June 2024 - WG-IDAssurance - mailman.kantarainitiative.org

IAWG - Join in an hour!
by Amanda Gay 30 Jun '24

30 Jun '24

Dear IAWG Members: Please join us in an hour for our next IAWG meeting. For review-prior to the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-06-27* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 6.27.2024 1. Administration: - Roll call, determination of quorum. - Moved Zaid Al Bukhari to nonvoting due to non-attendance. Quorum is now 5 out of 8 voting participants. - Minutes approval - 2024.06.13 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/517898265/2024-06-13+I…> - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" - Eballot Results <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/485392385/eBallot+-+Pr…> - 8 votes total - 1 ineligible vote (cast by nonmember) = 7 total votes (out of 9) 1. Quorum was achieved 2. Question 1: 6 approve, 1 disapprove 3. Question 2: 5 approve, 1 disapprove (one respondent skipped this question) - Update on next steps - Address of Record update: - Address of Record–(most recent version <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/333414402/Address+of+R…> from February 8th with ARB Comment); response in progress 3. ISO 17065 Discussion Items 4. Group Discussion: - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - Initial discussion to determine if any criteria need changing - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

6 7

Invitation and Agenda - IAWG - June 27, 2024
by Amanda Gay 25 Jun '24

25 Jun '24

Dear IAWG Members: Please join us Thursday, June 27, at 12PM ET for our next IAWG meeting. For review-prior to the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-06-27* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 6.27.2024 1. Administration: - Roll call, determination of quorum. - Moved Zaid Al Bukhari to nonvoting due to non-attendance. Quorum is now 5 out of 8 voting participants. - Minutes approval - 2024.06.13 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/517898265/2024-06-13+I…> - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" - Eballot Results <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/485392385/eBallot+-+Pr…> - 8 votes total - 1 ineligible vote (cast by nonmember) = 7 total votes (out of 9) 1. Quorum was achieved 2. Question 1: 6 approve, 1 disapprove 3. Question 2: 5 approve, 1 disapprove (one respondent skipped this question) - Update on next steps - Address of Record update: - Address of Record–(most recent version <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/333414402/Address+of+R…> from February 8th with ARB Comment); response in progress 3. ISO 17065 Discussion Items 4. Group Discussion: - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - Initial discussion to determine if any criteria need changing - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

2 1

IAWG - Please join us in an hour!
by Amanda Gay 13 Jun '24

13 Jun '24

Dear IAWG Members: Please join us in an hour for our next IAWG meeting today! For review prior to the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-06-13* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 6.13.2024 1. Administration: - Roll call, determination of quorum. - Move Zaid Al Bukhari to nonvoting due to non-attendance. Quorum is now 5 out of 8 voting participants. - Minutes approval - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" - Eballot Results <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/485392385/eBallot+-+Pr…> - 8 votes total - 1 ineligible vote (cast by nonmember) = 7 total votes (out of 9) 1. Quorum was achieved 2. Question 1: 6 approve, 1 disapprove 1. 7 votes 3. Question 2: 5 approve, 1 disapprove 1. 6 votes 2. 1 additional person skipped this question - Address of Record update: - Address of Record–(most recent version <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/333414402/Address+of+R…> from February 8th with ARB Comment); response in progress 3. ISO 17065 Discussion Items 4. Group Discussion: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - Initial discussion to determine if any criteria need changing - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation and Agenda - IAWG - 13 June 2024
by Amanda Gay 13 Jun '24

13 Jun '24

Dear IAWG Members: Please join us Thursday, June 13, at 12PM ET for our next IAWG meeting. For review prior to the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-06-13* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 6.13.2024 1. Administration: - Roll call, determination of quorum. - Move Zaid Al Bukhari to nonvoting due to non-attendance. Quorum is now 5 out of 8 voting participants. - Minutes approval - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" - Eballot Results <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/485392385/eBallot+-+Pr…> - 8 votes total - 1 ineligible vote (cast by nonmember) = 7 total votes (out of 9) 1. Quorum was achieved 2. Question 1: 6 approve, 1 disapprove 1. 7 votes 3. Question 2: 5 approve, 1 disapprove 1. 6 votes 2. 1 additional person skipped this question - Address of Record update: - Address of Record–(most recent version <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/333414402/Address+of+R…> from February 8th with ARB Comment); response in progress 3. ISO 17065 Discussion Items 4. Group Discussion: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - Initial discussion to determine if any criteria need changing - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

2 1

Fwd: Digital ID Rules Q&A Webinar [SEC=OFFICIAL]
by Andrew Hughes 12 Jun '24

12 Jun '24

Hi IAWG - part of our mandate is to review and provide contribution to organizations as they develop ID Assurance schemes and frameworks. Australia has an open consultation directed towards rules and standards supporting their new Digital ID Act 2024. Should IAWG engage in this consultation? andrew. ---------- Forwarded message --------- From: Digital ID Legislation Engagement < DigitalIDLegislationEngagement(a)finance.gov.au> Date: Wed, Jun 12, 2024 at 5:43 AM Subject: Digital ID Rules Q&A Webinar [SEC=OFFICIAL] To: Digital ID Legislation Engagement < DigitalIDLegislationEngagement(a)finance.gov.au> *OFFICIAL* Good afternoon, The Digital ID Bill has passed through Parliament and the new *Digital ID Act 2024* is expected to commence by 1 December 2024. The Department of Finance is finalising the four-week period of public and stakeholder consultations <https://www.digitalidentity.gov.au/have-your-say/2024-digital-id-rules-accr…> regarding updated exposure drafts of the Accreditation and Digital ID Rules (Rules) and the Accreditation Data Standards (Standards), which are expected to be made by the Minister for Finance for commencement of the legislation. The consultation process has been live since *Tuesday, 28 May* and is set to conclude on *Tuesday 25 June 2024* when all written submissions are due. You are welcome to join us on *Wednesday the 19**th** of June 2024 at 9:30am to 11:30am* to ask any questions or provide feedback on the Rules and Standards <https://www.digitalidentity.gov.au/have-your-say/2024-digital-id-rules-accr…> that are out for consultation before the consultation closes. This webinar session will also provide you with some general themes of feedback we have received to date from other digital ID engagements held throughout the consultation period. You can register your interest in attending here: https://events.teams.microsoft.com/event/e7a9b1fe-620e-4c10-8873-ef3558b9cb… If you are interested in making a formal submission, you can also upload a written submission to the Digital ID Consultation Hub <https://www.digitalidentity.gov.au/have-your-say/2024-digital-id-rules-accr…> . We highly value your contributions to the development of this important framework. *Digital ID and Data Policy Division* Governance and Resource Management Group Department of Finance *A: *One Canberra Avenue, Forrest ACT 2603

1 0

Motions re. adoption of proposed changes to 63A#0180
by Richard G. WILSHER (＠Zygma Inc.) 04 Jun '24

04 Jun '24

Todays call (2024-05-16) addressed the technical agenda item: Proposed 63A#0180 Revisions: The net outcome was (I believe, but read the minutes for yourselves) broad support for implementing the proposed changes, the rational for which was as follows (and the form of which is attached): Whereas NIST wrote SP 800-63 rev.3 from the perspective of what a complete set of proofing, authentication, federation requirements might be Kantara has, in response to market demand, accommodated within the IAF Approval scheme both Full and Component Services. Generally speaking the structure and level of granularity of criteria allows a provider of a Component Service to state which criteria apply and which do not. However, I see some restriction being implied by 63A#0180 by reason of the very high perspective of this criterion and its sub-parts. By stating what the end game (i.e. Full Service) proofing evidence requirements are, and accepting that a criterion is either applicable or not, but there being no provision for partially acceptable, this criterion does not allow a Component Service provider to support part of the evidence selection and processing of a complete proofing while allowing its Service Consumer to provide the other evidence forms within the overall proofing. Such a use case might be a provider which provides for proofing a STRONG form of evidence, perhaps because it can resolve the technologically-demanding parts of the end-end process, while it doesnt supporting the processing of any FAIR evidence. In full disclosure, I have a client which deploys such a service, handling a STRONG and a single FAIR form of evidence while the Service Consumer handles the second FAIR form of evidence. [RGW 20240-05-16: and others are known to be providing similar services and wishing to gain Kantara Approval.] In such cases the criteria should be considered not applicable, yet to do so denies the CSP the recognition for the conformant processing of those forms of evidence which it does handle. I am therefore proposing to the IAWG a revision to 63A#0180 which, by breaking down the inherent breadth of this criterion, allows for more definitive applicability to be denoted. Please see the attached proposed changes. Clearly, in the cases of the expanded sub-criteria c) and d), a Full Service would have to indicate applicable for all sub-parts of c) and/or d) respectively, whereas a Component Service could be selective, according to its architecture/design. It should be noted that in the above discussion Component Service is one which meets the definition in the Kantara Glossary KIAF-1050 v2.0 (§3.4), not the erroneous description on the TSL pages. The same applies to the Full Service definition (§3.5). At the close of meeting I was asked to prepare a motion for e-voting, which I present below, though I have seen fit to propose two motions for the purposes of fully-addressing the requirements for proceeding with the acceptance and publication of the proposed changes. I guess the Secretariat will be responsible for setting the voting in progress with a deadline for submissions? Motion #1: That the subject proposed changes to criterion 63A#0180 be approved by the IAWG as presented and that the KI Secretariat publish them without delay as the latest criteria set (KIAF-1430 SP 800-63A SAC-SoCA v5.1). Motion #2: That the subject changes be approved as being Non-material in nature*, and in their publication, be processed accordingly by the KI Secretariat. * The materiality was not discussed but I will offer the argument that since these changes will add clarity, will not impose any additional operational or functional requirements upon CSPs and will not require any changes to existing Approved services, they are NOT of a material nature. Neither will they affect nor influence one jot any spurious attempts to claim Kantara Approval where none exists. Thank you for your efforts to address these changes. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

3 4