- WG-IDAssurance - mailman.kantarainitiative.org

Updated invitation: Identity Assurance Work Group Call @ Weekly from 12pm to 1pm on Thursday from Thu Sep 7, 2023 to Wed Aug 21 (EDT) (wg-idassurance@kantarainitiative.org)
by Kantara Initiative 22 Aug '24

22 Aug '24

This event has been updated Changed: time Identity Assurance Work Group Call Weekly from 12pm to 1pm on Thursday from Thursday Sep 7, 2023 to Wednesday Aug 21 Eastern Time - New York Location Zoom https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/maps/search/Zoom+https:%2F%2Fus06web.zoom.us%2Fj%2F9… Meetings at 12 pm Eastern TimeTime zone converter: www.thetimenow.com/time-zone-converter.phpTopic: IAWGTime: This is a recurring meeting.Join Zoom Meetinghttps://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09Meeting ID: 931 6796 5850Passcode: 884696One tap mobile+13126266799,,93167965850#,,,,*884696# US (Chicago)+16465588656,,93167965850#,,,,*884696# US (New York)Dial by your location +1 312 626 6799 US (Chicago) +1 646 558 8656 US (New York) +1 301 715 8592 US (Washington DC) +1 346 248 7799 US (Houston) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma)Meeting ID: 931 6796 5850Passcode: 884696Find your local number: https://zoom.us/u/aeg9vt8LSr Reply for wg-idassurance(a)kantarainitiative.org and view more details https://calendar.google.com/calendar/event?action=VIEW&eid=YTY5azI5dGdkNWFq… Your attendance is optional. ~~//~~ Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this email because you are an attendee on the event. To stop receiving future updates for this event, decline this event. Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more https://support.google.com/calendar/answer/37135#forwarding

1 0

Updated invitation: Identity Assurance Work Group Call @ Weekly from 12pm to 1pm on Thursday (EDT) (wg-idassurance@kantarainitiative.org)
by Kantara Initiative 22 Aug '24

22 Aug '24

This event has been updated Identity Assurance Work Group Call Weekly from 12pm to 1pm on Thursday Eastern Time - New York Location Zoom https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/maps/search/Zoom+https:%2F%2Fus06web.zoom.us%2Fj%2F9… Meetings at 12 pm Eastern TimeTime zone converter: www.thetimenow.com/time-zone-converter.phpTopic: IAWGTime: This is a recurring meeting.Join Zoom Meetinghttps://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09Meeting ID: 931 6796 5850Passcode: 884696One tap mobile+13126266799,,93167965850#,,,,*884696# US (Chicago)+16465588656,,93167965850#,,,,*884696# US (New York)Dial by your location +1 312 626 6799 US (Chicago) +1 646 558 8656 US (New York) +1 301 715 8592 US (Washington DC) +1 346 248 7799 US (Houston) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma)Meeting ID: 931 6796 5850Passcode: 884696Find your local number: https://zoom.us/u/aeg9vt8LSr Reply for wg-idassurance(a)kantarainitiative.org and view more details https://calendar.google.com/calendar/event?action=VIEW&eid=YTY5azI5dGdkNWFq… Your attendance is optional. ~~//~~ Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this email because you are an attendee on the event. To stop receiving future updates for this event, decline this event. Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more https://support.google.com/calendar/answer/37135#forwarding

1 0

Fwd: NIST Releases Second Public Draft of Digital Identity Guidelines for Final Review
by Andrew Hughes 21 Aug '24

21 Aug '24

Ok folks - here we go! Start reading and getting ready to discuss. IAWG will assemble one submission. Comment period is open until October 7 Andrew Hughes CISM m +1 250.888.9474 AndrewHughes3000(a)gmail.com https://www.linkedin.com/in/andrew-hughes-682058a ---------- Forwarded message --------- From: National Institute of Standards and Technology (NIST) < subscriptions(a)service.govdelivery.com> Date: Wed, Aug 21, 2024 at 7:43 AM Subject: NIST Releases Second Public Draft of Digital Identity Guidelines for Final Review To: <andrewhughes3000(a)gmail.com> The guidance aims to ensure security, privacy and accessibility for people accessing government services. [image: nist] View as a Web Page <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVy…> [image: News] NIST Releases Second Public Draft of Digital Identity Guidelines for Final Review [image: Icons for methods of establishing online identity, including a password and a physical ID card, are shown near a screen reading "ACCESS GRANTED."] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDEsInVy…> When we need to show proof of identity, we might reach for our driver’s license — or perhaps, sooner than many of us imagine, we may opt for a digital credential stored on a smartphone. To ensure we can use both novel and time-tested methods to prove our identities securely when accessing essential services, the U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) has updated its draft digital identity guidance. The draft *Digital Identity Guidelines* (NIST Special Publication [SP] 800-63 Revision 4 <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDIsInVy…> and its companion publications SPs 800-63A <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDMsInVy…> , 800-63B <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDQsInVy…> and 800-63C <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDUsInVy…>) have been updated to reflect the robust feedback that NIST received in 2023 as part of a four-month-long comment period and yearlong period of external engagement. Read More <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDYsInVy…> Connect with us [image: facebook] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDcsInVy…>[image: twitter] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDgsInVy…>[image: youtube] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDksInVy…>[image: linkedin] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTAsInVy…>[image: flickr] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTEsInVy…> Received this email from a friend? Subscribe here <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTIsInVy…> . [image: NIST] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTMsInVy…> Subscriber services: Manage Preferences <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTQsInVy…> | Unsubscribe <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTUsInVy…> | Help <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTYsInVy…> ------------------------------ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTcsInVy…> . Technical questions? Contact inquiries(a)nist.gov. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive <https://www.google.com/maps/search/100+Bureau+Drive?entry=gmail&source=g>, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 [image: GovDelivery logo] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTgsInVy…>

1 0

Invitation and Agenda - IAWG - 22 August 2024
by Amanda Gay 20 Aug '24

20 Aug '24

Dear IAWG Members: Please join us Thursday, August 22 at 12PM ET for our next IAWG meeting. The proposed agenda and Zoom details are below. Date and Time - Date: Thursday, 2024-08-22 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 08.22.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.07.25 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/569507845/2024-07-25+I…> - 2024.08.08 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/588382209/2024-08-08+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting Cadence for August/September - August 22 - Return to weekly calls as of September 5th 3. ISO 17065 Discussion Items 4. Group Discussion: - Status Update: Supplement for Syncable Authenticators <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…> 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Please Join Us In An Hour - IAWG
by Amanda Gay 08 Aug '24

08 Aug '24

Dear IAWG Members: Please join us in an hour for the next IAWG meeting. The proposed agenda and Zoom details are below. Please also keep an eye out for an email from Jimmy containing a first attempt at rolling the supplement into Kantara criteria! *Date and Time* - *Date: Thursday, 2024-08-08* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 08.08.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - Jimmy moves for unanimous, seconded by Hughes. Motion passes. - 2024.07.25 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/569507845/2024-07-25+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer* - August 8 (Passkey Presentations), August 22 - *If rev.4 is released, this cadence will be updated 3. ISO 17065 Discussion Items 4. Group Discussion: - Passkey Presentations - Tim Capalli, Okta - Dean Saxe, Beyond Identity - Alexei Czeskis, ID.me 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

2 1

Agenda and Invitation - IAWG - August 08, 2025
by Amanda Gay 07 Aug '24

07 Aug '24

Dear IAWG Members: Please join us this Thursday, at 12 Noon ET for the next IAWG meeting. The proposed agenda and Zoom details are below. Please also keep an eye out for an email from Jimmy containing a first attempt at rolling the supplement into Kantara criteria! *Date and Time* - *Date: Thursday, 2024-08-08* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 08.08.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - Jimmy moves for unanimous, seconded by Hughes. Motion passes. - 2024.07.25 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/569507845/2024-07-25+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer* - August 8 (Passkey Presentations), August 22 - *If rev.4 is released, this cadence will be updated 3. ISO 17065 Discussion Items 4. Group Discussion: - Passkey Presentations - Tim Capalli, Okta - Dean Saxe, Beyond Identity - Alexei Czeskis, ID.me 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

4 4

IAWG Today - Join Us In An Hour!
by Amanda Gay 25 Jul '24

25 Jul '24

Dear IAWG Members: Please join us in an hour for the next IAWG meeting. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-07-25* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 7.25.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.07.11 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/549519393/2024-07-11+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer* - August 8 (Passkey Presentations), August 22 - *If rev.4 is released, this cadence will be updated 3. ISO 17065 Discussion Items 4. Group Discussion: - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation and Agenda - IAWG - 25 July 2024
by Amanda Gay 23 Jul '24

23 Jul '24

Dear IAWG Members: Please join us Thursday, July 25th at 12PM Noon for the next IAWG meeting. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-07-25* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 7.25.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.07.11 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/549519393/2024-07-11+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer* - August 8 (Passkey Presentations), August 22 - *If rev.4 is released, this cadence will be updated 3. ISO 17065 Discussion Items 4. Group Discussion: - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Join Us In An Hour - IAWG Call 11 July 2024
by Amanda Gay 18 Jul '24

18 Jul '24

Dear IAWG Members: Please join us in an hour for the next IAWG meeting. For review before the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - - Please come prepared to answer the questions noted in agenda. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-07-11* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 7.11.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.06.27 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/532578311/2024-06-27+I…> - 2024.06.13 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/517898265/2024-06-13+I…> - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer* - July 11, July 25 - August 8, August 22 - *If rev.4 is released, this cadence will be updated 3. ISO 17065 Discussion Items 4. Group Discussion: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - What changes are required? What additional criteria is needed in the existing framework to demonstrate conformity? - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

2 1

Invitation and Agenda - IAWG Call 11 July 2024
by Amanda Gay 09 Jul '24

09 Jul '24

Dear IAWG Members: Please join us Thursday, July 11th, at 12PM ET for our next IAWG meeting. For review before the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - - Please come prepared to answer the questions noted in agenda. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-07-11* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 7.11.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.06.27 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/532578311/2024-06-27+I…> - 2024.06.13 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/517898265/2024-06-13+I…> - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer* - July 11, July 25 - August 8, August 22 - *If rev.4 is released, this cadence will be updated 3. ISO 17065 Discussion Items 4. Group Discussion: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - What changes are required? What additional criteria is needed in the existing framework to demonstrate conformity? - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Re: The CSP SHALL ensure that MF-CS key authenticators DO NOT facilitate the cloning of the secret key onto multiple devices. (RE: Synch-able authenticators)
by Jimmy Jung 05 Jul '24

05 Jul '24

Thanks Alexei, Taking the larger IAWG out of the loop. Yes, I believe that the 63B supplement is intended to address this; but Kantara is in the position of trying to catch our criteria up to NIST; and it is impacting folks trying to address the criteria today. (I think ID.me has some time). My personal view is that relying parties ought to have the flexibility to choose their own level of comfort; regardless of the NIST supplement and the Kantara criteria. It seems unlikely that a “consumer" oriented RP (e.g., Amazon or Insta) would choose to be more restrictive and not allow synching, but certainly, if FIDO wants to proliferate, they may well reach RPs that are not comfortable with passkeys synching on to some library workstation browser (e.g., Bank of America or Social Security Administration). But that is just my personal view, and not germane to the issue at hand - Kantara’s next move. I think the NIST supplement is a concession to the market. I assume this hot discussion is happening in the (UAF) Technical Working Group? Jimmy From: Alexei Czeskis <alexei.czeskis(a)id.me> Sent: Friday, July 5, 2024 1:12 PM To: Jimmy Jung <jimmy.jung(a)slandala.com> Cc: Andrew Hughes <andrewhughes3000(a)gmail.com>; Amanda Gay <amanda(a)kantarainitiative.org>; wg-idassurance(a)kantarainitiative.org; Tanel Suurhans <tanel(a)id.me>; Blake Hall <blake(a)id.me> Subject: Re: [WG-IDAssurance] The CSP SHALL ensure that MF-CS key authenticators DO NOT facilitate the cloning of the secret key onto multiple devices. (RE: Synch-able authenticators) Hi all! Definitely very interested in this conversation. As Blake said, I was a long-time editor for U2F, FIDO2, and WebAuthn -- I love this space! > I had assumed that we had the ability to prevent the generation of synchable passkeys as they are registered with the CSP, but I’m having a hard time seeing that when I look through the protocol. Certain platform vendors have significant reservations about giving RPs this type of control. It's a continuing hot topic of discussion right now in FIDO -- as you can imagine, many RPs want more control. My personal view is that some of the more "consumer" oriented platforms believe that all non-roaming (non-fob-based) passkeys should be sync'able and that everything else should be managed via MDM. Yep, the Backup Eligibility and Backup State flags are there in Authenticator Data (so you are supposed to get it back in the response): * Bit 3: Backup Eligibility<https://w3c.github.io/webauthn/#backup-eligibility> (BE). * 1 means the public key credential source<https://w3c.github.io/webauthn/#public-key-credential-source> is backup eligible<https://w3c.github.io/webauthn/#backup-eligible>. * 0 means the public key credential source<https://w3c.github.io/webauthn/#public-key-credential-source> is not backup eligible<https://w3c.github.io/webauthn/#backup-eligible>. * Bit 4: Backup State<https://w3c.github.io/webauthn/#backup-state> (BS). * 1 means the public key credential source<https://w3c.github.io/webauthn/#public-key-credential-source> is currently backed up<https://w3c.github.io/webauthn/#backed-up>. * 0 means the public key credential source<https://w3c.github.io/webauthn/#public-key-credential-source> is not currently backed up<https://w3c.github.io/webauthn/#backed-up>. The 2023 WWDC<https://developer.apple.com/videos/play/wwdc2023/10263/> talk on enterprise management of Passkeys describes what I think is the closest we currently get to having control over passkey creation and sync'ing beyond what's in the spec. I read the NIST’s 800-63B supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…> as accounting for the inability of agencies to control the sync nature on non-managed devices and instead saying that agencies should lean into MDM: Devices (e.g., mobile phones, laptops, tablets) that generate, store, and sync authenticators containing federal enterprise private keys SHALL be protected by mobile device management software or other device configuration controls that prevent the syncing or sharing of keys to unauthorized devices or sync fabrics Is that how you read it as well? Thanks, -Alexei -- Alexei Czeskis SVP of Engineering alexei.czeskis(a)id.me<mailto:alexei.czeskis@id.me> ID.me<http://www.id.me/> | We're hiring!<http://careers.id.me/> [https://s3.amazonaws.com/idme/logo/idme-logo-signature.png] On Sun, Jun 30, 2024 at 8:01 PM Blake Hall <blake(a)id.me<mailto:blake@id.me>> wrote: Adding Alexei to the discussion. He is one of the FIDO standard authors and might have useful feedback for this group. On Sat, Jun 29, 2024 at 11:00 PM Jimmy Jung <jimmy.jung(a)slandala.com<mailto:jimmy.jung@slandala.com>> wrote: Perhaps Andrew will appreciate me throwing a completely different log on the fire. We briefly discussed what we should do about NISTs synchable authenticator supplement and concluded that it was at least worth waiting got the next 3-4 draft, Perhaps Andrew will appreciate me throwing a completely different log on the fire. We briefly discussed what we should do about NISTs synchable authenticator supplement and concluded that it was at least worth waiting got the next 3-4 draft, to see which way the wind is blowing. That still seems quite reasonable, but I will reiterate that have a few clients that are quite keen to see this leveraged. That being said, I did try to dig onto WebAuthn. I had assumed that we had the ability to prevent the generation of synchable passkeys as they are registered with the CSP, but I’m having a hard time seeing that when I look through the protocol. I see an ability to NOT ACCEPT synched passkeys on the authentication side, but no way to prevent their creation at registration. https://webauthn.guide/#webauthn-api<https://urldefense.com/v3/__https:/webauthn.guide/*webauthn-api__;Iw!!AVdDj…> When the user creates their passkey, the server/CSP can ONLY specify if the credential is “Cross-platform” (i.e., removable; e.g.,yubikey) or “platform” (i.e., SW, tied to the device). But you CAN”T specify if it is backup eligible (i.e., synchable). You CAN ONLY reject that authenticator after it has been created. So, to prevent synchable authenticators, we would have to ONLY ALLOW user to create and use Yubikeys and other removeable HW authenticators. I think that cuts out a large swath of the passkey utility, until synchability is allowed. Jimmy AT REGISTRATION, we can specify the authenticator type. “authenticatorSelection” seems to define the constraints. HOWEVER, I am very uncertain if this is granular enough to exclude cloneable authenticators. authenticatorSelection: This optional object helps relying parties make further restrictions on the type of authenticators allowed for registration. In this example we are indicating we want to register a cross-platform authenticator (like a Yubikey) instead of a platform authenticator like Windows Hello or Touch ID. Read the spec.<https://urldefense.com/v3/__https:/w3c.github.io/webauthn/*dom-publickeycre…> From the specification (https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-auth…<https://urldefense.com/v3/__https:/w3c.github.io/webauthn/*dom-publickeycre…>): “authenticatorSelection, of type AuthenticatorSelectionCriteria The Relying Party (the server/CSP) MAY use this OPTIONAL member to specify capabilities and settings that the authenticator MUST or SHOULD satisfy to participate in the create() operation. See § 5.4.4 Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria). https://w3c.github.io/webauthn/#dictdef-authenticatorselectioncriteria<https://urldefense.com/v3/__https:/w3c.github.io/webauthn/*dictdef-authenti…> authenticatorAttachment, of type DOMString If this member is present, eligible authenticators are filtered to be only those authenticators attached with the specified authenticator attachment modality (see also § 6.2.1 Authenticator Attachment Modality). If this member is absent, then any attachment modality is acceptable. The value SHOULD be a member of AuthenticatorAttachment but client platforms MUST ignore unknown values, treating an unknown value as if the member does not exist. We refer to authenticators that are part of the client device as platform authenticators, while those that are reachable via cross-platform transport protocols are referred to as roaming authenticators. … The primary use case for platform authenticators is to register a particular client device as a "trusted device", so the client device itself acts as a something you have authentication factor for future authentication. This gives the user the convenience benefit of not needing a roaming authenticator for future authentication ceremonies, e.g., the user will not have to dig around in their pocket for their key fob or phone. (https://w3c.github.io/webauthn/#sctn-authenticator-attachment-modality<https://urldefense.com/v3/__https:/w3c.github.io/webauthn/*sctn-authenticat…>) Looking instead at NIST’s 800-63B supplement, where they discuss synchable authenticators. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…<https://urldefense.com/v3/__https:/nvlpubs.nist.gov/nistpubs/SpecialPublica…> In Table 2. WebAuthn Level 3 flags, they identify: Backup Eligibility – which Indicates whether the authenticator can be synced to a different device (i.e., whether the key can be stored elsewhere). AND Backup State – which Indicates whether an authenticator HAS been synced to a different device. NIST specifically says that “Federal agencies MAY use this flag if they intend to establish restric�ons on authen�cators that have been synced to other devices. For public facing applica�ons, agencies SHOULD NOT change the acceptance based on this flag due to user experience concerns. For enterprise decisions, this flag MAY be used to support the restric�on of syncable authen�cators for specific applica�ons.” (excuse the pdf to MS cut and paste) I Don’t know where in the protocol these show up (somewhere in the https://w3c.github.io/webauthn/#authenticator-data<https://urldefense.com/v3/__https:/w3c.github.io/webauthn/*authenticator-da…>). But this may only allow us to prohibit their use, not control if they are created. I would note that NIST only discusses this in terms of a multi-factor authenticator, but I assume they are accepting the premise that passkey is multifactor, even if the “thing-you-have” is your laptop (of public library computer?) _______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance(a)kantarainitiative.org<mailto:wg-idassurance@kantarainitiative.org> To unsubscribe send an email to staff(a)kantarainitiative.org<mailto:staff@kantarainitiative.org> List archives -- https://urldefense.com/v3/__https://mailman.kantarainitiative.org/hyperkitt…<https://urldefense.com/v3/__https:/mailman.kantarainitiative.org/hyperkitty…> ______ Group wiki -- https://urldefense.com/v3/__https://kantara.atlassian.net/wiki/spaces/WG-ID…<https://urldefense.com/v3/__https:/kantara.atlassian.net/wiki/spaces/WG-IDA…> -- Blake Hall Founder & CEO Mobile: 615-293-4702 blake(a)ID.me<mailto:blake@ID.me> ID.me<http://www.id.me/> | We're hiring!<http://careers.id.me/> [https://assets.id.me/logo/idme-logo-signature.png] Veterans Get Secure Single-Sign On for Benefits: http://go.id.me/2iKDM6j President's National Strategy for Trusted Identities in Cyberspace: http://go.id.me/2hZzUKr Building the Trust Graph: http://go.id.me/trust-graph This message (including any attachments) may contain confidential and privileged information belonging to the sender, for a specific individual and purpose, and is legally privileged. If you are not the intended recipient, you should delete this message and any disclosure, copying, forwarding or distribution of this message, or the taking of any action based on it, by you is strictly prohibited.

2 1

IAWG - Join in an hour!
by Amanda Gay 01 Jul '24

01 Jul '24

Dear IAWG Members: Please join us in an hour for our next IAWG meeting. For review-prior to the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-06-27* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 6.27.2024 1. Administration: - Roll call, determination of quorum. - Moved Zaid Al Bukhari to nonvoting due to non-attendance. Quorum is now 5 out of 8 voting participants. - Minutes approval - 2024.06.13 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/517898265/2024-06-13+I…> - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" - Eballot Results <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/485392385/eBallot+-+Pr…> - 8 votes total - 1 ineligible vote (cast by nonmember) = 7 total votes (out of 9) 1. Quorum was achieved 2. Question 1: 6 approve, 1 disapprove 3. Question 2: 5 approve, 1 disapprove (one respondent skipped this question) - Update on next steps - Address of Record update: - Address of Record–(most recent version <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/333414402/Address+of+R…> from February 8th with ARB Comment); response in progress 3. ISO 17065 Discussion Items 4. Group Discussion: - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - Initial discussion to determine if any criteria need changing - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

6 7

Invitation and Agenda - IAWG - June 27, 2024
by Amanda Gay 25 Jun '24

25 Jun '24

Dear IAWG Members: Please join us Thursday, June 27, at 12PM ET for our next IAWG meeting. For review-prior to the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-06-27* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 6.27.2024 1. Administration: - Roll call, determination of quorum. - Moved Zaid Al Bukhari to nonvoting due to non-attendance. Quorum is now 5 out of 8 voting participants. - Minutes approval - 2024.06.13 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/517898265/2024-06-13+I…> - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" - Eballot Results <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/485392385/eBallot+-+Pr…> - 8 votes total - 1 ineligible vote (cast by nonmember) = 7 total votes (out of 9) 1. Quorum was achieved 2. Question 1: 6 approve, 1 disapprove 3. Question 2: 5 approve, 1 disapprove (one respondent skipped this question) - Update on next steps - Address of Record update: - Address of Record–(most recent version <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/333414402/Address+of+R…> from February 8th with ARB Comment); response in progress 3. ISO 17065 Discussion Items 4. Group Discussion: - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - Initial discussion to determine if any criteria need changing - ARB comment on potential bug in 63A#0510 criteria (Lynzie) - Talks about biometric performance requirements which is more about measuring algorithmic performance and not human performance. If using a human, this cannot be done. - #0510 references 63B authentication criteria and authentication doesn’t recognize human verification of the biometric against some portrait or reference biometric. The 63B criteria is only applicable to automated biometric systems. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

2 1

IAWG - Please join us in an hour!
by Amanda Gay 13 Jun '24

13 Jun '24

Dear IAWG Members: Please join us in an hour for our next IAWG meeting today! For review prior to the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-06-13* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 6.13.2024 1. Administration: - Roll call, determination of quorum. - Move Zaid Al Bukhari to nonvoting due to non-attendance. Quorum is now 5 out of 8 voting participants. - Minutes approval - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" - Eballot Results <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/485392385/eBallot+-+Pr…> - 8 votes total - 1 ineligible vote (cast by nonmember) = 7 total votes (out of 9) 1. Quorum was achieved 2. Question 1: 6 approve, 1 disapprove 1. 7 votes 3. Question 2: 5 approve, 1 disapprove 1. 6 votes 2. 1 additional person skipped this question - Address of Record update: - Address of Record–(most recent version <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/333414402/Address+of+R…> from February 8th with ARB Comment); response in progress 3. ISO 17065 Discussion Items 4. Group Discussion: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - Initial discussion to determine if any criteria need changing - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation and Agenda - IAWG - 13 June 2024
by Amanda Gay 13 Jun '24

13 Jun '24

Dear IAWG Members: Please join us Thursday, June 13, at 12PM ET for our next IAWG meeting. For review prior to the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-06-13* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 6.13.2024 1. Administration: - Roll call, determination of quorum. - Move Zaid Al Bukhari to nonvoting due to non-attendance. Quorum is now 5 out of 8 voting participants. - Minutes approval - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" - Eballot Results <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/485392385/eBallot+-+Pr…> - 8 votes total - 1 ineligible vote (cast by nonmember) = 7 total votes (out of 9) 1. Quorum was achieved 2. Question 1: 6 approve, 1 disapprove 1. 7 votes 3. Question 2: 5 approve, 1 disapprove 1. 6 votes 2. 1 additional person skipped this question - Address of Record update: - Address of Record–(most recent version <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/333414402/Address+of+R…> from February 8th with ARB Comment); response in progress 3. ISO 17065 Discussion Items 4. Group Discussion: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - Initial discussion to determine if any criteria need changing - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

2 1

Fwd: Digital ID Rules Q&A Webinar [SEC=OFFICIAL]
by Andrew Hughes 12 Jun '24

12 Jun '24

Hi IAWG - part of our mandate is to review and provide contribution to organizations as they develop ID Assurance schemes and frameworks. Australia has an open consultation directed towards rules and standards supporting their new Digital ID Act 2024. Should IAWG engage in this consultation? andrew. ---------- Forwarded message --------- From: Digital ID Legislation Engagement < DigitalIDLegislationEngagement(a)finance.gov.au> Date: Wed, Jun 12, 2024 at 5:43 AM Subject: Digital ID Rules Q&A Webinar [SEC=OFFICIAL] To: Digital ID Legislation Engagement < DigitalIDLegislationEngagement(a)finance.gov.au> *OFFICIAL* Good afternoon, The Digital ID Bill has passed through Parliament and the new *Digital ID Act 2024* is expected to commence by 1 December 2024. The Department of Finance is finalising the four-week period of public and stakeholder consultations <https://www.digitalidentity.gov.au/have-your-say/2024-digital-id-rules-accr…> regarding updated exposure drafts of the Accreditation and Digital ID Rules (Rules) and the Accreditation Data Standards (Standards), which are expected to be made by the Minister for Finance for commencement of the legislation. The consultation process has been live since *Tuesday, 28 May* and is set to conclude on *Tuesday 25 June 2024* when all written submissions are due. You are welcome to join us on *Wednesday the 19**th** of June 2024 at 9:30am to 11:30am* to ask any questions or provide feedback on the Rules and Standards <https://www.digitalidentity.gov.au/have-your-say/2024-digital-id-rules-accr…> that are out for consultation before the consultation closes. This webinar session will also provide you with some general themes of feedback we have received to date from other digital ID engagements held throughout the consultation period. You can register your interest in attending here: https://events.teams.microsoft.com/event/e7a9b1fe-620e-4c10-8873-ef3558b9cb… If you are interested in making a formal submission, you can also upload a written submission to the Digital ID Consultation Hub <https://www.digitalidentity.gov.au/have-your-say/2024-digital-id-rules-accr…> . We highly value your contributions to the development of this important framework. *Digital ID and Data Policy Division* Governance and Resource Management Group Department of Finance *A: *One Canberra Avenue, Forrest ACT 2603

1 0

Motions re. adoption of proposed changes to 63A#0180
by Richard G. WILSHER (＠Zygma Inc.) 04 Jun '24

04 Jun '24

Todays call (2024-05-16) addressed the technical agenda item: Proposed 63A#0180 Revisions: The net outcome was (I believe, but read the minutes for yourselves) broad support for implementing the proposed changes, the rational for which was as follows (and the form of which is attached): Whereas NIST wrote SP 800-63 rev.3 from the perspective of what a complete set of proofing, authentication, federation requirements might be Kantara has, in response to market demand, accommodated within the IAF Approval scheme both Full and Component Services. Generally speaking the structure and level of granularity of criteria allows a provider of a Component Service to state which criteria apply and which do not. However, I see some restriction being implied by 63A#0180 by reason of the very high perspective of this criterion and its sub-parts. By stating what the end game (i.e. Full Service) proofing evidence requirements are, and accepting that a criterion is either applicable or not, but there being no provision for partially acceptable, this criterion does not allow a Component Service provider to support part of the evidence selection and processing of a complete proofing while allowing its Service Consumer to provide the other evidence forms within the overall proofing. Such a use case might be a provider which provides for proofing a STRONG form of evidence, perhaps because it can resolve the technologically-demanding parts of the end-end process, while it doesnt supporting the processing of any FAIR evidence. In full disclosure, I have a client which deploys such a service, handling a STRONG and a single FAIR form of evidence while the Service Consumer handles the second FAIR form of evidence. [RGW 20240-05-16: and others are known to be providing similar services and wishing to gain Kantara Approval.] In such cases the criteria should be considered not applicable, yet to do so denies the CSP the recognition for the conformant processing of those forms of evidence which it does handle. I am therefore proposing to the IAWG a revision to 63A#0180 which, by breaking down the inherent breadth of this criterion, allows for more definitive applicability to be denoted. Please see the attached proposed changes. Clearly, in the cases of the expanded sub-criteria c) and d), a Full Service would have to indicate applicable for all sub-parts of c) and/or d) respectively, whereas a Component Service could be selective, according to its architecture/design. It should be noted that in the above discussion Component Service is one which meets the definition in the Kantara Glossary KIAF-1050 v2.0 (§3.4), not the erroneous description on the TSL pages. The same applies to the Full Service definition (§3.5). At the close of meeting I was asked to prepare a motion for e-voting, which I present below, though I have seen fit to propose two motions for the purposes of fully-addressing the requirements for proceeding with the acceptance and publication of the proposed changes. I guess the Secretariat will be responsible for setting the voting in progress with a deadline for submissions? Motion #1: That the subject proposed changes to criterion 63A#0180 be approved by the IAWG as presented and that the KI Secretariat publish them without delay as the latest criteria set (KIAF-1430 SP 800-63A SAC-SoCA v5.1). Motion #2: That the subject changes be approved as being Non-material in nature*, and in their publication, be processed accordingly by the KI Secretariat. * The materiality was not discussed but I will offer the argument that since these changes will add clarity, will not impose any additional operational or functional requirements upon CSPs and will not require any changes to existing Approved services, they are NOT of a material nature. Neither will they affect nor influence one jot any spurious attempts to claim Kantara Approval where none exists. Thank you for your efforts to address these changes. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

3 4

IAWG from Identiverse - Join in an hour!
by Amanda Gay 30 May '24

30 May '24

Dear IAWG Members: Please join us in an hour for our next IAWG meeting (live from Vegas!) or head over to Copperleaf 6 if you are attending Identiverse! The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-05-30* - *Time: 9:00 AM PT | 12:00 PM ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT AGENDA 5.30.2024 1. Administration: - Minutes approval - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" 3. ISO 17065 Discussion Items 4. Group Discussion: - IAWG, US Assurance, UK Certification Work in 2024 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

IAWG Meeting Thursday May 30 from Identiverse!!!
by Andrew Hughes 28 May '24

28 May '24

Coming to you live from Las Vegas! We will be running the IAWG call on May 30 9am Pacific from Identiverse. We are hoping to have some guests and interested folks drop in to watch what we do on calls. So - if you are attending Identiverse, come find us in *Copperleaf 6* from 8am onwards - we'll light up the IAWG call at 9am Pacific as usual. For these kinds of open calls, if we have lots of guests then the call will be more explanatory as we talk about topics. If few guests then it should be a regular call. Watch for the agenda. andrew. *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

2 2

Please Join Us In An Hour - IAWG Call
by Amanda Gay 16 May '24

16 May '24

Dear IAWG Members: Please join us in an hour for the next IAWG meeting. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-05-16* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *DRAFT Agenda* 1. Administration: - Minutes approval - 2024.04.04 Meeting Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/440303618/2024-04-04+I…> - 2024.04.25 Meeting MInutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/449249286/2024-04-25+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Adjusted meeting cadence for May: - May 30 - Auditor Introduction - James Keenan - David Nutbrown 3. ISO 17065 Discussion Items 4. Group Discussion: - Proposed 63A#0180 Revisions: 63A#0180 - proposed criteria adjustment <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…> (circulated by email 2024.04.06 by Richard Wilsher, attached for convenience) - In Progress - Proposed supplement to NIST related to evidence requirements - Continued discussion if needed: Proposed S3A edits to enhance transparency (as proposed to ARB) - Jimmy Jung - Assessment Program Question <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…> from 04.26.2024 - Assessment Program Question (attached for convenience) 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation & Agenda for IAWG Call 2024.05.16
by Amanda Gay 14 May '24

14 May '24

Dear IAWG Members: Please join us Thursday, May 16, at 12PM ET for our next IAWG meeting. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-05-16* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *DRAFT Agenda* 1. Administration: - Minutes approval - 2024.04.04 Meeting Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/440303618/2024-04-04+I…> - 2024.04.25 Meeting MInutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/449249286/2024-04-25+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Adjusted meeting cadence for May: - May 30 - Auditor Introduction - James Keenan - David Nutbrown 3. ISO 17065 Discussion Items 4. Group Discussion: - Proposed 63A#0180 Revisions: 63A#0180 - proposed criteria adjustment <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…> (circulated by email 2024.04.06 by Richard Wilsher, attached for convenience) - In Progress - Proposed supplement to NIST related to evidence requirements - Continued discussion if needed: Proposed S3A edits to enhance transparency (as proposed to ARB) - Jimmy Jung - Assessment Program Question <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…> from 04.26.2024 - Assessment Program Question (attached for convenience) 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Fwd: Join Us! Webinar Invite for NCCoE Mobile Driver’s License Community of Interest
by Andrew Hughes 02 May '24

02 May '24

---------- Forwarded message --------- From: NIST Cybersecurity and Privacy Program < csrc.nist(a)service.govdelivery.com> Date: Thu, May 2, 2024 at 5:42 AM Subject: Join Us! Webinar Invite for NCCoE Mobile Driver’s License Community of Interest To: <andrewhughes3000(a)gmail.com> Register Now! [image: NIST] View As Web Page <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVy…> [image: Header] National Cybersecurity Center of Excellence Register Now for the NCCoE Mobile Driver's License Community of Interest Webinar *Date/Time:* Thursday, May 16, 2024 | 10:00 a.m. – 11:00 a.m. ET The NIST National Cybersecurity Center of Excellence (NCCoE) is hosting our second Mobile Driver’s License (mDL) project <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDEsInVy…> update as part of our webinar series. Please join our Project Leads Ryan Galluzzo and Bill Fisher for a short update on the status of the project and next steps. The goal of this project is to work with the community to develop guidance to implement mDLs. After much outreach with the mDL community, the NCCoE proposed three use cases as the focus for this effort. Each use case focuses heavily on the relying party requirements needed to integrate mDLs with business processes and identity technology stacks to realize business value. For this upcoming webinar, we’ve invited guest speakers from the OpenID Foundation <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDIsInVy…> to provide an update on the specification directly related to our cases, including OpenID for Verifiable Presentations (OID4VP) and OpenID for Verifiable Credential Issuance. Guests will also describe how OID4VP can work in tandem with the emerging Browser API specification from the World Wide Web Consortium (W3C) <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDMsInVy…> . At the conclusion of the webinar there will be time for Q&A. We look forward to your participation. *About OpenID Foundation:* Founded in 2007, the OpenID Foundation (OIDF) is a non-profit, open standards body developing identity and security specifications that serve billions of consumers across millions of applications. Register Now <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDQsInVy…> NIST Cybersecurity and Privacy Program Questions/Comments about this notice: mdl-nccoe(a)nist.gov NCCoE Website questions: nccoe(a)nist.gov Connect with us [image: facebook] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDUsInVy…>[image: twitter] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDYsInVy…>[image: youtube] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDcsInVy…>[image: linkedin] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDgsInVy…>[image: flickr] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDksInVy…> Received this email from a friend? Subscribe here <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTAsInVy…> . [image: ITL NIST] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTEsInVy…> Subscriber services: Manage Preferences <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTIsInVy…> | Unsubscribe <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTMsInVy…> | Help <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTQsInVy…> ------------------------------ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTUsInVy…> . Technical questions? Contact inquiries(a)nist.gov. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 [image: GovDelivery logo] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTYsInVy…>

1 0

Reminder-No IAWG today!
by Amanda Gay 02 May '24

02 May '24

Hi all: Just a reminder-no call today. Reach out with any questions/concerns/agenda items! Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

IAWG Cancelled May 2nd
by Amanda Gay 01 May '24

01 May '24

Hi all: The IAWG Weekly Call is canceled this week (May 2nd). We will regroup May 16th. Please reach out with any questions or concerns (or potential agenda items!). Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Canceled event: Identity Assurance Work Group Call @ Thu May 2, 2024 09:00 - 10:00 (PDT) (wg-idassurance@kantarainitiative.org)
by Andrew Hughes 01 May '24

01 May '24

This event has been canceled. Identity Assurance Work Group Call Thursday May 2, 2024 ⋅ 09:00 – 10:00 Pacific Time - Vancouver Location Zoom https://us06web.zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 https://www.google.com/maps/search/Zoom+https:%2F%2Fus06web.zoom.us%2Fj%2F9… Meetings at 12 pm Eastern TimeTime zone converter: www.thetimenow.com/time-zone-converter.phpTopic: IAWGTime: This is a recurring meeting.Join Zoom Meetinghttps://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09Meeting ID: 931 6796 5850Passcode: 884696One tap mobile+13126266799,,93167965850#,,,,*884696# US (Chicago)+16465588656,,93167965850#,,,,*884696# US (New York)Dial by your location +1 312 626 6799 US (Chicago) +1 646 558 8656 US (New York) +1 301 715 8592 US (Washington DC) +1 346 248 7799 US (Houston) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma)Meeting ID: 931 6796 5850Passcode: 884696Find your local number: https://zoom.us/u/aeg9vt8LSr ~~//~~ Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this email because you are an attendee on the event. To stop receiving future updates for this event, decline this event. Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more https://support.google.com/calendar/answer/37135#forwarding

1 0