John, I wouldnt characterize what you are describing (ie an OP being able to issue both LOA1 & LO2 assertions) as 'step-down'.

A 'step-up' scenario from LOA1 to LOA2  would be

proofing2+authn1 -------- (when requested by an RP) --------> proofing2+authn2

as you cant (easily) proof real-time, the only variable for the stepping up is the authentication mechanism.

But what you are describing is the OP just being able to issue either LOA1 or LOA2 as appropriate, given that the proofing supports both.

Paul

John Bradley wrote: 
OMB M-04-04 doesn't require non correlatable identifiers.

All LoA 1 identifiers are by definition pseudonymous because they are not identity proofed.

ICAM requires non-coralatable identifiers for privacy reasons that are outside of OMB-04-04 and SP-800-63.

A IMI info card can contain claims for LoA 1,2 and 3.

A openID can only be LoA 1 because it dosn't meet the requirements of LoA 2.

Once openID is suitable for LoA 2 and a IdP/OP is certified by a ICAM Trust framework provider,  that IDP can step down a LoA 2 proofed account to make a LoA 1 assertion about it.

IdP can step down but not up.

John B.
On 2009-12-14, at 7:08 PM, RL 'Bob' Morgan wrote:

  
The LoA1 in OMB M-04-04 is somewhat unique to other levels because it 
requires Pseudonyms(PPIDs) and no personal identified information. Those 
policies are defined separately from the LoA1 policy and used by IDPs to 
generate response messages.
      
I am not sure what you mean by this.  OMB 04-04 says that what it calls 
"anonymous credentials" *may* be used with LoAs 1 and 2.  The ICAM OpenID 
profile says that PPIDs must be used, but also permits other personal 
information to be requested by the RP and provided by the OP.

    
If IDPs provide support more than one levels, stipulating a desired LoA 
makes sense but I haven't seen IDPs supporting multi-levels. RPs may be 
responsible to manage WLs for each levels to find IDPs to provide 
services they need.
      
We're expecting that the typical US higher-education IdP will support 
multiple LoAs.  It doesn't make sense to segregate populations into 
separate IdPs by LoA.  We're also expecting that RPs requiring LoA will 
ask for the LoA they need, rather than having to configure IdPs to know 
which RPs require what.

 - RL "Bob"

_______________________________________________
DG-Concordia mailing list
DG-Concordia@kantarainitiative.org
http://kantarainitiative.org/mailman/listinfo/dg-concordia
    

  

_______________________________________________
DG-Concordia mailing list
DG-Concordia@kantarainitiative.org
http://kantarainitiative.org/mailman/listinfo/dg-concordia