May 2024 - WG-IDAssurance - mailman.kantarainitiative.org

Motions re. adoption of proposed changes to 63A#0180
by Richard G. WILSHER (＠Zygma Inc.) 04 Jun '24

04 Jun '24

Todays call (2024-05-16) addressed the technical agenda item: Proposed 63A#0180 Revisions: The net outcome was (I believe, but read the minutes for yourselves) broad support for implementing the proposed changes, the rational for which was as follows (and the form of which is attached): Whereas NIST wrote SP 800-63 rev.3 from the perspective of what a complete set of proofing, authentication, federation requirements might be Kantara has, in response to market demand, accommodated within the IAF Approval scheme both Full and Component Services. Generally speaking the structure and level of granularity of criteria allows a provider of a Component Service to state which criteria apply and which do not. However, I see some restriction being implied by 63A#0180 by reason of the very high perspective of this criterion and its sub-parts. By stating what the end game (i.e. Full Service) proofing evidence requirements are, and accepting that a criterion is either applicable or not, but there being no provision for partially acceptable, this criterion does not allow a Component Service provider to support part of the evidence selection and processing of a complete proofing while allowing its Service Consumer to provide the other evidence forms within the overall proofing. Such a use case might be a provider which provides for proofing a STRONG form of evidence, perhaps because it can resolve the technologically-demanding parts of the end-end process, while it doesnt supporting the processing of any FAIR evidence. In full disclosure, I have a client which deploys such a service, handling a STRONG and a single FAIR form of evidence while the Service Consumer handles the second FAIR form of evidence. [RGW 20240-05-16: and others are known to be providing similar services and wishing to gain Kantara Approval.] In such cases the criteria should be considered not applicable, yet to do so denies the CSP the recognition for the conformant processing of those forms of evidence which it does handle. I am therefore proposing to the IAWG a revision to 63A#0180 which, by breaking down the inherent breadth of this criterion, allows for more definitive applicability to be denoted. Please see the attached proposed changes. Clearly, in the cases of the expanded sub-criteria c) and d), a Full Service would have to indicate applicable for all sub-parts of c) and/or d) respectively, whereas a Component Service could be selective, according to its architecture/design. It should be noted that in the above discussion Component Service is one which meets the definition in the Kantara Glossary KIAF-1050 v2.0 (§3.4), not the erroneous description on the TSL pages. The same applies to the Full Service definition (§3.5). At the close of meeting I was asked to prepare a motion for e-voting, which I present below, though I have seen fit to propose two motions for the purposes of fully-addressing the requirements for proceeding with the acceptance and publication of the proposed changes. I guess the Secretariat will be responsible for setting the voting in progress with a deadline for submissions? Motion #1: That the subject proposed changes to criterion 63A#0180 be approved by the IAWG as presented and that the KI Secretariat publish them without delay as the latest criteria set (KIAF-1430 SP 800-63A SAC-SoCA v5.1). Motion #2: That the subject changes be approved as being Non-material in nature*, and in their publication, be processed accordingly by the KI Secretariat. * The materiality was not discussed but I will offer the argument that since these changes will add clarity, will not impose any additional operational or functional requirements upon CSPs and will not require any changes to existing Approved services, they are NOT of a material nature. Neither will they affect nor influence one jot any spurious attempts to claim Kantara Approval where none exists. Thank you for your efforts to address these changes. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

3 4

IAWG from Identiverse - Join in an hour!
by Amanda Gay 30 May '24

30 May '24

Dear IAWG Members: Please join us in an hour for our next IAWG meeting (live from Vegas!) or head over to Copperleaf 6 if you are attending Identiverse! The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-05-30* - *Time: 9:00 AM PT | 12:00 PM ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT AGENDA 5.30.2024 1. Administration: - Minutes approval - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" 3. ISO 17065 Discussion Items 4. Group Discussion: - IAWG, US Assurance, UK Certification Work in 2024 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

IAWG Meeting Thursday May 30 from Identiverse!!!
by Andrew Hughes 28 May '24

28 May '24

Coming to you live from Las Vegas! We will be running the IAWG call on May 30 9am Pacific from Identiverse. We are hoping to have some guests and interested folks drop in to watch what we do on calls. So - if you are attending Identiverse, come find us in *Copperleaf 6* from 8am onwards - we'll light up the IAWG call at 9am Pacific as usual. For these kinds of open calls, if we have lots of guests then the call will be more explanatory as we talk about topics. If few guests then it should be a regular call. Watch for the agenda. andrew. *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

2 2

Please Join Us In An Hour - IAWG Call
by Amanda Gay 16 May '24

16 May '24

Dear IAWG Members: Please join us in an hour for the next IAWG meeting. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-05-16* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *DRAFT Agenda* 1. Administration: - Minutes approval - 2024.04.04 Meeting Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/440303618/2024-04-04+I…> - 2024.04.25 Meeting MInutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/449249286/2024-04-25+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Adjusted meeting cadence for May: - May 30 - Auditor Introduction - James Keenan - David Nutbrown 3. ISO 17065 Discussion Items 4. Group Discussion: - Proposed 63A#0180 Revisions: 63A#0180 - proposed criteria adjustment <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…> (circulated by email 2024.04.06 by Richard Wilsher, attached for convenience) - In Progress - Proposed supplement to NIST related to evidence requirements - Continued discussion if needed: Proposed S3A edits to enhance transparency (as proposed to ARB) - Jimmy Jung - Assessment Program Question <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…> from 04.26.2024 - Assessment Program Question (attached for convenience) 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation & Agenda for IAWG Call 2024.05.16
by Amanda Gay 14 May '24

14 May '24

Dear IAWG Members: Please join us Thursday, May 16, at 12PM ET for our next IAWG meeting. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-05-16* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *DRAFT Agenda* 1. Administration: - Minutes approval - 2024.04.04 Meeting Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/440303618/2024-04-04+I…> - 2024.04.25 Meeting MInutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/449249286/2024-04-25+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Adjusted meeting cadence for May: - May 30 - Auditor Introduction - James Keenan - David Nutbrown 3. ISO 17065 Discussion Items 4. Group Discussion: - Proposed 63A#0180 Revisions: 63A#0180 - proposed criteria adjustment <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…> (circulated by email 2024.04.06 by Richard Wilsher, attached for convenience) - In Progress - Proposed supplement to NIST related to evidence requirements - Continued discussion if needed: Proposed S3A edits to enhance transparency (as proposed to ARB) - Jimmy Jung - Assessment Program Question <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…> from 04.26.2024 - Assessment Program Question (attached for convenience) 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Fwd: Join Us! Webinar Invite for NCCoE Mobile Driver’s License Community of Interest
by Andrew Hughes 02 May '24

02 May '24

---------- Forwarded message --------- From: NIST Cybersecurity and Privacy Program < csrc.nist(a)service.govdelivery.com> Date: Thu, May 2, 2024 at 5:42 AM Subject: Join Us! Webinar Invite for NCCoE Mobile Driver’s License Community of Interest To: <andrewhughes3000(a)gmail.com> Register Now! [image: NIST] View As Web Page <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVy…> [image: Header] National Cybersecurity Center of Excellence Register Now for the NCCoE Mobile Driver's License Community of Interest Webinar *Date/Time:* Thursday, May 16, 2024 | 10:00 a.m. – 11:00 a.m. ET The NIST National Cybersecurity Center of Excellence (NCCoE) is hosting our second Mobile Driver’s License (mDL) project <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDEsInVy…> update as part of our webinar series. Please join our Project Leads Ryan Galluzzo and Bill Fisher for a short update on the status of the project and next steps. The goal of this project is to work with the community to develop guidance to implement mDLs. After much outreach with the mDL community, the NCCoE proposed three use cases as the focus for this effort. Each use case focuses heavily on the relying party requirements needed to integrate mDLs with business processes and identity technology stacks to realize business value. For this upcoming webinar, we’ve invited guest speakers from the OpenID Foundation <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDIsInVy…> to provide an update on the specification directly related to our cases, including OpenID for Verifiable Presentations (OID4VP) and OpenID for Verifiable Credential Issuance. Guests will also describe how OID4VP can work in tandem with the emerging Browser API specification from the World Wide Web Consortium (W3C) <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDMsInVy…> . At the conclusion of the webinar there will be time for Q&A. We look forward to your participation. *About OpenID Foundation:* Founded in 2007, the OpenID Foundation (OIDF) is a non-profit, open standards body developing identity and security specifications that serve billions of consumers across millions of applications. Register Now <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDQsInVy…> NIST Cybersecurity and Privacy Program Questions/Comments about this notice: mdl-nccoe(a)nist.gov NCCoE Website questions: nccoe(a)nist.gov Connect with us [image: facebook] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDUsInVy…>[image: twitter] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDYsInVy…>[image: youtube] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDcsInVy…>[image: linkedin] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDgsInVy…>[image: flickr] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDksInVy…> Received this email from a friend? Subscribe here <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTAsInVy…> . [image: ITL NIST] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTEsInVy…> Subscriber services: Manage Preferences <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTIsInVy…> | Unsubscribe <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTMsInVy…> | Help <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTQsInVy…> ------------------------------ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTUsInVy…> . Technical questions? Contact inquiries(a)nist.gov. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 [image: GovDelivery logo] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTYsInVy…>

1 0

Reminder-No IAWG today!
by Amanda Gay 02 May '24

02 May '24

Hi all: Just a reminder-no call today. Reach out with any questions/concerns/agenda items! Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

IAWG Cancelled May 2nd
by Amanda Gay 01 May '24

01 May '24

Hi all: The IAWG Weekly Call is canceled this week (May 2nd). We will regroup May 16th. Please reach out with any questions or concerns (or potential agenda items!). Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Canceled event: Identity Assurance Work Group Call @ Thu May 2, 2024 09:00 - 10:00 (PDT) (wg-idassurance@kantarainitiative.org)
by Andrew Hughes 01 May '24

01 May '24

This event has been canceled. Identity Assurance Work Group Call Thursday May 2, 2024 ⋅ 09:00 – 10:00 Pacific Time - Vancouver Location Zoom https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/maps/search/Zoom+https:%2F%2Fus06web.zoom.us%2Fj%2F9… Meetings at 12 pm Eastern TimeTime zone converter: www.thetimenow.com/time-zone-converter.phpTopic: IAWGTime: This is a recurring meeting.Join Zoom Meetinghttps://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09Meeting ID: 931 6796 5850Passcode: 884696One tap mobile+13126266799,,93167965850#,,,,*884696# US (Chicago)+16465588656,,93167965850#,,,,*884696# US (New York)Dial by your location +1 312 626 6799 US (Chicago) +1 646 558 8656 US (New York) +1 301 715 8592 US (Washington DC) +1 346 248 7799 US (Houston) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma)Meeting ID: 931 6796 5850Passcode: 884696Find your local number: https://zoom.us/u/aeg9vt8LSr ~~//~~ Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this email because you are an attendee on the event. To stop receiving future updates for this event, decline this event. Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more https://support.google.com/calendar/answer/37135#forwarding

1 0