- WG-IDAssurance - mailman.kantarainitiative.org

Invitation and Agenda - IAWG - 13 June 2024
by Amanda Gay 13 Jun '24

13 Jun '24

Dear IAWG Members: Please join us Thursday, June 13, at 12PM ET for our next IAWG meeting. For review prior to the call: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-06-13* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT 6.13.2024 1. Administration: - Roll call, determination of quorum. - Move Zaid Al Bukhari to nonvoting due to non-attendance. Quorum is now 5 out of 8 voting participants. - Minutes approval - 2024.05.30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/498270217/2024-05-30+I…> - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" - Eballot Results <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/485392385/eBallot+-+Pr…> - 8 votes total - 1 ineligible vote (cast by nonmember) = 7 total votes (out of 9) 1. Quorum was achieved 2. Question 1: 6 approve, 1 disapprove 1. 7 votes 3. Question 2: 5 approve, 1 disapprove 1. 6 votes 2. 1 additional person skipped this question - Address of Record update: - Address of Record–(most recent version <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/333414402/Address+of+R…> from February 8th with ARB Comment); response in progress 3. ISO 17065 Discussion Items 4. Group Discussion: - NIST's 63B Supplement <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63Bsup1.p…>for Syncable Authenticators - Initial discussion to determine if any criteria need changing - Potential Criteria Updates - Discussion: re: 63B#1340, 63A#0130 b) (Jimmy Jung’s email <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…>on May 28th), and 63B#0120. Led by Jimmy. 5. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

2 1

Fwd: Digital ID Rules Q&A Webinar [SEC=OFFICIAL]
by Andrew Hughes 12 Jun '24

12 Jun '24

Hi IAWG - part of our mandate is to review and provide contribution to organizations as they develop ID Assurance schemes and frameworks. Australia has an open consultation directed towards rules and standards supporting their new Digital ID Act 2024. Should IAWG engage in this consultation? andrew. ---------- Forwarded message --------- From: Digital ID Legislation Engagement < DigitalIDLegislationEngagement(a)finance.gov.au> Date: Wed, Jun 12, 2024 at 5:43 AM Subject: Digital ID Rules Q&A Webinar [SEC=OFFICIAL] To: Digital ID Legislation Engagement < DigitalIDLegislationEngagement(a)finance.gov.au> *OFFICIAL* Good afternoon, The Digital ID Bill has passed through Parliament and the new *Digital ID Act 2024* is expected to commence by 1 December 2024. The Department of Finance is finalising the four-week period of public and stakeholder consultations <https://www.digitalidentity.gov.au/have-your-say/2024-digital-id-rules-accr…> regarding updated exposure drafts of the Accreditation and Digital ID Rules (Rules) and the Accreditation Data Standards (Standards), which are expected to be made by the Minister for Finance for commencement of the legislation. The consultation process has been live since *Tuesday, 28 May* and is set to conclude on *Tuesday 25 June 2024* when all written submissions are due. You are welcome to join us on *Wednesday the 19**th** of June 2024 at 9:30am to 11:30am* to ask any questions or provide feedback on the Rules and Standards <https://www.digitalidentity.gov.au/have-your-say/2024-digital-id-rules-accr…> that are out for consultation before the consultation closes. This webinar session will also provide you with some general themes of feedback we have received to date from other digital ID engagements held throughout the consultation period. You can register your interest in attending here: https://events.teams.microsoft.com/event/e7a9b1fe-620e-4c10-8873-ef3558b9cb… If you are interested in making a formal submission, you can also upload a written submission to the Digital ID Consultation Hub <https://www.digitalidentity.gov.au/have-your-say/2024-digital-id-rules-accr…> . We highly value your contributions to the development of this important framework. *Digital ID and Data Policy Division* Governance and Resource Management Group Department of Finance *A: *One Canberra Avenue, Forrest ACT 2603

1 0

Motions re. adoption of proposed changes to 63A#0180
by Richard G. WILSHER (＠Zygma Inc.) 04 Jun '24

04 Jun '24

Todays call (2024-05-16) addressed the technical agenda item: Proposed 63A#0180 Revisions: The net outcome was (I believe, but read the minutes for yourselves) broad support for implementing the proposed changes, the rational for which was as follows (and the form of which is attached): Whereas NIST wrote SP 800-63 rev.3 from the perspective of what a complete set of proofing, authentication, federation requirements might be Kantara has, in response to market demand, accommodated within the IAF Approval scheme both Full and Component Services. Generally speaking the structure and level of granularity of criteria allows a provider of a Component Service to state which criteria apply and which do not. However, I see some restriction being implied by 63A#0180 by reason of the very high perspective of this criterion and its sub-parts. By stating what the end game (i.e. Full Service) proofing evidence requirements are, and accepting that a criterion is either applicable or not, but there being no provision for partially acceptable, this criterion does not allow a Component Service provider to support part of the evidence selection and processing of a complete proofing while allowing its Service Consumer to provide the other evidence forms within the overall proofing. Such a use case might be a provider which provides for proofing a STRONG form of evidence, perhaps because it can resolve the technologically-demanding parts of the end-end process, while it doesnt supporting the processing of any FAIR evidence. In full disclosure, I have a client which deploys such a service, handling a STRONG and a single FAIR form of evidence while the Service Consumer handles the second FAIR form of evidence. [RGW 20240-05-16: and others are known to be providing similar services and wishing to gain Kantara Approval.] In such cases the criteria should be considered not applicable, yet to do so denies the CSP the recognition for the conformant processing of those forms of evidence which it does handle. I am therefore proposing to the IAWG a revision to 63A#0180 which, by breaking down the inherent breadth of this criterion, allows for more definitive applicability to be denoted. Please see the attached proposed changes. Clearly, in the cases of the expanded sub-criteria c) and d), a Full Service would have to indicate applicable for all sub-parts of c) and/or d) respectively, whereas a Component Service could be selective, according to its architecture/design. It should be noted that in the above discussion Component Service is one which meets the definition in the Kantara Glossary KIAF-1050 v2.0 (§3.4), not the erroneous description on the TSL pages. The same applies to the Full Service definition (§3.5). At the close of meeting I was asked to prepare a motion for e-voting, which I present below, though I have seen fit to propose two motions for the purposes of fully-addressing the requirements for proceeding with the acceptance and publication of the proposed changes. I guess the Secretariat will be responsible for setting the voting in progress with a deadline for submissions? Motion #1: That the subject proposed changes to criterion 63A#0180 be approved by the IAWG as presented and that the KI Secretariat publish them without delay as the latest criteria set (KIAF-1430 SP 800-63A SAC-SoCA v5.1). Motion #2: That the subject changes be approved as being Non-material in nature*, and in their publication, be processed accordingly by the KI Secretariat. * The materiality was not discussed but I will offer the argument that since these changes will add clarity, will not impose any additional operational or functional requirements upon CSPs and will not require any changes to existing Approved services, they are NOT of a material nature. Neither will they affect nor influence one jot any spurious attempts to claim Kantara Approval where none exists. Thank you for your efforts to address these changes. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

3 4

IAWG from Identiverse - Join in an hour!
by Amanda Gay 30 May '24

30 May '24

Dear IAWG Members: Please join us in an hour for our next IAWG meeting (live from Vegas!) or head over to Copperleaf 6 if you are attending Identiverse! The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-05-30* - *Time: 9:00 AM PT | 12:00 PM ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> DRAFT AGENDA 5.30.2024 1. Administration: - Minutes approval - 2024.05.16 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/473137153/2024-05-16+I…> 2. IAWG Actions/Reminders/Updates: - Proposed Meeting Cadence for June/Extended Summer - June 13, June 27 - July 11, July 25 - August 8, August 22 - Informal poll from LC to determine overall use of AI in report/content generation (goal is to decide whether a policy is needed) - "Have you used Chat-gpt or other AI tools to help generate or contribute to any group content or reports?" 3. ISO 17065 Discussion Items 4. Group Discussion: - IAWG, US Assurance, UK Certification Work in 2024 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

IAWG Meeting Thursday May 30 from Identiverse!!!
by Andrew Hughes 28 May '24

28 May '24

Coming to you live from Las Vegas! We will be running the IAWG call on May 30 9am Pacific from Identiverse. We are hoping to have some guests and interested folks drop in to watch what we do on calls. So - if you are attending Identiverse, come find us in *Copperleaf 6* from 8am onwards - we'll light up the IAWG call at 9am Pacific as usual. For these kinds of open calls, if we have lots of guests then the call will be more explanatory as we talk about topics. If few guests then it should be a regular call. Watch for the agenda. andrew. *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

2 2

Please Join Us In An Hour - IAWG Call
by Amanda Gay 16 May '24

16 May '24

Dear IAWG Members: Please join us in an hour for the next IAWG meeting. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-05-16* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *DRAFT Agenda* 1. Administration: - Minutes approval - 2024.04.04 Meeting Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/440303618/2024-04-04+I…> - 2024.04.25 Meeting MInutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/449249286/2024-04-25+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Adjusted meeting cadence for May: - May 30 - Auditor Introduction - James Keenan - David Nutbrown 3. ISO 17065 Discussion Items 4. Group Discussion: - Proposed 63A#0180 Revisions: 63A#0180 - proposed criteria adjustment <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…> (circulated by email 2024.04.06 by Richard Wilsher, attached for convenience) - In Progress - Proposed supplement to NIST related to evidence requirements - Continued discussion if needed: Proposed S3A edits to enhance transparency (as proposed to ARB) - Jimmy Jung - Assessment Program Question <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…> from 04.26.2024 - Assessment Program Question (attached for convenience) 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation & Agenda for IAWG Call 2024.05.16
by Amanda Gay 14 May '24

14 May '24

Dear IAWG Members: Please join us Thursday, May 16, at 12PM ET for our next IAWG meeting. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2024-05-16* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *DRAFT Agenda* 1. Administration: - Minutes approval - 2024.04.04 Meeting Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/440303618/2024-04-04+I…> - 2024.04.25 Meeting MInutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/449249286/2024-04-25+I…> - Kantara Updates - Assurance Updates 2. IAWG Actions/Reminders/Updates: - Adjusted meeting cadence for May: - May 30 - Auditor Introduction - James Keenan - David Nutbrown 3. ISO 17065 Discussion Items 4. Group Discussion: - Proposed 63A#0180 Revisions: 63A#0180 - proposed criteria adjustment <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…> (circulated by email 2024.04.06 by Richard Wilsher, attached for convenience) - In Progress - Proposed supplement to NIST related to evidence requirements - Continued discussion if needed: Proposed S3A edits to enhance transparency (as proposed to ARB) - Jimmy Jung - Assessment Program Question <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/353632257/2024+Meeting…> from 04.26.2024 - Assessment Program Question (attached for convenience) 5. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Fwd: Join Us! Webinar Invite for NCCoE Mobile Driver’s License Community of Interest
by Andrew Hughes 02 May '24

02 May '24

---------- Forwarded message --------- From: NIST Cybersecurity and Privacy Program < csrc.nist(a)service.govdelivery.com> Date: Thu, May 2, 2024 at 5:42 AM Subject: Join Us! Webinar Invite for NCCoE Mobile Driver’s License Community of Interest To: <andrewhughes3000(a)gmail.com> Register Now! [image: NIST] View As Web Page <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVy…> [image: Header] National Cybersecurity Center of Excellence Register Now for the NCCoE Mobile Driver's License Community of Interest Webinar *Date/Time:* Thursday, May 16, 2024 | 10:00 a.m. – 11:00 a.m. ET The NIST National Cybersecurity Center of Excellence (NCCoE) is hosting our second Mobile Driver’s License (mDL) project <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDEsInVy…> update as part of our webinar series. Please join our Project Leads Ryan Galluzzo and Bill Fisher for a short update on the status of the project and next steps. The goal of this project is to work with the community to develop guidance to implement mDLs. After much outreach with the mDL community, the NCCoE proposed three use cases as the focus for this effort. Each use case focuses heavily on the relying party requirements needed to integrate mDLs with business processes and identity technology stacks to realize business value. For this upcoming webinar, we’ve invited guest speakers from the OpenID Foundation <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDIsInVy…> to provide an update on the specification directly related to our cases, including OpenID for Verifiable Presentations (OID4VP) and OpenID for Verifiable Credential Issuance. Guests will also describe how OID4VP can work in tandem with the emerging Browser API specification from the World Wide Web Consortium (W3C) <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDMsInVy…> . At the conclusion of the webinar there will be time for Q&A. We look forward to your participation. *About OpenID Foundation:* Founded in 2007, the OpenID Foundation (OIDF) is a non-profit, open standards body developing identity and security specifications that serve billions of consumers across millions of applications. Register Now <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDQsInVy…> NIST Cybersecurity and Privacy Program Questions/Comments about this notice: mdl-nccoe(a)nist.gov NCCoE Website questions: nccoe(a)nist.gov Connect with us [image: facebook] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDUsInVy…>[image: twitter] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDYsInVy…>[image: youtube] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDcsInVy…>[image: linkedin] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDgsInVy…>[image: flickr] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDksInVy…> Received this email from a friend? Subscribe here <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTAsInVy…> . [image: ITL NIST] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTEsInVy…> Subscriber services: Manage Preferences <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTIsInVy…> | Unsubscribe <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTMsInVy…> | Help <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTQsInVy…> ------------------------------ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTUsInVy…> . Technical questions? Contact inquiries(a)nist.gov. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 [image: GovDelivery logo] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTYsInVy…>

1 0

Reminder-No IAWG today!
by Amanda Gay 02 May '24

02 May '24

Hi all: Just a reminder-no call today. Reach out with any questions/concerns/agenda items! Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

IAWG Cancelled May 2nd
by Amanda Gay 01 May '24

01 May '24

Hi all: The IAWG Weekly Call is canceled this week (May 2nd). We will regroup May 16th. Please reach out with any questions or concerns (or potential agenda items!). Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0