[VoT] Upcoming discussion on conveying authentication risk to relying parties

[Scott Shorter <[e-mail]>]

Hello VOT,

Tomorrow at 3pm EDT, instead of the usual Kantara IAWG biweekly meeting, there will be an ad hoc discussion on the NIST 800-63-3 comment period.

The particular topic is how to convey authentication risk information to relying parties, so the IETF VOT community of interest naturally came to mind.   Sorry for the short notice but please join if you’re interested and able.

Thanks and see below for meeting coordinates,
Scott

Scott Shorter - Vice President, Security
[e-mail]<mailto:[e-mail]>

Begin forwarded message:

From: Scott Shorter <[e-mail]<mailto:[e-mail]>>
Subject: No IAWG on 2016-06-16
Date: June 15, 2016 at 11:19:04 AM EDT
To: IA WG <[e-mail]<mailto:[e-mail]>>

Hi all,

The chair and vice-chair of IAWG are unavailable, there will be no official meeting tomorrow.  I’ll be on the call to host an ad-hoc discussion group on NIST SP 800-63-3.  I would like to train the discussion this week towards the needs of relying parties.  This may require directing our comments at an imaginary OMB M-04-04 comment process, but I don’t see that as a reason not to consider the perspective.

As food for thought, I want to share an old pearl of wisdom from Ron Rivest.  While I was reading Hardjono and Peatland’s recent position paper<https://www.w3.org/2016/04/blockchain-workshop/interest/hardjono-pentland.html>, I got interested in the footnote to RFC2693<https://tools.ietf.org/html/rfc2693#section-5.7.2>, where I saw the following subsection within the “other possibilities” section.


5.7.2<https://tools.ietf.org/html/rfc2693#section-5.7.2> Rivest's Reversal of the CRL Logic


   Ron Rivest has written a paper [R98<https://tools.ietf.org/html/rfc2693#ref-R98>] suggesting that the whole
   validity condition model is flawed because it assumes that the issuer
   (or some entity to which it delegates this responsibility) decides
   the conditions under which a certificate is valid.  That traditional
   model is consistent with a military key management model, in which
   there is some central authority responsible for key release and for
   determining key validity.


   However, in the commercial space, it is the verifier and not the
   issuer who is taking a risk by accepting a certificate.  It should
   therefore be the verifier who decides what level of assurance he
   needs before accepting a credential.  That verifier needs information
   from the issuer, and the more recent that information the better, but
   the decision is the verifier's in the end.

   This line of thought deserves further consideration, but is not
   reflected in the SPKI structure definition.  It might even be that
   both the issuer and the verifier have stakes in this decision, so
   that any replacement validity logic would have to include inputs from
   both.


This sort of thinking can lead to things like the IETF Vectors of Trust approach which can permit conveying the particulars of the authentication to the relying party.

Please join tomorrow if you can!

Date and Time

  *   Date: Thursday, 2016-06-16
  *   Time: 12:00 PDT | 15:00 EDT
  *   United States Toll [phone]
  *   Alternate Toll [phone]
Skype: [phone]<https://www.turbobridge.com/join.html>
     *   Conference ID: 613-2898
  *   International Dial-In Numbers<http://bit.ly/intnl_nums>

Thanks,
Scott

Scott Shorter - Vice President, Security
[e-mail]<mailto:[e-mail]>