September 2024 - WG-IDAssurance - mailman.kantarainitiative.org

Join Us In An Hour - IAWG - 12 September 2024
by Amanda Gay 12 Sep '24

12 Sep '24

Dear IAWG Members: Please join us in an hour for the next IAWG meeting. The proposed agenda and Zoom details are below. Date and Time - Date: Thursday, 2024-09-12 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> GROUP ACTION: Everyone who is interested in drafting comments to start sending them via the NIST provided comment form <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> (Excel file in the “Documentation Box” on the right-hand side) to Carol. ( carol(a)kantarainitiative.com) DRAFT 09.12.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.09.05 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616661008/2024-09-05+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting cadence - weekly. 3. ISO 17065 Discussion Items 4. Group Discussion: - Draft 2 of 800-63-4 <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> - Topics from IAWG leadership 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation and Agenda - IAWG - 12 September 2024
by Amanda Gay 10 Sep '24

10 Sep '24

Dear IAWG Members: Please join us Thursday, September 12, at 12PM ET for our next IAWG meeting. The proposed agenda and Zoom details are below. Date and Time - Date: Thursday, 2024-09-12 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> GROUP ACTION: Everyone who is interested in drafting comments to start sending them via the NIST provided comment form <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> (Excel file in the “Documentation Box” on the right-hand side) to Carol. ( carol(a)kantarainitiative.com) DRAFT 09.12.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.09.05 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616661008/2024-09-05+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting cadence - weekly. 3. ISO 17065 Discussion Items 4. Group Discussion: - Draft 2 of 800-63-4 <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> - Topics from IAWG leadership 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

About sync.authrs
by Richard G. WILSHER (＠Zygma Inc.) 05 Sep '24

05 Sep '24

Apologies for this even later contribution to today's meeting, but . On the last call which in which I was a participant I made a statement which I'd like to reiterate, for good reason (imo!): Kantara's purpose is to give assurance to RPs and the user community at large that services which we assess and Approve can be relied upon to the extent of the criteria and assessment processes applied. While we may use NIST's 800-63 series as a very significant technical driver for our criteria, we have in the past exercised judgement in the creation of Kantara's criteria in order to reflect practical and commercial realities. Indeed, my ongoing review of -63A rev.4 convinces me that we need to continue to exercise that judgement! My point therefore was that we should NOT be beholden to NIST's publications but do what is responsible whilst being responsive to our primary customers - CSPs who have services for which they wish to demonstrate conformity and thus Approval. In doing so, we need to take an approach towards NIST's 63B Supplement which provides for recognition of its good parts and to deal with the difficulties which remain, and my understanding thus far is that 63B rev.4 does not materially advance what is in the Supplement (open to education if that is not a valid assertion). An obvious aspect in this is that there are things occurring within the sync.authr fabric over which CSP's have no control and therefore our existing criteria demand a finding of nonconformance where criteria have requirements for CSPs to do certain things which they are simply unable to effect, which would (could?) lead to Approval not being granted. I am also mindful of our objective to keep our criteria 'technology agnostic'. All that said, I'd like to float an idea: Given their increasingly ubiquitous usage, not least by agencies who seem to want to put them to use despite how they may or may not meet NIST's published expectations, and noting that a good number of our CSPs want to deploy such authenticators within the scope of their services, in order to get passkeys / FIDO / syncable authenticators out the door, can we state the following in the guidance section for those criteria where things are taken out of the CSP's hands? Where FIDO-specific authenticators are implemented within a policy/technical/operational fabric wherein: a) the CSP is unable to exercise any control over the authenticator implementation; and b) the CSP has no insight into said implementation; then the 'SoCA' entry for this criterion SHALL be cited as follows: "In scope - Not applicable: Authenticator fabric beyond [service name]'s scope of control - see [KI notice]" Implicitly therefore, Kantara needs to publish a notice to the effect that, given the pressure from service consumers to deploy FIDO-implemented passkeys, and in recognition of the fact that CSPs cannot be held responsible for the implementation of the operational infrastructure, Approval of services which deploy FIDO passkey authenticators DOES NOT extend to the assurability of the FIDO fabric. Furthermore, Kantara should affirm that any other form of authenticators deployed by a specific service DO fall within the scope of any Approval which has been awarded to that service. By publishing this notice and it being referenced from the SoCA (part of the TSL) and perhaps more explicitly also from a specific field in the primary entry for the Approved service, it should be abundantly clear to anyone genuinely interested in a service, as either a consumer (RP) or as a subject, that there's stuff we cannot control but everybody wants. This also avoids writing a non-agnostic criterion (or two) which directly refers to FIDO - it is the SoCA which delivers the technology-specific notice. Jimmy has already provided some draft criteria in response to the Supplement and he and I have colluded to bring those along a bit further BUT . they can only go so far and serve no purpose unless we address the elephant in the room. I might add, I see this as a short-term solution, the longer-term goal being to encourage the establishment of a means to evaluate and affirm the correctness of FIDO implementations. Not KI's job, imo. Someone else's, but we should offer encouragement. Food for thought, along with the grist for the mill? Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

2 1

Join Us In An Hour - IAWG - 05 September 2024
by Amanda Gay 05 Sep '24

05 Sep '24

Dear IAWG Members: Please join us in an hour for our next IAWG meeting. I've included the proposed agenda and Zoom details below. Date and Time - Date: Thursday, 2024-09-05 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> GROUP ACTION: Everyone who is interested in drafting comments to start sending them via the NIST-provided comment form <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> (Excel file in the “Documentation Box” on the right-hand side) to Carol. ( carol(a)kantarainitiative.com) DRAFT 09.05.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.08.29 <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616202269/2024-08-29+I…> Meeting Minutes DRAFT - 2024.08.22 <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/615055364/2024-08-22+I…> Meeting Minutes DRAFT - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting cadence - weekly. 3. ISO 17065 Discussion Items 4. Group Discussion: - Draft 2 of 800-63-4 <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

-63 rev.4 - Short-notice grist for the mill
by Richard G. WILSHER (＠Zygma Inc.) 05 Sep '24

05 Sep '24

If I have missed any other postings of review comments re. -63 rev.4, apologies. I've gone for reviewing -63A before anything else, normative clauses only, and its slow going. Maybe we need to divide and conquer - some on A, some on B, some on C? I suspect the base doc is worthy of attention from everyone since it, theoretically at least, affects A, B and C ? Anyway, here are my scattered thoughts thus far. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

2 1

Invitation and Agenda - IAWG - 05 September 2024
by Amanda Gay 04 Sep '24

04 Sep '24

Dear IAWG Members: Please join us Thursday, September 5, at 12PM ET for our next IAWG meeting. I've included the proposed agenda and Zoom details below. Date and Time - Date: Thursday, 2024-09-05 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> GROUP ACTION: Everyone who is interested in drafting comments to start sending them via the NIST-provided comment form <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> (Excel file in the “Documentation Box” on the right-hand side) to Carol. ( carol(a)kantarainitiative.com) DRAFT 09.05.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.08.29 <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616202269/2024-08-29+I…> Meeting Minutes DRAFT - 2024.08.22 <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/615055364/2024-08-22+I…> Meeting Minutes DRAFT - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting cadence - weekly. 3. ISO 17065 Discussion Items 4. Group Discussion: - Draft 2 of 800-63-4 <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

2 1