July 2024 - WG-IDAssurance - mailman.kantarainitiative.org

IAWG Today - Join Us In An Hour!
by Amanda Gay 25 Jul '24

25 Jul '24

Dear IAWG Members: Please join us in an hour for the next IAWG meeting. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-07-25* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 7.25.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.07.11 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/549519393/2024-07-11+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer* - August 8 (Passkey Presentations), August 22 - *If rev.4 is released, this cadence will be updated 3. ISO 17065 Discussion Items 4. Group Discussion: - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation and Agenda - IAWG - 25 July 2024
by Amanda Gay 23 Jul '24

23 Jul '24

Dear IAWG Members: Please join us Thursday, July 25th at 12PM Noon for the next IAWG meeting. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-07-25* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 7.25.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.07.11 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/549519393/2024-07-11+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer* - August 8 (Passkey Presentations), August 22 - *If rev.4 is released, this cadence will be updated 3. ISO 17065 Discussion Items 4. Group Discussion: - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Join Us In An Hour - IAWG Call 11 July 2024
by Amanda Gay 18 Jul '24

18 Jul '24

Dear IAWG Members: Please join us in an hour for the next IAWG meeting. For review before the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - - Please come prepared to answer the questions noted in agenda. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-07-11* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 7.11.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.06.27 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/532578311/2024-06-27+I…> - 2024.06.13 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/517898265/2024-06-13+I…> - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer* - July 11, July 25 - August 8, August 22 - *If rev.4 is released, this cadence will be updated 3. ISO 17065 Discussion Items 4. Group Discussion: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - What changes are required? What additional criteria is needed in the existing framework to demonstrate conformity? - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

2 1

Invitation and Agenda - IAWG Call 11 July 2024
by Amanda Gay 09 Jul '24

09 Jul '24

Dear IAWG Members: Please join us Thursday, July 11th, at 12PM ET for our next IAWG meeting. For review before the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - - Please come prepared to answer the questions noted in agenda. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-07-11* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 7.11.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.06.27 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/532578311/2024-06-27+I…> - 2024.06.13 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/517898265/2024-06-13+I…> - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer* - July 11, July 25 - August 8, August 22 - *If rev.4 is released, this cadence will be updated 3. ISO 17065 Discussion Items 4. Group Discussion: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - What changes are required? What additional criteria is needed in the existing framework to demonstrate conformity? - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Re: The CSP SHALL ensure that MF-CS key authenticators DO NOT facilitate the cloning of the secret key onto multiple devices. (RE: Synch-able authenticators)
by Jimmy Jung 05 Jul '24

05 Jul '24

Thanks Alexei, Taking the larger IAWG out of the loop. Yes, I believe that the 63B supplement is intended to address this; but Kantara is in the position of trying to catch our criteria up to NIST; and it is impacting folks trying to address the criteria today. (I think ID.me has some time). My personal view is that relying parties ought to have the flexibility to choose their own level of comfort; regardless of the NIST supplement and the Kantara criteria. It seems unlikely that a “consumer" oriented RP (e.g., Amazon or Insta) would choose to be more restrictive and not allow synching, but certainly, if FIDO wants to proliferate, they may well reach RPs that are not comfortable with passkeys synching on to some library workstation browser (e.g., Bank of America or Social Security Administration). But that is just my personal view, and not germane to the issue at hand - Kantara’s next move. I think the NIST supplement is a concession to the market. I assume this hot discussion is happening in the (UAF) Technical Working Group? Jimmy From: Alexei Czeskis <alexei.czeskis(a)id.me> Sent: Friday, July 5, 2024 1:12 PM To: Jimmy Jung <jimmy.jung(a)slandala.com> Cc: Andrew Hughes <andrewhughes3000(a)gmail.com>; Amanda Gay <amanda(a)kantarainitiative.org>; wg-idassurance(a)kantarainitiative.org; Tanel Suurhans <tanel(a)id.me>; Blake Hall <blake(a)id.me> Subject: Re: [WG-IDAssurance] The CSP SHALL ensure that MF-CS key authenticators DO NOT facilitate the cloning of the secret key onto multiple devices. (RE: Synch-able authenticators) Hi all! Definitely very interested in this conversation. As Blake said, I was a long-time editor for U2F, FIDO2, and WebAuthn -- I love this space! > I had assumed that we had the ability to prevent the generation of synchable passkeys as they are registered with the CSP, but I’m having a hard time seeing that when I look through the protocol. Certain platform vendors have significant reservations about giving RPs this type of control. It's a continuing hot topic of discussion right now in FIDO -- as you can imagine, many RPs want more control. My personal view is that some of the more "consumer" oriented platforms believe that all non-roaming (non-fob-based) passkeys should be sync'able and that everything else should be managed via MDM. Yep, the Backup Eligibility and Backup State flags are there in Authenticator Data (so you are supposed to get it back in the response): * Bit 3: Backup Eligibility<https://w3c.github.io/webauthn/#backup-eligibility> (BE). * 1 means the public key credential source<https://w3c.github.io/webauthn/#public-key-credential-source> is backup eligible<https://w3c.github.io/webauthn/#backup-eligible>. * 0 means the public key credential source<https://w3c.github.io/webauthn/#public-key-credential-source> is not backup eligible<https://w3c.github.io/webauthn/#backup-eligible>. * Bit 4: Backup State<https://w3c.github.io/webauthn/#backup-state> (BS). * 1 means the public key credential source<https://w3c.github.io/webauthn/#public-key-credential-source> is currently backed up<https://w3c.github.io/webauthn/#backed-up>. * 0 means the public key credential source<https://w3c.github.io/webauthn/#public-key-credential-source> is not currently backed up<https://w3c.github.io/webauthn/#backed-up>. The 2023 WWDC<https://developer.apple.com/videos/play/wwdc2023/10263/> talk on enterprise management of Passkeys describes what I think is the closest we currently get to having control over passkey creation and sync'ing beyond what's in the spec. I read the NIST’s 800-63B supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…> as accounting for the inability of agencies to control the sync nature on non-managed devices and instead saying that agencies should lean into MDM: Devices (e.g., mobile phones, laptops, tablets) that generate, store, and sync authenticators containing federal enterprise private keys SHALL be protected by mobile device management software or other device configuration controls that prevent the syncing or sharing of keys to unauthorized devices or sync fabrics Is that how you read it as well? Thanks, -Alexei -- Alexei Czeskis SVP of Engineering alexei.czeskis(a)id.me<mailto:alexei.czeskis@id.me> ID.me<http://www.id.me/> | We're hiring!<http://careers.id.me/> [https://s3.amazonaws.com/idme/logo/idme-logo-signature.png] On Sun, Jun 30, 2024 at 8:01 PM Blake Hall <blake(a)id.me<mailto:blake@id.me>> wrote: Adding Alexei to the discussion. He is one of the FIDO standard authors and might have useful feedback for this group. On Sat, Jun 29, 2024 at 11:00 PM Jimmy Jung <jimmy.jung(a)slandala.com<mailto:jimmy.jung@slandala.com>> wrote: Perhaps Andrew will appreciate me throwing a completely different log on the fire. We briefly discussed what we should do about NISTs synchable authenticator supplement and concluded that it was at least worth waiting got the next 3-4 draft, Perhaps Andrew will appreciate me throwing a completely different log on the fire. We briefly discussed what we should do about NISTs synchable authenticator supplement and concluded that it was at least worth waiting got the next 3-4 draft, to see which way the wind is blowing. That still seems quite reasonable, but I will reiterate that have a few clients that are quite keen to see this leveraged. That being said, I did try to dig onto WebAuthn. I had assumed that we had the ability to prevent the generation of synchable passkeys as they are registered with the CSP, but I’m having a hard time seeing that when I look through the protocol. I see an ability to NOT ACCEPT synched passkeys on the authentication side, but no way to prevent their creation at registration. https://webauthn.guide/#webauthn-api<https://urldefense.com/v3/__https:/webauthn.guide/*webauthn-api__;Iw!!AVdDj…> When the user creates their passkey, the server/CSP can ONLY specify if the credential is “Cross-platform” (i.e., removable; e.g.,yubikey) or “platform” (i.e., SW, tied to the device). But you CAN”T specify if it is backup eligible (i.e., synchable). You CAN ONLY reject that authenticator after it has been created. So, to prevent synchable authenticators, we would have to ONLY ALLOW user to create and use Yubikeys and other removeable HW authenticators. I think that cuts out a large swath of the passkey utility, until synchability is allowed. Jimmy AT REGISTRATION, we can specify the authenticator type. “authenticatorSelection” seems to define the constraints. HOWEVER, I am very uncertain if this is granular enough to exclude cloneable authenticators. authenticatorSelection: This optional object helps relying parties make further restrictions on the type of authenticators allowed for registration. In this example we are indicating we want to register a cross-platform authenticator (like a Yubikey) instead of a platform authenticator like Windows Hello or Touch ID. Read the spec.<https://urldefense.com/v3/__https:/w3c.github.io/webauthn/*dom-publickeycre…> From the specification (https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-auth…<https://urldefense.com/v3/__https:/w3c.github.io/webauthn/*dom-publickeycre…>): “authenticatorSelection, of type AuthenticatorSelectionCriteria The Relying Party (the server/CSP) MAY use this OPTIONAL member to specify capabilities and settings that the authenticator MUST or SHOULD satisfy to participate in the create() operation. See § 5.4.4 Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria). https://w3c.github.io/webauthn/#dictdef-authenticatorselectioncriteria<https://urldefense.com/v3/__https:/w3c.github.io/webauthn/*dictdef-authenti…> authenticatorAttachment, of type DOMString If this member is present, eligible authenticators are filtered to be only those authenticators attached with the specified authenticator attachment modality (see also § 6.2.1 Authenticator Attachment Modality). If this member is absent, then any attachment modality is acceptable. The value SHOULD be a member of AuthenticatorAttachment but client platforms MUST ignore unknown values, treating an unknown value as if the member does not exist. We refer to authenticators that are part of the client device as platform authenticators, while those that are reachable via cross-platform transport protocols are referred to as roaming authenticators. … The primary use case for platform authenticators is to register a particular client device as a "trusted device", so the client device itself acts as a something you have authentication factor for future authentication. This gives the user the convenience benefit of not needing a roaming authenticator for future authentication ceremonies, e.g., the user will not have to dig around in their pocket for their key fob or phone. (https://w3c.github.io/webauthn/#sctn-authenticator-attachment-modality<https://urldefense.com/v3/__https:/w3c.github.io/webauthn/*sctn-authenticat…>) Looking instead at NIST’s 800-63B supplement, where they discuss synchable authenticators. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…<https://urldefense.com/v3/__https:/nvlpubs.nist.gov/nistpubs/SpecialPublica…> In Table 2. WebAuthn Level 3 flags, they identify: Backup Eligibility – which Indicates whether the authenticator can be synced to a different device (i.e., whether the key can be stored elsewhere). AND Backup State – which Indicates whether an authenticator HAS been synced to a different device. NIST specifically says that “Federal agencies MAY use this flag if they intend to establish restric�ons on authen�cators that have been synced to other devices. For public facing applica�ons, agencies SHOULD NOT change the acceptance based on this flag due to user experience concerns. For enterprise decisions, this flag MAY be used to support the restric�on of syncable authen�cators for specific applica�ons.” (excuse the pdf to MS cut and paste) I Don’t know where in the protocol these show up (somewhere in the https://w3c.github.io/webauthn/#authenticator-data<https://urldefense.com/v3/__https:/w3c.github.io/webauthn/*authenticator-da…>). But this may only allow us to prohibit their use, not control if they are created. I would note that NIST only discusses this in terms of a multi-factor authenticator, but I assume they are accepting the premise that passkey is multifactor, even if the “thing-you-have” is your laptop (of public library computer?) _______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance(a)kantarainitiative.org<mailto:wg-idassurance@kantarainitiative.org> To unsubscribe send an email to staff(a)kantarainitiative.org<mailto:staff@kantarainitiative.org> List archives -- https://urldefense.com/v3/__https://mailman.kantarainitiative.org/hyperkitt…<https://urldefense.com/v3/__https:/mailman.kantarainitiative.org/hyperkitty…> ______ Group wiki -- https://urldefense.com/v3/__https://kantara.atlassian.net/wiki/spaces/WG-ID…<https://urldefense.com/v3/__https:/kantara.atlassian.net/wiki/spaces/WG-IDA…> -- Blake Hall Founder & CEO Mobile: 615-293-4702 blake(a)ID.me<mailto:blake@ID.me> ID.me<http://www.id.me/> | We're hiring!<http://careers.id.me/> [https://assets.id.me/logo/idme-logo-signature.png] Veterans Get Secure Single-Sign On for Benefits: http://go.id.me/2iKDM6j President's National Strategy for Trusted Identities in Cyberspace: http://go.id.me/2hZzUKr Building the Trust Graph: http://go.id.me/trust-graph This message (including any attachments) may contain confidential and privileged information belonging to the sender, for a specific individual and purpose, and is legally privileged. If you are not the intended recipient, you should delete this message and any disclosure, copying, forwarding or distribution of this message, or the taking of any action based on it, by you is strictly prohibited.

2 1

IAWG - Join in an hour!
by Amanda Gay 30 Jun '24

30 Jun '24

Dear IAWG Members: Please join us in an hour for our next IAWG meeting. For review-prior to the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-06-27* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 6.27.2024 1. Administration: - Roll call, determination of quorum. - Moved Zaid Al Bukhari to nonvoting due to non-attendance. Quorum is now 5 out of 8 voting participants. - Minutes approval - 2024.06.13 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/517898265/2024-06-13+I…> - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" - Eballot Results <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/485392385/eBallot+-+Pr…> - 8 votes total - 1 ineligible vote (cast by nonmember) = 7 total votes (out of 9) 1. Quorum was achieved 2. Question 1: 6 approve, 1 disapprove 3. Question 2: 5 approve, 1 disapprove (one respondent skipped this question) - Update on next steps - Address of Record update: - Address of Record–(most recent version <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/333414402/Address+of+R…> from February 8th with ARB Comment); response in progress 3. ISO 17065 Discussion Items 4. Group Discussion: - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - Initial discussion to determine if any criteria need changing - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

6 7