- WG-IDAssurance - mailman.kantarainitiative.org

Draft criteria revisions: synchable authenticators
by Richard G. WILSHER (＠Zygma Inc.) 08 Oct '24

08 Oct '24

Now that all the rev.4 pd2 fun is over, here's a possible substitute for this week's IAWG meeting: Proposed revisions for synchable authenticator, accounting for 63B Supp1 and rev.4 pd2, as originally drafted by JJ and subsequently interfered-with by myself (my inputs mostly in purple). It is the full set of 63B criteria so you can review in full context or you can filter on col. Q to see only those for which changes or additions are proposed. Spk to you all on Thursday. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

2 1

Join Us In An Hour - IAWG - 03 October 2024
by Amanda Gay 03 Oct '24

03 Oct '24

Dear IAWG Members: Please join us in an hour for our next IAWG meeting. *Voting Members: Please prioritize attendance to this week's call, as the primary objective will be to vote on Kantara's comment submission to NIST.* The proposed agenda and Zoom details are below. Date and Time - Date: Thursday, 2024-10-03 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> DRAFT 10.03.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.09.26 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616497192/2024-09-26+I…> - 2024.09.19 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616661030/2024-09-19+I…> - 2024.09.05 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616661008/2024-09-05+I…> - Kantara Updates - DEIA Survey <https://www.surveymonkey.com/r/3LPP3WL> Open to Responses - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting cadence - weekly. 3. ISO 17065 Discussion Items 4. Group Discussion: - Draft 2 of 800-63-4 <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> - Finalize and vote on comments. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative **Please take a few minutes to complete the third annual DEIA survey <https://www.surveymonkey.com/r/3LPP3WL>!**

1 0

Invitation and Agenda - IAWG - 03 October 2024
by Amanda Gay 30 Sep '24

30 Sep '24

Dear IAWG Members: Please join us Thursday, October 3rd at 12PM ET for our next IAWG meeting. *Voting Members: Please prioritize attendance to this week's call, as the primary objective will be to vote on Kantara's comment submission to NIST.* The proposed agenda and Zoom details are below. Date and Time - Date: Thursday, 2024-10-03 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> DRAFT 10.03.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.09.26 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616497192/2024-09-26+I…> - 2024.09.19 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616661030/2024-09-19+I…> - 2024.09.05 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616661008/2024-09-05+I…> - Kantara Updates - DEIA Survey <https://www.surveymonkey.com/r/3LPP3WL> Open to Responses - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting cadence - weekly. 3. ISO 17065 Discussion Items 4. Group Discussion: - Draft 2 of 800-63-4 <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> - Finalize and vote on comments. 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative **Please take a few minutes to complete the third annual DEIA survey <https://www.surveymonkey.com/r/3LPP3WL>!**

1 0

Join Us In An Hour - IAWG - 26 September 2024
by Amanda Gay 26 Sep '24

26 Sep '24

Hi all: Please join us in an hour for the next IAWG meeting. The proposed agenda and Zoom details are below. Date and Time - Date: Thursday, 2024-09-26 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 09.26.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.09.05 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616661008/2024-09-05+I…> - Kantara Updates - DEIA Survey <https://www.surveymonkey.com/r/3LPP3WL> Open to Responses - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting cadence - weekly. 3. ISO 17065 Discussion Items 4. Group Discussion: - Draft 2 of 800-63-4 <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> - Topics from IAWG leadership 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative **Please take a few minutes to complete the third annual DEIA survey <https://www.surveymonkey.com/r/3LPP3WL>!**

1 0

Invitation and Agenda - IAWG - 26 September 2024
by Amanda Gay 25 Sep '24

25 Sep '24

Hi all: Apologies for the late notice! Please join us tomorrow, September 26, at 12PM ET for our next IAWG meeting. The proposed agenda and Zoom details are below. Date and Time - Date: Thursday, 2024-09-26 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 09.26.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.09.05 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616661008/2024-09-05+I…> - Kantara Updates - DEIA Survey <https://www.surveymonkey.com/r/3LPP3WL> Open to Responses - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting cadence - weekly. 3. ISO 17065 Discussion Items 4. Group Discussion: - Draft 2 of 800-63-4 <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> - Topics from IAWG leadership 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative **Please take a few minutes to complete the third annual DEIA survey <https://www.surveymonkey.com/r/3LPP3WL>!**

1 0

Join Us In An Hour - IAWG - 19 September 2024
by Amanda Gay 19 Sep '24

19 Sep '24

Dear IAWG Members: Please join us in an hour for the next IAWG meeting. The proposed agenda and Zoom details are below. Date and Time - Date: Thursday, 2024-09-19 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> GROUP ACTION: Everyone who is interested in drafting comments to start sending them via the NIST provided comment form <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> (Excel file in the “Documentation Box” on the right-hand side) to Carol. ( carol(a)kantarainitiative.com) DRAFT 09.19.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.09.05 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616661008/2024-09-05+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting cadence - weekly. 3. ISO 17065 Discussion Items 4. Group Discussion: - Draft 2 of 800-63-4 <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> - Topics from IAWG leadership 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

2 1

Invitation and Agenda - IAWG - 19 September 2024
by Amanda Gay 18 Sep '24

18 Sep '24

Dear IAWG Members: Please join us Thursday, September 19 at 12PM ET for our next IAWG meeting. The proposed agenda and Zoom details are below. Date and Time - Date: Thursday, 2024-09-19 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> GROUP ACTION: Everyone who is interested in drafting comments to start sending them via the NIST provided comment form <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> (Excel file in the “Documentation Box” on the right-hand side) to Carol. ( carol(a)kantarainitiative.com) DRAFT 09.19.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.09.05 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616661008/2024-09-05+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting cadence - weekly. 3. ISO 17065 Discussion Items 4. Group Discussion: - Draft 2 of 800-63-4 <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> - Topics from IAWG leadership 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

7 9

Join Us In An Hour - IAWG - 12 September 2024
by Amanda Gay 12 Sep '24

12 Sep '24

Dear IAWG Members: Please join us in an hour for the next IAWG meeting. The proposed agenda and Zoom details are below. Date and Time - Date: Thursday, 2024-09-12 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> GROUP ACTION: Everyone who is interested in drafting comments to start sending them via the NIST provided comment form <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> (Excel file in the “Documentation Box” on the right-hand side) to Carol. ( carol(a)kantarainitiative.com) DRAFT 09.12.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.09.05 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616661008/2024-09-05+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting cadence - weekly. 3. ISO 17065 Discussion Items 4. Group Discussion: - Draft 2 of 800-63-4 <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> - Topics from IAWG leadership 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation and Agenda - IAWG - 12 September 2024
by Amanda Gay 10 Sep '24

10 Sep '24

Dear IAWG Members: Please join us Thursday, September 12, at 12PM ET for our next IAWG meeting. The proposed agenda and Zoom details are below. Date and Time - Date: Thursday, 2024-09-12 - Time: 9:00 PT | 12:00 ET (time zone calculator <https://www.timeanddate.com/worldclock/converter.html>) - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://zoom.us/u/abUx61ivsc> Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> GROUP ACTION: Everyone who is interested in drafting comments to start sending them via the NIST provided comment form <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> (Excel file in the “Documentation Box” on the right-hand side) to Carol. ( carol(a)kantarainitiative.com) DRAFT 09.12.2024 1. Administration: - Roll call, determination of quorum. - Minutes approval - 2024.09.05 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/616661008/2024-09-05+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Meeting cadence - weekly. 3. ISO 17065 Discussion Items 4. Group Discussion: - Draft 2 of 800-63-4 <https://csrc.nist.gov/pubs/sp/800/63/4/2pd> - Topics from IAWG leadership 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

About sync.authrs
by Richard G. WILSHER (＠Zygma Inc.) 05 Sep '24

05 Sep '24

Apologies for this even later contribution to today's meeting, but . On the last call which in which I was a participant I made a statement which I'd like to reiterate, for good reason (imo!): Kantara's purpose is to give assurance to RPs and the user community at large that services which we assess and Approve can be relied upon to the extent of the criteria and assessment processes applied. While we may use NIST's 800-63 series as a very significant technical driver for our criteria, we have in the past exercised judgement in the creation of Kantara's criteria in order to reflect practical and commercial realities. Indeed, my ongoing review of -63A rev.4 convinces me that we need to continue to exercise that judgement! My point therefore was that we should NOT be beholden to NIST's publications but do what is responsible whilst being responsive to our primary customers - CSPs who have services for which they wish to demonstrate conformity and thus Approval. In doing so, we need to take an approach towards NIST's 63B Supplement which provides for recognition of its good parts and to deal with the difficulties which remain, and my understanding thus far is that 63B rev.4 does not materially advance what is in the Supplement (open to education if that is not a valid assertion). An obvious aspect in this is that there are things occurring within the sync.authr fabric over which CSP's have no control and therefore our existing criteria demand a finding of nonconformance where criteria have requirements for CSPs to do certain things which they are simply unable to effect, which would (could?) lead to Approval not being granted. I am also mindful of our objective to keep our criteria 'technology agnostic'. All that said, I'd like to float an idea: Given their increasingly ubiquitous usage, not least by agencies who seem to want to put them to use despite how they may or may not meet NIST's published expectations, and noting that a good number of our CSPs want to deploy such authenticators within the scope of their services, in order to get passkeys / FIDO / syncable authenticators out the door, can we state the following in the guidance section for those criteria where things are taken out of the CSP's hands? Where FIDO-specific authenticators are implemented within a policy/technical/operational fabric wherein: a) the CSP is unable to exercise any control over the authenticator implementation; and b) the CSP has no insight into said implementation; then the 'SoCA' entry for this criterion SHALL be cited as follows: "In scope - Not applicable: Authenticator fabric beyond [service name]'s scope of control - see [KI notice]" Implicitly therefore, Kantara needs to publish a notice to the effect that, given the pressure from service consumers to deploy FIDO-implemented passkeys, and in recognition of the fact that CSPs cannot be held responsible for the implementation of the operational infrastructure, Approval of services which deploy FIDO passkey authenticators DOES NOT extend to the assurability of the FIDO fabric. Furthermore, Kantara should affirm that any other form of authenticators deployed by a specific service DO fall within the scope of any Approval which has been awarded to that service. By publishing this notice and it being referenced from the SoCA (part of the TSL) and perhaps more explicitly also from a specific field in the primary entry for the Approved service, it should be abundantly clear to anyone genuinely interested in a service, as either a consumer (RP) or as a subject, that there's stuff we cannot control but everybody wants. This also avoids writing a non-agnostic criterion (or two) which directly refers to FIDO - it is the SoCA which delivers the technology-specific notice. Jimmy has already provided some draft criteria in response to the Supplement and he and I have colluded to bring those along a bit further BUT . they can only go so far and serve no purpose unless we address the elephant in the room. I might add, I see this as a short-term solution, the longer-term goal being to encourage the establishment of a means to evaluate and affirm the correctness of FIDO implementations. Not KI's job, imo. Someone else's, but we should offer encouragement. Food for thought, along with the grist for the mill? Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

2 1