- WG-IDAssurance - mailman.kantarainitiative.org

Charter review - line numbered reference version
by Andrew Hughes 16 Nov '23

16 Nov '23

For our upcoming IAWG Charter review discussions, I have created word and pdf versions of the current charter. NB: The PDF contains the authoritative line numbering - use those numbers when referring to specific text. This page will host the materials: https://kantara.atlassian.net/wiki/spaces/IAWG/pages/290914314/2024+Charter… *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0

Invitation & Agenda for IAWG Call 2023-11-16
by Amanda Gay 14 Nov '23

14 Nov '23

Dear IAWG Members: Please join us at *12pm *US Eastern Time, November 16, for our next IAWG meeting. If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey.* The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-11-16* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> Proposed Agenda 11.16.2023 1. Administration: - Roll call - Minutes approval - 2023-10-26 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/282394645> - 2023-11-09 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/287801440/2023-11-09+D…> (will be complete before Wednesday AM) - Kantara Updates - Assurance Updates 2. Discussion: - Kantara Initiative Comments Preparation for NIST’s IImplementation of National Standards Strategy for Critical and Emerging Technology (Denny Prvu) - Continued Address of Record Discussion - Charter and restructuring 3. Any Other Business Best, -Amanda -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Address of Record
by Jimmy Jung 09 Nov '23

09 Nov '23

Folks, Under the heading of other-topics/open-discussion/items-we-may-not-get-to, I wanted to send the following regarding the address of record criteria in 63A. Below please find an inclusive extract of criteria regarding "address of record." On several occasions, systems I have worked with have run into complications with "address of record," and I had hoped to explore what is trying to accomplish by this criteria, as well as gain some context for reviewing the criteria as it evolves in 63 rev 4. SP 800-63 formally defines "Address of Record" as "the validated and verified location (physical or digital) where an individual can receive communications using approved mechanisms." I would summarize 63 and the criteria for address of record as follows: * You must validate the address of record with an issuing or authoritative source using information taken from the valid id evidence. (address of record can't be self-asserted) * 63A specifically calls out postal, mobile-phone (SMS), landline or email as potential addresses of record (with a preference for Postal) * For Unsupervised proofing you must send an enrollment code to the confirmed address of record, which the Applicant must return. (for Supervised you may) * If the enrollment code is also an authenticator it must be reset * "An enrollment code allows the CSP to confirm that the applicant controls an address of record, as well as offering the applicant the ability to reestablish binding to their enrollment record." * There are various limitations in the format, validity and attempts allowed for enrollment codes. * The enrollment code and notification of proofing must be sent to different addresses of record. My confusion stems from the difficulty, if not inability to validate the email or quite frankly postal as an address of record with an issuing or authoritative source. Citing my favorite examples, google will not validate a gmail address and no one "issues" a postal address. * We identify an applicant by comparing them to the evidence and validating and verifying the evidence. * As described by 63, we can use an enrollment code to confirm that the same applicant controls the address of record and confirm that the applicant can "receive communications" at that address. * But given that email (not postal) is the likely preferred address for most systems and applicants, especially unsupervised systems; validating an email address with an issuing or authoritative source is very difficult. * and I am unsure of the utility - if the applicant controls the address and we have identified the applicant, how useful is it to validate an address of record? * Also, if supervised doesn't use an enrollment code to confirm control, then we would be sending notifications to an unvalidated address. * And, if validating an address of record is so difficult; isn't it that much more difficult to have two; so that you may send the "enrollment code and notification of proofing to different addresses of record". (often the different addresses are the web-site/application performing the identification and an email address) * And just for fun, can you send an enrollment code to an address of record, if an address of record isn't an address of record until the applicant returns the enrollment code? Thanks Jimmy [cid:image001.jpg@01DA0E0A.36B58AE0] Jimmy Jung www.Slandala.com<http://www.slandala.com/> 703 851 6813 § (..) Clause title Requirement 63A tag index KI_criterion (text in red in this column are revisions this version) 2 3 4.4.1.6 (IAL2) 1 Address Confirmation Valid records to confirm address SHALL be issuing source(s) or authoritative source(s). n/a 4.4.1.6 (IAL2) 2 Address Confirmation The CSP SHALL confirm address of record. The CSP SHOULD confirm address of record through validation of the address contained on any supplied, valid piece of identity evidence. The CSP MAY confirm address of record by validating information supplied by the applicant that is not contained on any supplied piece of identity evidence. 63A#0270 The CSP SHALL validate and confirm the Applicant's address of record by relying only upon issuing source(s) or authoritative source(s). * * 4.4.1.6 (IAL2) 3 Address Confirmation Self-asserted address data that has not been confirmed in records SHALL NOT be used for confirmation. 63A#0280 The CSP SHALL NOT accept un-validated self-asserted addresses. * * 4.4.1.6 (IAL2) 4 Address Confirmation If CSP performs in-person proofing (physical or supervised remote): 63A#0290 If the CSP performs Supervised (In-person or Remote) proofing it SHALL document the maximum validities it allows for enrollment codes and only issue codes that meet that limitation, which SHALL NOT exceed 7 days. * * 4.4.1.6 (IAL2) 4 Address Confirmation The CSP SHOULD send a notification of proofing to a confirmed address of record. n/a 4.4.1.6 (IAL2) 4 Address Confirmation The CSP MAY provide an enrollment code directly to the subscriber if binding to an authenticator will occur at a later time. n/a 4.4.1.6 (IAL2) 4 Address Confirmation The enrollment code SHALL be valid for a maximum of 7 days. n/a See 63A#0290 4.4.1.6 (IAL2) 5 Address Confirmation If the CSP performs remote proofing (unsupervised): 63A#0300 If the CSP performs Unsupervised proofing it SHALL: * 4.4.1.6 (IAL2) 5 Address Confirmation The CSP SHALL send an enrollment code to a confirmed address of record for the applicant. 63A#0300 a) send an enrollment code to a confirmed address of record for the Applicant; * 4.4.1.6 (IAL2) 5 Address Confirmation The applicant SHALL present a valid enrollment code to complete the identity proofing process. 63A#0300 b) require the Applicant to present a valid enrollment code to complete the identity proofing process; * 4.4.1.6 (IAL2) 5 Address Confirmation The CSP SHOULD send the enrollment code to the postal address that has been validated in records. The CSP MAY send the enrollment code to a mobile telephone (SMS or voice), landline telephone, or email if it has been validated in records. n/a 4.4.1.6 (IAL2) 5 Address Confirmation If the enrollment code is also intended to be an authentication factor, it SHALL be reset upon first use. 63A#0300 c) If the enrollment code is also intended to be an authentication factor, reset the code upon first use; * 4.4.1.6 (IAL2) 5 Address Confirmation Enrollment codes SHALL have the following maximum validities: 63A#0300 d) document the maximum validities it allows for enrollment codes and only issue codes that meet the following limitations: * 4.4.1.6 (IAL2) 5 Address Confirmation 10 days when sent to a postal address of record within the contiguous United States; 63A#0300 d) i) 10 days, when sent to a postal address of record within the contiguous United States; * 4.4.1.6 (IAL2) 5 Address Confirmation 30 days when sent to a postal address of record outside the contiguous United States; 63A#0300 d) ii) 30 days, when sent to a postal address of record outside the contiguous United States; * 4.4.1.6 (IAL2) 5 Address Confirmation 10 minutes when sent to a telephone of record (SMS or voice); 63A#0300 d) iii) 10 minutes, when sent to a telephone number of record (SMS or voice); * 4.4.1.6 (IAL2) 5 Address Confirmation 24 hours when sent to an email address of record. 63A#0300 d) iv) 24 hours, when sent to an email address of record. * 4.4.1.6 (IAL2) 5 Address Confirmation The CSP SHALL ensure the enrollment code and notification of proofing are sent to different addresses of record. For example, if the CSP sends an enrollment code to a phone number validated in records, a proofing notification will be sent to the postal address validated in records or obtained from validated and verified evidence, such as a driver's license. 63A#0300 e) ensure that the enrollment code and notification of proofing are sent to different addresses of record. * 4.4.1.6 (IAL2) Note Address Confirmation Postal address is the preferred method of sending any communications, including enrollment code and notifications, with the applicant. However, these guidelines support any confirmed address of record, whether physical or digital. n/a 4.5.6 (IAL3) 1 Address Confirmation The CSP SHALL confirm address of record. The CSP SHOULD confirm address of record through validation of the address contained on any supplied, valid piece of identity evidence. The CSP MAY confirm address of record by validating information supplied by the applicant, not contained on any supplied, valid piece of identity evidence. 63A#0390 The CSP SHALL confirm the Applicant's address of record using either: * 4.5.6 (IAL3) Address Confirmation 63A#0390 a) only information taken from any piece of valid identity evidence; or * 4.5.6 (IAL3) Address Confirmation 63A#0390 b) for information values which might reasonably be amended from time-to-time, information substituted by the Applicant which SHALL be validated with the issuing source of the information. * 4.5.6 (IAL3) 3 Address Confirmation A notification of proofing SHALL be sent to the confirmed address of record. 63A#0400 The CSP SHALL send a notification of proofing outcome to the confirmed address of record. * 4.6 Enrollment Code An enrollment code allows the CSP to confirm that the applicant controls an address of record, as well as offering the applicant the ability to reestablish binding to their enrollment record. n/a 4.6 Enrollment Code Binding NEED NOT be completed in the same session as the original identity proofing transaction. n/a 4.6 Enrollment Code An enrollment code SHALL be comprised of one of the following: 63A#0450 The CSP SHALL only issue enrollment codes that are, minimally, a random six character alphanumeric sequence or other value of equivalent entropy, represented either as: * * 4.6 1 Enrollment Code Minimally, a random six character alphanumeric or equivalent entropy. For example, a code generated using an approved random number generator or a serial number for a physical hardware authenticator. 63A#0450 a) a human-readable text string; OR * * 4.6 2 Enrollment Code A machine-readable optical label, such as a QR Code, that contains data of similar or higher entropy as a random six character alphanumeric. 63A#0450 b) A machine-readable optical label. * *

4 3

Join Us in 1 Hour - IAWG Call - 2023-11-09
by Amanda Gay 09 Nov '23

09 Nov '23

Dear IAWG Members: Please join us in one hour today, November 9, for our next IAWG meeting. If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey.* The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-11-09* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here <https://kantara.atlassian.net/wiki/spaces/IAWG/overview>. Proposed Agenda 11.9.2023 1. Administration: - Roll call - Minutes approval - 2023-10-26 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/282394645/2023-10-26+D…> - Kantara Updates - Assurance Updates 2. Discussion: - Address of Record Inquiry <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/2023+Meeting…> (last topic on 2023 Meeting Materials page) - Charter and restructuring 3. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation & Agenda for IAWG Call 2023-11-09
by Amanda Gay 07 Nov '23

07 Nov '23

Dear IAWG Members: Please join us at *12pm *US Eastern Time today, November 9, for our next IAWG meeting. If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey.* The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-11-09* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here <https://kantara.atlassian.net/wiki/spaces/IAWG/overview>. Proposed Agenda 11.9.2023 1. Administration: - Roll call - Minutes approval - 2023-10-26 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/282394645/2023-10-26+D…> - Kantara Updates - Assurance Updates 2. Discussion: - Address of Record Inquiry <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/2023+Meeting…> (last topic on 2023 Meeting Materials page) - Charter and restructuring 3. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

IAWG Meeting 11.2.2023-CANCELED
by Amanda Gay 01 Nov '23

01 Nov '23

Hi all: We will cancel this week's IAWG meeting and plan to resume next week, on November 9th. Please let me know any questions or concerns! Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

EU on remote ID
by mhaeaking＠freeuk.com 26 Oct '23

26 Oct '23

For Info. This identifies quite a few loose ends and highlights sundry very confusing items, such as what high doesn't mean: https://www.biometricupdate.com/202310/eidas-update-sets-up-harmonized-remo…

1 0

Invitation & Agenda for IAWG Call 2023-10-26
by Amanda Gay 24 Oct '23

24 Oct '23

Dear IAWG Members: Please join us at *12pm *US Eastern Time today, October 26, for our next IAWG meeting. If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey.* The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-10-26* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> Proposed Agenda 10.26.2023 1. Administration: - Roll call - Minutes approval - 2023-10-05 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/269418526/2023-10-05+D…> - 2023-09-07 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/261390337/2023-09-07+D…> - 2023-09-21 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/264339457/2023-9-21+Me…> - 2023-9-28 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/267452417/2023-9-28+DR…> - Kantara Updates - Assurance Updates 2. Discussion: - CO_SAC Updates: Richard’s updated analysis (an additional note on CO#0050), linked here <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/2023+Meeting…> - We would still be requiring this point, but it makes more sense to locate it in #0090. Jimmy supports this point. - Follow up discussion to Richard’s email on September 26th, 2023 regarding 63B #1900: - Sub-clause D was eliminated on an earlier IAWG call. - After further consideration, Richard now recommends a minor tweak to the main clause and the retainment of sub-clause D, as the clause actually requires the CSP to respond to a legal instrument requiring that they revoke, so it should be retained. Changes as noted below (purple text signifying minor differences in main clause): 1. The CSP SHALL revoke promptly the binding of authenticators to the Subject's online identity and, unless prohibited by any legal instrument, and give notice of such to the Subject, when any one of the following occurs: 1. the Subject's online identity ceases to exist; OR 2. the Subject requests revocation; OR 3. the CSP determines that the Subject no longer meets its eligibility requirements; OR 4. the CSP is obligated to do so in response to a legal instrument. - Charter and restructuring 3. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Join Us in 1 Hour - IAWG Call - 2023-10-19
by Amanda Gay 19 Oct '23

19 Oct '23

Dear IAWG Members: Please join us at *12pm *US Eastern Time today, October 19, for our next IAWG meeting. If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey.* The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-10-19* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> Proposed Agenda 10.19.2023 1. Administration: - Roll call - Minutes approval - 2023-10-05 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/269418526/2023-10-05+D…> - 2023-09-07 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/261390337/2023-09-07+D…> - 2023-09-21 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/264339457/2023-9-21+Me…> - 2023-9-28 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/267452417/2023-9-28+DR…> - Kantara Updates - Assurance Updates 2. Discussion: - CO_SAC Updates: Richard’s updated analysis (an additional note on CO#0050), linked here <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/2023+Meeting…> - We would still be requiring this point, but it makes more sense to locate it in #0090. Jimmy supports this point. - Follow up discussion to Richard’s email on September 26th, 2023 regarding 63B #1900: - Sub-clause D was eliminated on an earlier IAWG call. - After further consideration, Richard now recommends a minor tweak to the main clause and the retainment of sub-clause D, as the clause actually requires the CSP to respond to a legal instrument requiring that they revoke, so it should be retained. Changes as noted below (purple text signifying minor differences in main clause): 1. The CSP SHALL revoke promptly the binding of authenticators to the Subject's online identity and, unless prohibited by any legal instrument, and give notice of such to the Subject, when any one of the following occurs: 1. the Subject's online identity ceases to exist; OR 2. the Subject requests revocation; OR 3. the CSP determines that the Subject no longer meets its eligibility requirements; OR 4. the CSP is obligated to do so in response to a legal instrument. - Charter and restructuring 3. Any Other Business -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

2 2

Today's meeting cancelled - apologies for last minute notification
by Andrew Hughes 19 Oct '23

19 Oct '23

Hi - I'm cancelling today's call - got news of a sudden serious illness this morning of someone close to the team - let's resume next week. *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0