- WG-IDAssurance - mailman.kantarainitiative.org

Invitation & Agenda for IAWG Call 2023-12-14 IAWG Work Group
by Amanda Gay 12 Dec '23

12 Dec '23

Dear IAWG Members: Please join us at *12pm *US Eastern Time, December 14, for our next IAWG meeting. ***Reminder*** *Group Action (November 30):* IAWG members are to review the charter and provide comments to clean and clarify language. Guidelines: - Refer to the numbering in the PDF, but make comments in the Word doc. - If something is confusing, please comment. - Don’t assume things are there for a purpose. - Note any omissions for later inclusion. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-12-14* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> Proposed Agenda 12.14.2023 1. Administration: - Roll call - Minutes approval - 2023-11-30 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/300351535/2023-11-30+D…> - Kantara Updates - Assurance Updates 2. Discussion: - Discuss comments and changes: 2024 Charter Review Process <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/290914314/2024+Charter…> - Set a schedule for completion of the 2024 Charter. - Address of Record Position (if available) - Updates regarding NIST Comment Period (rev. 4): https://www.nist.gov/blogs/cybersecurity-insights/note-progressnists-digita… 3. Any Other Business Best, -Amanda -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

NIST blog on 800-63 flight path
by Andrew Hughes 12 Dec '23

12 Dec '23

Just out today: https://www.nist.gov/blogs/cybersecurity-insights/note-progressnists-digita… Our goal remains to have the next version of each volume out by the Spring > of 2024. With our gratitude for the robust and substantive engagement we > received during the comment period, at this time we would like to announce > that all four volumes of Special Publication 800-63-4 will have a second > public comment period, which will last at least 45 days. *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0

Reminder-No IAWG meeting 12.7.2023
by Amanda Gay 04 Dec '23

04 Dec '23

Hi all: A quick reminder that we will not be meeting this week on 12.7.2023. We will regroup on 12.14.2023 with the charter discussion (2024 Charter Review Process <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/290914314/2024+Charter…> ). Reach out with any questions! Best, -Amanda -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Join Us in 1 Hour - IAWG Call - 2023-11-30
by Amanda Gay 30 Nov '23

30 Nov '23

Dear IAWG Members: Please join us in an hour today, November 30, for our next IAWG meeting. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2023-11-30* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> Proposed Agenda 11.30.2023 1. Administration: - Roll call - Minutes approval - 2023-10-26 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/282394645> - 2023-11-09 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/287801440/2023-11-09+D…> - 2023-11-16-Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/291405832/2023-11-16+D…> - Kantara Updates - Assurance Updates - Kantara Initiative Comments Preparation for NIST’s Implementation of National Standards Strategy for Critical and Emerging Technology - Denny Prvu has registered an intent to submit on behalf of Kantara Initiative and will be sending comments for review and feedback to the listserv. 2. Discussion: - Continued Address of Record Discussion - Charter and restructuring 3. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation & Agenda for IAWG Call 2023-11-30
by Amanda Gay 28 Nov '23

28 Nov '23

Dear IAWG Members: Please join us at *12pm *US Eastern Time today, November 30, for our next IAWG meeting. If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey.* The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-11-30* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> Proposed Agenda 11.30.2023 1. Administration: - Roll call - Minutes approval - 2023-10-26 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/282394645> - 2023-11-09 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/287801440/2023-11-09+D…> - 2023-11-16-Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/291405832/2023-11-16+D…> - Kantara Updates - Assurance Updates 2. Discussion: - Kantara Initiative Comments Preparation for NIST’s Implementation of National Standards Strategy for Critical and Emerging Technology (Denny Prvu) - Continued Address of Record Discussion - Charter and restructuring 3. Any Other Business Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Week of 11.20.2023-NO IAWG MEETING
by Amanda Gay 20 Nov '23

20 Nov '23

Hi all: Just a reminder that as it is Thanksgiving in the US, IAWG will NOT meet on 11.23.2023. We will re-group the following week. Thank you for your continued involvement and support! Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Join Us in 1 Hour - IAWG Call - 2023-11-16
by Amanda Gay 16 Nov '23

16 Nov '23

Dear IAWG Members: Please join us in an hour today, November 16, for our next IAWG meeting. If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey.* The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-11-16* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> Proposed Agenda 11.16.2023 1. Administration: - Roll call - Minutes approval - 2023-10-26 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/282394645> - 2023-11-09 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/287801440/2023-11-09+D…> - Kantara Updates - Assurance Updates 2. Discussion: - Kantara Initiative Comments Preparation for NIST’s Implementation of National Standards Strategy for Critical and Emerging Technology (Denny Prvu) - Continued Address of Record Discussion - Charter and restructuring 3. Any Other Business Best, -Amanda -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Charter review - line numbered reference version
by Andrew Hughes 16 Nov '23

16 Nov '23

For our upcoming IAWG Charter review discussions, I have created word and pdf versions of the current charter. NB: The PDF contains the authoritative line numbering - use those numbers when referring to specific text. This page will host the materials: https://kantara.atlassian.net/wiki/spaces/IAWG/pages/290914314/2024+Charter… *Andrew Hughes *CISM mobile/signal +1 250.888.9474 AndrewHughes3000(a)gmail.com *https://www.linkedin.com/in/andrew-hughes-682058a <https://www.linkedin.com/in/andrew-hughes-682058a>*

1 0

Invitation & Agenda for IAWG Call 2023-11-16
by Amanda Gay 14 Nov '23

14 Nov '23

Dear IAWG Members: Please join us at *12pm *US Eastern Time, November 16, for our next IAWG meeting. If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey.* The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-11-16* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> Proposed Agenda 11.16.2023 1. Administration: - Roll call - Minutes approval - 2023-10-26 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/282394645> - 2023-11-09 Minutes DRAFT <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/287801440/2023-11-09+D…> (will be complete before Wednesday AM) - Kantara Updates - Assurance Updates 2. Discussion: - Kantara Initiative Comments Preparation for NIST’s IImplementation of National Standards Strategy for Critical and Emerging Technology (Denny Prvu) - Continued Address of Record Discussion - Charter and restructuring 3. Any Other Business Best, -Amanda -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Address of Record
by Jimmy Jung 09 Nov '23

09 Nov '23

Folks, Under the heading of other-topics/open-discussion/items-we-may-not-get-to, I wanted to send the following regarding the address of record criteria in 63A. Below please find an inclusive extract of criteria regarding "address of record." On several occasions, systems I have worked with have run into complications with "address of record," and I had hoped to explore what is trying to accomplish by this criteria, as well as gain some context for reviewing the criteria as it evolves in 63 rev 4. SP 800-63 formally defines "Address of Record" as "the validated and verified location (physical or digital) where an individual can receive communications using approved mechanisms." I would summarize 63 and the criteria for address of record as follows: * You must validate the address of record with an issuing or authoritative source using information taken from the valid id evidence. (address of record can't be self-asserted) * 63A specifically calls out postal, mobile-phone (SMS), landline or email as potential addresses of record (with a preference for Postal) * For Unsupervised proofing you must send an enrollment code to the confirmed address of record, which the Applicant must return. (for Supervised you may) * If the enrollment code is also an authenticator it must be reset * "An enrollment code allows the CSP to confirm that the applicant controls an address of record, as well as offering the applicant the ability to reestablish binding to their enrollment record." * There are various limitations in the format, validity and attempts allowed for enrollment codes. * The enrollment code and notification of proofing must be sent to different addresses of record. My confusion stems from the difficulty, if not inability to validate the email or quite frankly postal as an address of record with an issuing or authoritative source. Citing my favorite examples, google will not validate a gmail address and no one "issues" a postal address. * We identify an applicant by comparing them to the evidence and validating and verifying the evidence. * As described by 63, we can use an enrollment code to confirm that the same applicant controls the address of record and confirm that the applicant can "receive communications" at that address. * But given that email (not postal) is the likely preferred address for most systems and applicants, especially unsupervised systems; validating an email address with an issuing or authoritative source is very difficult. * and I am unsure of the utility - if the applicant controls the address and we have identified the applicant, how useful is it to validate an address of record? * Also, if supervised doesn't use an enrollment code to confirm control, then we would be sending notifications to an unvalidated address. * And, if validating an address of record is so difficult; isn't it that much more difficult to have two; so that you may send the "enrollment code and notification of proofing to different addresses of record". (often the different addresses are the web-site/application performing the identification and an email address) * And just for fun, can you send an enrollment code to an address of record, if an address of record isn't an address of record until the applicant returns the enrollment code? Thanks Jimmy [cid:image001.jpg@01DA0E0A.36B58AE0] Jimmy Jung www.Slandala.com<http://www.slandala.com/> 703 851 6813 § (..) Clause title Requirement 63A tag index KI_criterion (text in red in this column are revisions this version) 2 3 4.4.1.6 (IAL2) 1 Address Confirmation Valid records to confirm address SHALL be issuing source(s) or authoritative source(s). n/a 4.4.1.6 (IAL2) 2 Address Confirmation The CSP SHALL confirm address of record. The CSP SHOULD confirm address of record through validation of the address contained on any supplied, valid piece of identity evidence. The CSP MAY confirm address of record by validating information supplied by the applicant that is not contained on any supplied piece of identity evidence. 63A#0270 The CSP SHALL validate and confirm the Applicant's address of record by relying only upon issuing source(s) or authoritative source(s). * * 4.4.1.6 (IAL2) 3 Address Confirmation Self-asserted address data that has not been confirmed in records SHALL NOT be used for confirmation. 63A#0280 The CSP SHALL NOT accept un-validated self-asserted addresses. * * 4.4.1.6 (IAL2) 4 Address Confirmation If CSP performs in-person proofing (physical or supervised remote): 63A#0290 If the CSP performs Supervised (In-person or Remote) proofing it SHALL document the maximum validities it allows for enrollment codes and only issue codes that meet that limitation, which SHALL NOT exceed 7 days. * * 4.4.1.6 (IAL2) 4 Address Confirmation The CSP SHOULD send a notification of proofing to a confirmed address of record. n/a 4.4.1.6 (IAL2) 4 Address Confirmation The CSP MAY provide an enrollment code directly to the subscriber if binding to an authenticator will occur at a later time. n/a 4.4.1.6 (IAL2) 4 Address Confirmation The enrollment code SHALL be valid for a maximum of 7 days. n/a See 63A#0290 4.4.1.6 (IAL2) 5 Address Confirmation If the CSP performs remote proofing (unsupervised): 63A#0300 If the CSP performs Unsupervised proofing it SHALL: * 4.4.1.6 (IAL2) 5 Address Confirmation The CSP SHALL send an enrollment code to a confirmed address of record for the applicant. 63A#0300 a) send an enrollment code to a confirmed address of record for the Applicant; * 4.4.1.6 (IAL2) 5 Address Confirmation The applicant SHALL present a valid enrollment code to complete the identity proofing process. 63A#0300 b) require the Applicant to present a valid enrollment code to complete the identity proofing process; * 4.4.1.6 (IAL2) 5 Address Confirmation The CSP SHOULD send the enrollment code to the postal address that has been validated in records. The CSP MAY send the enrollment code to a mobile telephone (SMS or voice), landline telephone, or email if it has been validated in records. n/a 4.4.1.6 (IAL2) 5 Address Confirmation If the enrollment code is also intended to be an authentication factor, it SHALL be reset upon first use. 63A#0300 c) If the enrollment code is also intended to be an authentication factor, reset the code upon first use; * 4.4.1.6 (IAL2) 5 Address Confirmation Enrollment codes SHALL have the following maximum validities: 63A#0300 d) document the maximum validities it allows for enrollment codes and only issue codes that meet the following limitations: * 4.4.1.6 (IAL2) 5 Address Confirmation 10 days when sent to a postal address of record within the contiguous United States; 63A#0300 d) i) 10 days, when sent to a postal address of record within the contiguous United States; * 4.4.1.6 (IAL2) 5 Address Confirmation 30 days when sent to a postal address of record outside the contiguous United States; 63A#0300 d) ii) 30 days, when sent to a postal address of record outside the contiguous United States; * 4.4.1.6 (IAL2) 5 Address Confirmation 10 minutes when sent to a telephone of record (SMS or voice); 63A#0300 d) iii) 10 minutes, when sent to a telephone number of record (SMS or voice); * 4.4.1.6 (IAL2) 5 Address Confirmation 24 hours when sent to an email address of record. 63A#0300 d) iv) 24 hours, when sent to an email address of record. * 4.4.1.6 (IAL2) 5 Address Confirmation The CSP SHALL ensure the enrollment code and notification of proofing are sent to different addresses of record. For example, if the CSP sends an enrollment code to a phone number validated in records, a proofing notification will be sent to the postal address validated in records or obtained from validated and verified evidence, such as a driver's license. 63A#0300 e) ensure that the enrollment code and notification of proofing are sent to different addresses of record. * 4.4.1.6 (IAL2) Note Address Confirmation Postal address is the preferred method of sending any communications, including enrollment code and notifications, with the applicant. However, these guidelines support any confirmed address of record, whether physical or digital. n/a 4.5.6 (IAL3) 1 Address Confirmation The CSP SHALL confirm address of record. The CSP SHOULD confirm address of record through validation of the address contained on any supplied, valid piece of identity evidence. The CSP MAY confirm address of record by validating information supplied by the applicant, not contained on any supplied, valid piece of identity evidence. 63A#0390 The CSP SHALL confirm the Applicant's address of record using either: * 4.5.6 (IAL3) Address Confirmation 63A#0390 a) only information taken from any piece of valid identity evidence; or * 4.5.6 (IAL3) Address Confirmation 63A#0390 b) for information values which might reasonably be amended from time-to-time, information substituted by the Applicant which SHALL be validated with the issuing source of the information. * 4.5.6 (IAL3) 3 Address Confirmation A notification of proofing SHALL be sent to the confirmed address of record. 63A#0400 The CSP SHALL send a notification of proofing outcome to the confirmed address of record. * 4.6 Enrollment Code An enrollment code allows the CSP to confirm that the applicant controls an address of record, as well as offering the applicant the ability to reestablish binding to their enrollment record. n/a 4.6 Enrollment Code Binding NEED NOT be completed in the same session as the original identity proofing transaction. n/a 4.6 Enrollment Code An enrollment code SHALL be comprised of one of the following: 63A#0450 The CSP SHALL only issue enrollment codes that are, minimally, a random six character alphanumeric sequence or other value of equivalent entropy, represented either as: * * 4.6 1 Enrollment Code Minimally, a random six character alphanumeric or equivalent entropy. For example, a code generated using an approved random number generator or a serial number for a physical hardware authenticator. 63A#0450 a) a human-readable text string; OR * * 4.6 2 Enrollment Code A machine-readable optical label, such as a QR Code, that contains data of similar or higher entropy as a random six character alphanumeric. 63A#0450 b) A machine-readable optical label. * *

4 3