April 2025 - WG-IDAssurance - mailman.kantarainitiative.org

Reminder: IAWG - Weekly Group Call
by Andrew Hughes 30 Apr '25

30 Apr '25

For May 1 2025, meeting at the regular time (12:00pm Eastern) Main agenda item: discuss comparable alternative topic. Please refer to email: https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantar… IAWG - Weekly Group Call Thursday May 1, 2025 ⋅ 09:00 – 10:00 Pacific Time - Vancouver Location https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/url?q=https%3A%2F%2Fus06web.zoom.us%2Fj%2F9316796585… Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 --- One tap mobile +16465588656,,93167965850#,,,,*884696# US (New York) +16469313860,,93167965850#,,,,*884696# US --- Dial by your location • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 669 444 9171 US Meeting ID: 931 6796 5850 Passcode: 884696 Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ Guests Andrew Hughes carol(a)kantarainitiative.org david(a)kantarainitiative.co.uk james(a)kantarainitiative.co.uk kay(a)kantarainitiative.org yehoshua(a)proof.com eric.thompson(a)experian.com mmagrath(a)easydynamics.com

1 0

Revised passkeys Notice
by Richard G. WILSHER (＠Zygma Inc.) 29 Apr '25

29 Apr '25

Pfa a draft revised Notice (actually, presented as a replacement Notice) addressing passkeys, accounting for reviewed consideration and the arguments presented in JWJ's email of 04-24. For discussion this week, assuming there is a meeting to be held. A couple of critical elements to be finalized, as commented. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

IAWG Group Call This Week
by Yehoshua Silberstein 25 Apr '25

25 Apr '25

Good evening everyone. There will be an IAWG call this week. Looking forward to seeing you to discuss comparable alternative criteria. IAWG - Weekly Group Call Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 --- One tap mobile +16465588656,,93167965850#,,,,*884696# US (New York) +16469313860,,93167965850#,,,,*884696# US --- Dial by your location • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 669 444 9171 US Meeting ID: 931 6796 5850 Passcode: 884696 Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ LOCATION https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 View map -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

2 1

Comparable Alternative Criteria - Discussion Focus
by Yehoshua Silberstein 24 Apr '25

24 Apr '25

Good afternoon, Thank you to everyone who participated in the initial conversation about Richard's comparable alternative criteria proposal. Our conversation has highlighted several fundamental questions that we need to address to make this framework well-understood and work effectively, particularly given our program's model of a single SAC leading to monolithic certification. To focus our discussion next week, I want to highlight the key areas where we need clarity and resolution: * Rationale for Alternatives: What is the intended policy for using comparable alternatives? Are they for specific necessity (where a barrier exists), or permissible for any equally effective approach? How should the required justification criteria (63A#0700/0710) reflect this policy? * Process & Approval: How will comparable alternative justifications be formally evaluated and approved within our assessment process? Who makes the final decision? * Certification Scope: How will certifications effectively represent services that use a mix of standard criteria and approved comparable alternatives across different flows? What exactly does the program's approval and the resulting certification guarantee regarding the specific alternatives to service providers and agencies? * Defining & Assessing Comparability: How will assessors consistently and objectively evaluate if an alternative truly achieves "same or better" risk management? What specific evidence is required? How is the assessment impacted if the rationale for the alternative was a specific barrier? * Program Value & Clarity for Agencies: What is the distinct value proposition of a Kantara-certified comparable alternative specifically for agencies? How does our certification interact with an agency's own authority and process for determining acceptable controls? * Operational Impact: What are the expected impacts on assessment time, cost, and resources with the introduction of these criteria, especially considering the need to potentially evaluate the rationale for the alternative and how it fits within a single certification scope? These questions aim to address the foundational purpose of comparable alternatives within our program and resolve the complexities that arise in their evaluation, approval, and communication to agencies, helping us move towards a clear and functional framework. Please come prepared to discuss these points next week. Best, Yehoshua -- Yehoshua Silberstein | Senior Counsel, Product Compliance R&D yehoshua(a)proof.com (857) 577-8144 Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do! NOTICE: This email may contain proprietary, business-confidential, and/or privileged material. If you are not the intended recipient, please delete this message and notify the sender immediately. Any unauthorized use is strictly prohibited. This email does not constitute a signed writing for purposes of a binding contract.

1 0

REMINDER: IAWG - Weekly Group Call April 17 2025
by Andrew Hughes 17 Apr '25

17 Apr '25

Yes, there is an IAWG meeting today - sorry for the late reminder. We will continue discussing the items on the action list IAWG - Weekly Group Call Thursday Apr 17, 2025 ⋅ 09:00 – 10:00 Pacific Time - Vancouver Location https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/url?q=https%3A%2F%2Fus06web.zoom.us%2Fj%2F9316796585… Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 --- One tap mobile +16465588656,,93167965850#,,,,*884696# US (New York) +16469313860,,93167965850#,,,,*884696# US --- Dial by your location • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 669 444 9171 US Meeting ID: 931 6796 5850 Passcode: 884696 Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ Guests Andrew Hughes carol(a)kantarainitiative.org david(a)kantarainitiative.co.uk james(a)kantarainitiative.co.uk kay(a)kantarainitiative.org yehoshua(a)proof.com eric.thompson(a)experian.com mmagrath(a)easydynamics.com

1 0

2025-04-10 meeting notes
by Andrew Hughes 10 Apr '25

10 Apr '25

https://kantara.atlassian.net/wiki/spaces/IAWG/pages/963248216/2025-04-10+I… Thanks for joining today's call - we think that we have nailed down the syncable authenticators "which criteria can be excluded" discussion. Discussion is complete at this point - you have a week to review and examine the proposal - on next week's call barring any major errors, we will close the item and make a recommendation to the Assurance Program to adopt. *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0

Reminder - IAWG - Weekly Group Call April 10, 2025
by Andrew Hughes 10 Apr '25

10 Apr '25

Hi IAWG - main discussion topics for this week's call: - continue resolution of syncable authenticators topic (See email from Jimmy) - continue resolution of 'alternative criteria' topic (Richard) IAWG - Weekly Group Call Thursday Apr 10, 2025 ⋅ 09:00 – 10:00 Pacific Time - Vancouver Location https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/url?q=https%3A%2F%2Fus06web.zoom.us%2Fj%2F9316796585… Kantara Initiative is inviting you to a scheduled Zoom meeting. Join Zoom Meeting https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 Meeting ID: 931 6796 5850 Passcode: 884696 --- One tap mobile +16465588656,,93167965850#,,,,*884696# US (New York) +16469313860,,93167965850#,,,,*884696# US --- Dial by your location • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 689 278 1000 US • +1 719 359 4580 US • +1 720 707 2699 US (Denver) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 669 444 9171 US Meeting ID: 931 6796 5850 Passcode: 884696 Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ Guests Andrew Hughes carol(a)kantarainitiative.org david(a)kantarainitiative.co.uk james(a)kantarainitiative.co.uk kay(a)kantarainitiative.org yehoshua(a)proof.com eric.thompson(a)experian.com mmagrath(a)easydynamics.com

1 1

Additional 63A_SAC non-material edit
by Richard G. WILSHER (＠Zygma Inc.) 10 Apr '25

10 Apr '25

I wish to submit the following change for inclusion in the forthcoming 63A re-issue: In the CO_SAC we amended (some while back) criteria which referred to 'Applicants' to be replaced with 'Applicant/Service Consumer' to clarify the necessary applicatikon of the affected criteria when the service being assessed is a component service (see guidance text provided for CO#0110). The following 63A_SAC criteria are in need of the same treatment but were overlooked at the time of changes to the CO_SAC. 63A#0060 The CSP SHALL provide mechanisms to redress Applicant/Service Consumer complaints or problems arising from their use of the identity proofing service. 63A#0062 The CSP SHALL document and publish its redress mechanisms in a manner which is easy for Applicants/Service Consumers to find and use. I think this is self-explanatory and will be unable to participate and support this proposed change at this week's meeting - I'm preferring not to be firing on all four at 03:00 local. Happy meeting, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

Update to Notice KI#2024-01 – Accommodation of Passkeys
by Jimmy Jung 05 Apr '25

05 Apr '25

Below please find my inputs to the proposal to Update to Notice KI#2024-01 The ORIGINAL referenced 63B# criteria: • 0410, 0420, 0430, 0440, 0450, 0460; • 1150, 1160; • 1210, 1220, 1230, 1240; • 1270, 1280, 1290, 1300, 1310, 1320, 1330; • 1450, 1460, 1470, 1480, 1490, 1500, 1510, 1520, 1530, 1540, and 1550. I concur that the language should be reviewed to make clear that the use of the “In scope – Not applicable to Passkeys” caveat is specific only to criteria as it relates to the use of FIDO passkeys. I would also note that the notice includes the following: “Kantara Initiative is in the process of assessing the risks and defining such criteria that will provide the necessary confidence that compliance can be met. Until that is completed and communicated, …” I think we should consider if that is accurate and update accordingly. With regard to criteria, * STRIKE 0410, 0420, 0430, 0440, 0450, 0460 – strike these from the notice. They are memorized secret/password criteria and not applicable to Cryptographic Device Authenticators. They are referenced by the Cryptographic Device Authenticator criteria in 1290 and removed from applicability for passkeys when the notice strikes 1290. Referencing them in the notice only risks a CSP thinking they may be ignored accidentally. * ADD 1130, 1140, 1170– it is not clear why they were left out. These controls appear to be local to the user device and outside the assessment scope * KEEP 1150, 1160, 1210, 1220, 1230, 1240; - It should be noted that these are Single-Factor Cryptographic Software authenticator criteria. While we may assume that passkeys are multifactor; technically the authenticator does not indicate. * ADD 1250, 1260 – it is not clear why they were left out * KEEP 1270, 1280, 1290, 1300, 1310, 1320, 1330 * KEEP 1450, 1460 * STRIKE 1470, 1480, 1490, 1500, 1510, 1520, 1530, 1540, and 1550. - Strike these from the notice. They are biometric criteria and not applicable to Cryptographic Device Authenticators. They are referenced by the Cryptographic Device Authenticator criteria in 1310 and removed from applicability for passkeys when the notice strikes 1310. Referencing them in the notice only risks a CSP thinking they may be ignored accidentally. (If they are to be included (1505 may need to be added * ADD 1710 Throttling attempts for passkeys would be local to the device * I’m not sure if the use of the 5 dot points has some hidden meaning More specifically, WRT to the inclusion of 0410 – 0460; I suggest we consider how these would have been handled say two years ago, before passkeys were an issue. If you are not using passwords/Memorized secrets, or one time password devices, or multi-factor cryptographic hardware, you simply Mark those criteria as in scope not applicable. In the scenario where they are using passkeys but not passwords the caveats of the notice apply. In the scenario where they're using passwords but not pass keys the criteria is there to be addressed. The trickiest aspect is a system using both; I think it is best for the notice to not call out those things that are dismissed under the heading of the cryptographic software criteria. Let them make that calculation; rather than them assuming that these rules do not apply at all (or to their passwords) because they are using passkeys [cid:image001.jpg@01DBA4AA.C00B8E60] Jimmy Jung www.Slandala.com<http://www.slandala.com/> 703 851 6813

1 0

Re: Reminder: IAWG - Weekly Group Call April 3 2025
by Andrew Hughes 01 Apr '25

01 Apr '25

On Tue, Apr 1, 2025 at 10:24 AM Andrew Hughes <andrewhughes3000(a)gmail.com> wrote: > IAWG - Weekly Group Call > > > > Main agenda items for this this week's IAWG Call: > > * Discuss clarifying the definition of "verifiers" in 63B#0120 to ensure > FIPS 140 requirements are correctly applied to cryptographic modules, not > entire organizations, and to resolve inconsistencies with 63B#0090 > > * Review proposal to revise Notice KI#2024-01 – Accommodation of Passkeys > to include the following additional criteria - 63B#0780, #0790, #0800, > #1630, #1640, and #1710. > > https://cdn.kantarainitiative.org/wp-content/uploads/2025/02/Notice-KI-2024… > > * Review proposed 'comparable alternative' criteria. > > IAWG - Weekly Group Call > Thursday Apr 3, 2025 ⋅ 09:00 – 10:00 (Pacific Time - Vancouver) > Kantara Initiative is inviting you to a scheduled Zoom meeting. > Join Zoom Meeting > https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 > > Meeting ID: 931 6796 5850 > Passcode: 884696 > > --- > > One tap mobile > +16465588656,,93167965850#,,,,*884696# US (New York) > +16469313860,,93167965850#,,,,*884696# US > > --- > > Dial by your location > • +1 646 558 8656 US (New York) > • +1 646 931 3860 US > • +1 301 715 8592 US (Washington DC) > • +1 305 224 1968 US > • +1 309 205 3325 US > • +1 312 626 6799 US (Chicago) > • +1 689 278 1000 US > • +1 719 359 4580 US > • +1 720 707 2699 US (Denver) > • +1 253 205 0468 US > • +1 253 215 8782 US (Tacoma) > • +1 346 248 7799 US (Houston) > • +1 360 209 5623 US > • +1 386 347 5053 US > • +1 507 473 4847 US > • +1 564 217 2000 US > • +1 669 444 9171 US > > Meeting ID: 931 6796 5850 > Passcode: 884696 > > Find your local number: https://us06web.zoom.us/u/kdk6YRUeBQ > > Location > https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 > View map > <https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09> > >

1 0