[Wimse] Re: Request for Agenda Item: Workload identity authenticator levels

["Saxe, Dean" <[e-mail]>]

Pieter,

With my work at the FIDO Alliance, I’ve been considering this topic quite a lot recently.  My sense is that authenticator levels as defined by NIST are a useful construct.  But over time, I fear that they lose value because a credential at Level 3 today might only meet Level 2 tomorrow.  The levels are large-grained and don’t sufficiently describe the full context of an authentication event.

Recently I have started talking with others about the idea of describing the properties of the authentication event.  Pam Dingle had two talks at Identiverse this year where she discussed this concept to include not only information about the authenticator, but also information about the account recovery process, what the activation factor was, etc.  These discussions have lead me back to read the Vectors of Trust (VoT) RFC 8485 (https://datatracker.ietf.org/doc/html/rfc8485)  Although I haven’t yet pursued anything down this path, I think the VoT mechanism is well suited to describe the authentication event as a set of vectors which can be parsed to determine the suitability of the event to authorize the workload (or human).

I’m absolutely interested in helping pursue standardization in this realm.  Please let me know how I can help.

-dhs

--
Dean H. Saxe, CIDPRO<https://idpro.org/cidpro/> (he/him)
Senior Security Engineer, AWS Identity Security Team | Amazon Web Services (AWS)
E: [e-mail]<mailto:[e-mail]> | M: 206-659-7293<tel:[phone]>

From: Pieter Kasselman <pieter.kasselman=[e-mail]>
Date: Monday, July 8, 2024 at 8:06 AM
To: "[e-mail]" <[e-mail]>
Subject: [EXTERNAL] [Wimse] Request for Agenda Item: Workload identity authenticator levels


CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.


WIMSE co-chair hat off, identity enthusiast hat on.

Hi folks,

For user authentication, the industry has well established concepts around different levels of user authentication. For example NIST Special Publication 800-63-3 defines Authenticator Assurance Levels [1]. This raises the question of whether we (workload identity practitioners) would benefit from a similar set of definitions for workload identities.

Consequently, I would like to request a short 10 minutes slot on the agenda at IETF 120 to discuss this topic, see if there are existing work we can leverage and see if there is interest in pursuing establishing some form of Workload Identity Authentication Levels.

Cheers

Pieter

[1] https://pages.nist.gov/800-63-3/sp800-63-3.html