November 2024 - WG-IDAssurance - mailman.kantarainitiative.org

IAWG - 28 November 2024 CANCELED
by Amanda Gay 26 Nov '24

26 Nov '24

Hi all: There won't be an IAWG call this Thursday, due to the US holiday schedule. Reach out with any questions/concerns, and we'll tentatively plan to re-group December 5th. Happy Thanksgiving! Best, -Amanda -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative **Please take a few minutes to complete the third annual DEIA survey <https://www.surveymonkey.com/r/3LPP3WL>!**

1 0

Canceled event: Identity Assurance Work Group Call @ Thu Jan 2, 2025 12pm - 1pm (EST) (wg-idassurance@kantarainitiative.org)
by Kantara Initiative 22 Nov '24

22 Nov '24

This event has been canceled. Identity Assurance Work Group Call Thursday Jan 2, 2025 ⋅ 12pm – 1pm Eastern Time - New York Location Zoom https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/maps/search/Zoom+https:%2F%2Fus06web.zoom.us%2Fj%2F9… Meetings at 12 pm Eastern TimeTime zone converter: www.thetimenow.com/time-zone-converter.phpTopic: IAWGTime: This is a recurring meeting.Join Zoom Meetinghttps://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09Meeting ID: 931 6796 5850Passcode: 884696One tap mobile+13126266799,,93167965850#,,,,*884696# US (Chicago)+16465588656,,93167965850#,,,,*884696# US (New York)Dial by your location +1 312 626 6799 US (Chicago) +1 646 558 8656 US (New York) +1 301 715 8592 US (Washington DC) +1 346 248 7799 US (Houston) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma)Meeting ID: 931 6796 5850Passcode: 884696Find your local number: https://zoom.us/u/aeg9vt8LSr ~~//~~ Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this email because you are an attendee on the event. To stop receiving future updates for this event, decline this event. Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more https://support.google.com/calendar/answer/37135#forwarding

1 0

Canceled event: Identity Assurance Work Group Call @ Thu Dec 26, 2024 12pm - 1pm (EST) (wg-idassurance@kantarainitiative.org)
by Kantara Initiative 22 Nov '24

22 Nov '24

This event has been canceled. Identity Assurance Work Group Call Thursday Dec 26, 2024 ⋅ 12pm – 1pm Eastern Time - New York Location Zoom https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/maps/search/Zoom+https:%2F%2Fus06web.zoom.us%2Fj%2F9… Meetings at 12 pm Eastern TimeTime zone converter: www.thetimenow.com/time-zone-converter.phpTopic: IAWGTime: This is a recurring meeting.Join Zoom Meetinghttps://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09Meeting ID: 931 6796 5850Passcode: 884696One tap mobile+13126266799,,93167965850#,,,,*884696# US (Chicago)+16465588656,,93167965850#,,,,*884696# US (New York)Dial by your location +1 312 626 6799 US (Chicago) +1 646 558 8656 US (New York) +1 301 715 8592 US (Washington DC) +1 346 248 7799 US (Houston) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma)Meeting ID: 931 6796 5850Passcode: 884696Find your local number: https://zoom.us/u/aeg9vt8LSr ~~//~~ Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this email because you are an attendee on the event. To stop receiving future updates for this event, decline this event. Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more https://support.google.com/calendar/answer/37135#forwarding

1 0

Canceled event: Identity Assurance Work Group Call @ Thu Nov 21, 2024 12pm - 1pm (EST) (wg-idassurance@kantarainitiative.org)
by Kantara Initiative 22 Nov '24

22 Nov '24

This event has been canceled. Identity Assurance Work Group Call Thursday Nov 21, 2024 ⋅ 12pm – 1pm Eastern Time - New York Location Zoom https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/maps/search/Zoom+https:%2F%2Fus06web.zoom.us%2Fj%2F9… Meetings at 12 pm Eastern TimeTime zone converter: www.thetimenow.com/time-zone-converter.phpTopic: IAWGTime: This is a recurring meeting.Join Zoom Meetinghttps://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09Meeting ID: 931 6796 5850Passcode: 884696One tap mobile+13126266799,,93167965850#,,,,*884696# US (Chicago)+16465588656,,93167965850#,,,,*884696# US (New York)Dial by your location +1 312 626 6799 US (Chicago) +1 646 558 8656 US (New York) +1 301 715 8592 US (Washington DC) +1 346 248 7799 US (Houston) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma)Meeting ID: 931 6796 5850Passcode: 884696Find your local number: https://zoom.us/u/aeg9vt8LSr ~~//~~ Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this email because you are an attendee on the event. To stop receiving future updates for this event, decline this event. Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more https://support.google.com/calendar/answer/37135#forwarding

1 0

Canceled event: Identity Assurance Work Group Call @ Thu Nov 28, 2024 12pm - 1pm (EST) (wg-idassurance@kantarainitiative.org)
by Kantara Initiative 22 Nov '24

22 Nov '24

This event has been canceled. Identity Assurance Work Group Call Thursday Nov 28, 2024 ⋅ 12pm – 1pm Eastern Time - New York Location Zoom https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/maps/search/Zoom+https:%2F%2Fus06web.zoom.us%2Fj%2F9… Meetings at 12 pm Eastern TimeTime zone converter: www.thetimenow.com/time-zone-converter.phpTopic: IAWGTime: This is a recurring meeting.Join Zoom Meetinghttps://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09Meeting ID: 931 6796 5850Passcode: 884696One tap mobile+13126266799,,93167965850#,,,,*884696# US (Chicago)+16465588656,,93167965850#,,,,*884696# US (New York)Dial by your location +1 312 626 6799 US (Chicago) +1 646 558 8656 US (New York) +1 301 715 8592 US (Washington DC) +1 346 248 7799 US (Houston) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma)Meeting ID: 931 6796 5850Passcode: 884696Find your local number: https://zoom.us/u/aeg9vt8LSr ~~//~~ Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this email because you are an attendee on the event. To stop receiving future updates for this event, decline this event. Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more https://support.google.com/calendar/answer/37135#forwarding

1 0

Re: Revised Draft KI#N2024-01
by Richard G. WILSHER (＠Zygma Inc.) 21 Nov '24

21 Nov '24

Hi Nathan, Right, and CO#0170 requires that the CSP can “Demonstrate a risk management methodology that adequately identifies and mitigates risks related to the specified service and its user community and must show that a risk assessment review is performed at least once every twelve months, such as adherence to CobIT or [IS27001] practices” plus in 63A/B there are requirements that “The CSP SHALL employ appropriately-tailored security controls, to include control enhancements, from the high baseline of security controls defined in SP 800-53 or equivalent federal (e.g., FEDRAMP) or industry standards” and “When fulfilling criterion 63A#0430 the CSP SHALL ensure that the minimum assurance-related controls for high-impact systems or equivalent are satisfied” (virtually directly from SP 800-63 rev.3), but there comes the question as to how much time is invested in pulling-apart the details of the risk management and assessment. Plus there are specific criteria which explicitly address risk-determined measures such as password lengths, use of approved algorithms , … BUT, … the problem is that a good number of those criteria fall within the passkey infrastructure and are invisible. I think that, whilst (in my experience) CSPs are serious about their risk management and reduction one has to recognize that sometimes a risk is worth taking because of the potential rewards and the rationale is simply that: 1 – passkey service providers will not offer any insight to their functionings; 2 – the specification seems good and is widely recognized, and the claim is that it is being met (by the service providers – see point 1); 3 – clients (RPs) and Subjects are wanting it; 4 - CSPs do not want to lose market share; 5 – there is a recognized advantage over the use of passwords; 6 - the sheer ubiquity of these devices and the fact that they have not yet been shown to be suffering massive failures, i.e. they are demonstrating a generally-accepted degree of robustness. These factors collectively lead to a business risk analysis outcome which says “Yeah, we’ll use them”. The proposed notice encourages CSPs to advise their users (small ‘u’ – i.e. anyone interfacing to their service) but we felt that requiring such a notice or requiring an explicit risk analysis would therefore have to be expressed as assessable criteria, and we have not gone down that path, in part because of the required drafting / pubic review process and the difficukty in capturing the requirement in a manner which coed with the invisibility of the passkey fabric. And finally, the ‘chosen standard’ is frankly unlikely to address specific technologies, which is what we are facing. If you have any suggested changes to the text of the notice (or a different ourse of action?) please let us have them. Best, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Nathan Faut [mailto:n_faut_23658@yahoo.com] Sent: Thursday, November 21, 2024 19:00 To: IA WG; Richard G. WILSHER (@Zygma Inc.) Subject: Re: [WG-IDAssurance] Re: Revised Draft KI#N2024-01 Richard - But as assessors, you should review that the CSP performed a risk assessment according to their chosen standard - ISO, NIST, FEMA, PCI, whatever. You should not necessarily be waiting for NIST vis FIDO - a good risk assessment is still a good thing ... right? -Nathan =-=-=-=-=-=-=- On Thursday, November 21, 2024 at 01:10:39 PM EST, Richard G. WILSHER (@Zygma Inc.) <rgw(a)zygma.biz> wrote: “I assume this is predicated on risk assessments performed by NIST on FIDO implementations” Until such time as NIST actually publishes anything which it claims to be pursuant to a risk analysis the sceptic in me rules! We’ve heard it before but seen nothing. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Thursday, November 21, 2024 17:59 To: Richard G. WILSHER (@Zygma Inc.) Subject: RE: [WG-IDAssurance] Revised Draft KI#N2024-01 After my note to Mike, I’m wondering if we should go back to calling them “Cryptographic Software Authenticators” From: Richard G. WILSHER (@Zygma Inc.) <RGW(a)Zygma.biz> Sent: Thursday, November 21, 2024 12:38 PM To: wg-idassurance(a)kantarainitiative.org Subject: [WG-IDAssurance] Revised Draft KI#N2024-01 Well I’ve put to good use the time Amanda just gave back, so attached is a revised version of the Notice which has: 1. A prefatory notice about notices and where one is, as reference for final format; 2. Inclusion of the criteria sent earlier today by email; 3. Accommodation of most recent email exchanges which hadn’t made it into a draft text body – now there with a couple of comments/queries. Until 12-05 … Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Amanda Gay [mailto:amanda@kantarainitiative.org] Sent: Thursday, November 21, 2024 15:58 To: wg-idassurance(a)kantarainitiative.org Subject: [WG-IDAssurance] CANCELLED - IAWG - 21 November 2024 Dear IAWG Members: Apologies for the late cancellation, however, I just got word from Kantara leadership that we will NOT meet today. Please review the Updated Notice (attached) send comments through to the mailing list. Next Thursday is Thanksgiving in the US--there will be no IAWG call. We will tentatively regroup on December 5th. Feel free to reach out with any questions or concerns! Best, -A Amanda Gay | Administrative Coordinator <https://docs.google.com/uc?export=download&id=1f_FyEBepOKYcAfkyIsaSFzguA7Tg…> Twitter: @KantaraNews LinkedIn: @KantaraInitiative *Please take a few minutes to complete the third annual DEIA survey <https://www.surveymonkey.com/r/3LPP3WL> !* _______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance(a)kantarainitiative.org To unsubscribe send an email to staff(a)kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantar… ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurance

1 0

Proposed Passkey notice criteria
by Richard G. WILSHER (＠Zygma Inc.) 21 Nov '24

21 Nov '24

I believe that the list of criteria which should be referenced in the proposed notice are as follows: 63B# - 0410, 0420,0430, 0440, 0450, 0460, 1150, 1160, 1210, 1220, 1230, 1240, 1270, 1280, 1290, 1300, 1310, 1320, 1330, 1450, 1460, 1470, 1480, 1490, 1500, 1510, 1520, 1530, 1540, 1550 These have been previously brought to the IAWG's attention when we were meddling with the actual text of some of these. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

4 5

Re: Revised Draft KI#N2024-01
by Richard G. WILSHER (＠Zygma Inc.) 21 Nov '24

21 Nov '24

“I assume this is predicated on risk assessments performed by NIST on FIDO implementations” Until such time as NIST actually publishes anything which it claims to be pursuant to a risk analysis the sceptic in me rules! We’ve heard it before but seen nothing. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Thursday, November 21, 2024 17:59 To: Richard G. WILSHER (@Zygma Inc.) Subject: RE: [WG-IDAssurance] Revised Draft KI#N2024-01 After my note to Mike, I’m wondering if we should go back to calling them “Cryptographic Software Authenticators” From: Richard G. WILSHER (@Zygma Inc.) <RGW(a)Zygma.biz> Sent: Thursday, November 21, 2024 12:38 PM To: wg-idassurance(a)kantarainitiative.org Subject: [WG-IDAssurance] Revised Draft KI#N2024-01 Well I’ve put to good use the time Amanda just gave back, so attached is a revised version of the Notice which has: 1. A prefatory notice about notices and where one is, as reference for final format; 2. Inclusion of the criteria sent earlier today by email; 3. Accommodation of most recent email exchanges which hadn’t made it into a draft text body – now there with a couple of comments/queries. Until 12-05 … Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Amanda Gay [mailto:amanda@kantarainitiative.org] Sent: Thursday, November 21, 2024 15:58 To: wg-idassurance(a)kantarainitiative.org Subject: [WG-IDAssurance] CANCELLED - IAWG - 21 November 2024 Dear IAWG Members: Apologies for the late cancellation, however, I just got word from Kantara leadership that we will NOT meet today. Please review the Updated Notice (attached) send comments through to the mailing list. Next Thursday is Thanksgiving in the US--there will be no IAWG call. We will tentatively regroup on December 5th. Feel free to reach out with any questions or concerns! Best, -A Amanda Gay | Administrative Coordinator <https://docs.google.com/uc?export=download&id=1f_FyEBepOKYcAfkyIsaSFzguA7Tg…> Twitter: @KantaraNews LinkedIn: @KantaraInitiative *Please take a few minutes to complete the third annual DEIA survey <https://www.surveymonkey.com/r/3LPP3WL> !*

1 0

Revised Draft KI#N2024-01
by Richard G. WILSHER (＠Zygma Inc.) 21 Nov '24

21 Nov '24

Well I’ve put to good use the time Amanda just gave back, so attached is a revised version of the Notice which has: 1. A prefatory notice about notices and where one is, as reference for final format; 2. Inclusion of the criteria sent earlier today by email; 3. Accommodation of most recent email exchanges which hadn’t made it into a draft text body – now there with a couple of comments/queries. Until 12-05 … Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Amanda Gay [mailto:amanda@kantarainitiative.org] Sent: Thursday, November 21, 2024 15:58 To: wg-idassurance(a)kantarainitiative.org Subject: [WG-IDAssurance] CANCELLED - IAWG - 21 November 2024 Dear IAWG Members: Apologies for the late cancellation, however, I just got word from Kantara leadership that we will NOT meet today. Please review the Updated Notice (attached) send comments through to the mailing list. Next Thursday is Thanksgiving in the US--there will be no IAWG call. We will tentatively regroup on December 5th. Feel free to reach out with any questions or concerns! Best, -A Amanda Gay | Administrative Coordinator <https://docs.google.com/uc?export=download&id=1f_FyEBepOKYcAfkyIsaSFzguA7Tg…> Twitter: @KantaraNews LinkedIn: @KantaraInitiative *Please take a few minutes to complete the third annual DEIA survey <https://www.surveymonkey.com/r/3LPP3WL> !*

1 0

CANCELLED - IAWG - 21 November 2024
by Amanda Gay 21 Nov '24

21 Nov '24

Dear IAWG Members: Apologies for the late cancellation, however, I just got word from Kantara leadership that we will NOT meet today. Please review the Updated Notice (attached) send comments through to the mailing list. Next Thursday is Thanksgiving in the US--there will be no IAWG call. We will tentatively regroup on December 5th. Feel free to reach out with any questions or concerns! Best, -A *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative **Please take a few minutes to complete the third annual DEIA survey <https://www.surveymonkey.com/r/3LPP3WL>!**

1 0