> We also need to define vtm. 
> I imagine that vtm uri would point to the policy documents of the
> trust framework, 
> but that is not explicitly there. 
>
> Best, 
>
> Nat
>
>