I have to assume that by ‘63C compliant’ you mean ‘conformant to the Kantara 63C_SAC criteria’, because you’d have a hard job determining conformity/compliance against the NIST doc as published (which NIST have admitted was a bit of a ‘suck it and see’ approach - nice to notice that the idea of a Fedn Agrmnt has been adopted for rev.4). We invented the notions of a Fedn Agrmnt and a Fedn Authy because without certainly the former one would have little against which to assess, and the latter, well, it’s just good to have someone in charge (or to put it another way, at whom to point one’s finger). So I reckon it’s a ‘No’, a ‘Yes, if you must’ – I mean, I’d want to see that it functioned as a genuine cooperative, because if there was only a single entity appearing to run the show then … aren’t they the authority? And on your third question, I’d tend towards a definitive ‘No’ – I don’t see how can you have a federation without a federation ?? You should have your wife listen to the next IAWG call – she’d certainly be arranging to have you taken away to the funny farm! That’s my Fedora thrown into the ring. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Tuesday, March 19, 2024 19:00 To: wg-idassurance@kantarainitiative.org Subject: [WG-IDAssurance] FAL? I recall us working on the FAL criteria, and I even recall when we came up with the concept of a Federation Agreement, I even recall my wife thinking we were all quite daft, listening to one of our meetings as we drove down to the beach; but I don’t recall much more. So, as I was glancing through the criteria, I was struggling to answer the following: Can you be 63C compliant, without a federation agreement, a federation authority or a federation. I think the answers are no, yes and I don’t think so. That is to say, I think our criteria is set up to require an agreement, and folks that you are agreeing with – even if no one is “in-charge.” I will eventually get into it deeper, but I base this on our criteria that says, “in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves.” jimmy

In-line, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Wednesday, March 20, 2024 01:21 To: Richard G. WILSHER (@Zygma Inc.); wg-idassurance@kantarainitiative.org Subject: RE: [WG-IDAssurance] FAL? My thinking follows your; no, yes and how-would-you-even-do-that. That being said, I believe somewhere in the various US federal standards there is something that say you must be IAL, AAL and FAL compliant. No doubt written by someone who thought it safer to be comprehensive and didn’t quite think it through, consequently the FAL question does get asked where there is no federation. RGW: I would have to assume the unwritten/unspoken ‘as applicable’. Also, I see situations where someone sort of seems to be in charge, but seem uninterested in the mantle of “FEDERATION AUTHORITY.” RGW: Just talking a wag at that poss situation: Is there a Fedn Agrmnt which states how the Fedn is to operate, who approves the document? If it says that decisions as to the Agrmnt are determined by a majority, then show me the records of that happening, show me how a revised doc is approved. Someone has to take these steps, even if they rotate the responsibility annually (or even monthly!). If no control can be deomstrated by some rule / process then that’s a nonconformity in my mind, and I’m tending towards it being Major. If you can’t show decent management of a Fedn iaw its Agrmnt it isn’t worthy of Approval (imho: h = ‘hasty’). There may be many ways to construct, control, operate a Fedn, and I have no preferences, nor limitations, as to how that might be accomplished, so long as the 63C_SAC criteria can be met and that means there has to be a working Fedn Agrmnt and effective ‘authority’ over it (note, small ‘a’). jimmy From: Richard G. WILSHER (@Zygma Inc.) Sent: Tuesday, March 19, 2024 8:43 PM To: Jimmy Jung ; wg-idassurance@kantarainitiative.org Subject: RE: [WG-IDAssurance] FAL? I have to assume that by ‘63C compliant’ you mean ‘conformant to the Kantara 63C_SAC criteria’, because you’d have a hard job determining conformity/compliance against the NIST doc as published (which NIST have admitted was a bit of a ‘suck it and see’ approach - nice to notice that the idea of a Fedn Agrmnt has been adopted for rev.4). We invented the notions of a Fedn Agrmnt and a Fedn Authy because without certainly the former one would have little against which to assess, and the latter, well, it’s just good to have someone in charge (or to put it another way, at whom to point one’s finger). So I reckon it’s a ‘No’, a ‘Yes, if you must’ – I mean, I’d want to see that it functioned as a genuine cooperative, because if there was only a single entity appearing to run the show then … aren’t they the authority? And on your third question, I’d tend towards a definitive ‘No’ – I don’t see how can you have a federation without a federation ?? You should have your wife listen to the next IAWG call – she’d certainly be arranging to have you taken away to the funny farm! That’s my Fedora thrown into the ring. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Tuesday, March 19, 2024 19:00 To: wg-idassurance@kantarainitiative.org Subject: [WG-IDAssurance] FAL? I recall us working on the FAL criteria, and I even recall when we came up with the concept of a Federation Agreement, I even recall my wife thinking we were all quite daft, listening to one of our meetings as we drove down to the beach; but I don’t recall much more. So, as I was glancing through the criteria, I was struggling to answer the following: Can you be 63C compliant, without a federation agreement, a federation authority or a federation. I think the answers are no, yes and I don’t think so. That is to say, I think our criteria is set up to require an agreement, and folks that you are agreeing with – even if no one is “in-charge.” I will eventually get into it deeper, but I base this on our criteria that says, “in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves.” jimmy

That was a possibility I was considering, but I think our criteria would seem to specifically prohibit it; "in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves.” “Federation participants SHALL inter-operate in accordance with a documented Federation Agreement which SHALL define the obligations upon participants within the applicable Federation.” NIST seems to imply that there will be a Federation Authority enforcing a standard; we seem to allow for not having an “authority,” but still needing a standard/federation. In your case, perhaps the law defining the PKI and prohibiting the closed monopoly is the standard/agreement; which begs the question, can a party-of-one organize the creation of a Federation Agreement JUST between themselves. From: mhaeaking@freeuk.com Sent: Wednesday, March 20, 2024 2:59 AM To: Richard G. WILSHER (@Zygma Inc.) Cc: Jimmy Jung ; wg-idassurance@kantarainitiative.org Subject: Re: [WG-IDAssurance] Re: FAL? Could the context be federable, i.e. has all the links in to make it connect to any equivalent competition should there be any? My example is the West Australian system with a (privately-provided) PKI for those dealing in property and the land registry (I do not have the exact names to hand). The law is careful to demand that this is not setting up as a closed monopoly, even if nobody is interested in setting up a competitor. Thus the one provider should be checked out as being standards compliant and open to federation, even if no such federation is expected to emerge? Mark On 2024-03-20 02:39, Richard G. WILSHER (@Zygma Inc.) wrote: In-line, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttp://www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Wednesday, March 20, 2024 01:21 To: Richard G. WILSHER (@Zygma Inc.); wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: RE: [WG-IDAssurance] FAL? My thinking follows your; no, yes and how-would-you-even-do-that. That being said, I believe somewhere in the various US federal standards there is something that say you must be IAL, AAL and FAL compliant. No doubt written by someone who thought it safer to be comprehensive and didn't quite think it through, consequently the FAL question does get asked where there is no federation. RGW: I would have to assume the unwritten/unspoken 'as applicable'. Also, I see situations where someone sort of seems to be in charge, but seem uninterested in the mantle of "FEDERATION AUTHORITY." RGW: Just talking a wag at that poss situation: Is there a Fedn Agrmnt which states how the Fedn is to operate, who approves the document? If it says that decisions as to the Agrmnt are determined by a majority, then show me the records of that happening, show me how a revised doc is approved. Someone has to take these steps, even if they rotate the responsibility annually (or even monthly!). If no control can be deomstrated by some rule / process then that's a nonconformity in my mind, and I'm tending towards it being Major. If you can't show decent management of a Fedn iaw its Agrmnt it isn't worthy of Approval (imho: h = 'hasty'). There may be many ways to construct, control, operate a Fedn, and I have no preferences, nor limitations, as to how that might be accomplished, so long as the 63C_SAC criteria can be met and that means there has to be a working Fedn Agrmnt and effective 'authority' over it (note, small 'a'). jimmy From: Richard G. WILSHER (@Zygma Inc.) mailto:RGW@Zygma.biz> Sent: Tuesday, March 19, 2024 8:43 PM To: Jimmy Jung mailto:jimmy.jung@slandala.com>; wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: RE: [WG-IDAssurance] FAL? I have to assume that by '63C compliant' you mean 'conformant to the Kantara 63C_SAC criteria', because you'd have a hard job determining conformity/compliance against the NIST doc as published (which NIST have admitted was a bit of a 'suck it and see' approach - nice to notice that the idea of a Fedn Agrmnt has been adopted for rev.4). We invented the notions of a Fedn Agrmnt and a Fedn Authy because without certainly the former one would have little against which to assess, and the latter, well, it's just good to have someone in charge (or to put it another way, at whom to point one's finger). So I reckon it's a 'No', a 'Yes, if you must' – I mean, I'd want to see that it functioned as a genuine cooperative, because if there was only a single entity appearing to run the show then ... aren't they the authority? And on your third question, I'd tend towards a definitive 'No' – I don't see how can you have a federation without a federation ?? You should have your wife listen to the next IAWG call – she'd certainly be arranging to have you taken away to the funny farm! That's my Fedora thrown into the ring. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttp://www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Tuesday, March 19, 2024 19:00 To: wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: [WG-IDAssurance] FAL? I recall us working on the FAL criteria, and I even recall when we came up with the concept of a Federation Agreement, I even recall my wife thinking we were all quite daft, listening to one of our meetings as we drove down to the beach; but I don't recall much more. So, as I was glancing through the criteria, I was struggling to answer the following: Can you be 63C compliant, without a federation agreement, a federation authority or a federation. I think the answers are no, yes and I don't think so. That is to say, I think our criteria is set up to require an agreement, and folks that you are agreeing with – even if no one is "in-charge." I will eventually get into it deeper, but I base this on our criteria that says, "in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves." jimmy _______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.orgmailto:staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantara... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurance

Er... I think we (well - the Liberty Alliance...) had this discussion 20 years ago, under the heading of "circles of trust". I mean, I remember giving a press interview about it in early 2006... If I recall correctly, a lot of people started out thinking that, because the diagram for a "circle of trust" showed one credential issuer and multiple relying parties, that was some kind of rule. Gradually people were led to understand that the diagram illustrated conceptual roles, not a deployment model ;^) As a rough generalisation (and this goes back to the SET protocol of the 90s https://en.wikipedia.org/wiki/Secure_Electronic_Transaction), the conceptual roles don't change between a single-party deployment (Mark's "first-to-market") and a multi-party deployment: what does change is the liability model, because now the relying parties, for instance, need someone to sue in case of the mis-issuing of credentials. R On Wed, 20 Mar 2024, at 10:20, mhaeaking@freeuk.com wrote:

The sound of one hand clapping? It's also quite possible to be in more than one federation, and I'm not sure how that is covered. The parties presumably do not have to be currently active. The EU cross-border provisions of eIDAS have a lot of one-way requirements (even if couched in 'Mutual' language) but the 'first to market' must be allowed in, even if there is nobody else yet to play with. Five-Eyes arguably have no federation agreement, just five sovereign decisions to play nicely with the rest of the group. Passports also in theory comply with standards by peer-pressure, and there are presumably North American 'States/provinces rights' issues on driving/drivers licences/licenses where it's hardly up to Kantara to define what they must do.

On 2024-03-20 09:47, Jimmy Jung wrote:

...

That was a possibility I was considering, but I think our criteria would seem to specifically prohibit it;

"in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves." "Federation participants SHALL inter-operate in accordance with a documented Federation Agreement which SHALL define the obligations upon participants within the applicable Federation."

NIST seems to imply that there will be a Federation Authority enforcing a standard; we seem to allow for not having an "*authority,*" but still needing a standard/federation. In your case, perhaps the law defining the PKI and prohibiting the closed monopoly is the standard/agreement; which begs the question, can a party-of-one organize the creation of a Federation Agreement JUST between themselves.

*From:* mhaeaking@freeuk.com *Sent:* Wednesday, March 20, 2024 2:59 AM *To:* Richard G. WILSHER (@Zygma Inc.) *Cc:* Jimmy Jung ; wg-idassurance@kantarainitiative.org *Subject:* Re: [WG-IDAssurance] Re: FAL?

Could the context be federable, i.e. has all the links in to make it connect to any equivalent competition should there be any? My example is the West Australian system with a (privately-provided) PKI for those dealing in property and the land registry (I do not have the exact names to hand). The law is careful to demand that this is not setting up as a closed monopoly, even if nobody is interested in setting up a competitor.

Thus the one provider should be checked out as being standards compliant and open to federation, even if no such federation is expected to emerge?

Mark

On 2024-03-20 02:39, Richard G. WILSHER (@Zygma Inc.) wrote:

...

In-line,

*Richard G. WILSHER** *CEO & Founder, Zygma Inc.* *www.Zygma.biz* *+1 714 797 9942**

*From:* Jimmy Jung [mailto:jimmy.jung@slandala.com] *Sent:* Wednesday, March 20, 2024 01:21 *To:* Richard G. WILSHER (@Zygma Inc.); wg-idassurance@kantarainitiative.org *Subject:* RE: [WG-IDAssurance] FAL?

My thinking follows your; no, yes and how-would-you-even-do-that.

That being said, I believe somewhere in the various US federal standards there is something that say you must be IAL, AAL and FAL compliant. No doubt written by someone who thought it safer to be comprehensive and didn't quite think it through, consequently the FAL question does get asked where there is no federation.

RGW: I would have to assume the unwritten/unspoken 'as applicable'.

Also, I see situations where someone sort of seems to be in charge, but seem uninterested in the mantle of "FEDERATION AUTHORITY." RGW: Just talking a wag at that poss situation: Is there a Fedn Agrmnt which states how the Fedn is to operate, who approves the document? If it says that decisions as to the Agrmnt are determined by a majority, then show me the records of that happening, show me how a revised doc is approved. Someone has to take these steps, even if they rotate the responsibility annually (or even monthly!). If no control can be deomstrated by some rule / process then that's a nonconformity in my mind, and I'm tending towards it being Major.

If you can't show decent management of a Fedn iaw its Agrmnt it isn't worthy of Approval (imho: h = 'hasty'). There may be many ways to construct, control, operate a Fedn, and I have no preferences, nor limitations, as to how that might be accomplished, so long as the 63C_SAC criteria can be met and that means there has to be a working Fedn Agrmnt and effective 'authority' over it (note, small 'a').

jimmy

*From:* Richard G. WILSHER (@Zygma Inc.) *Sent:* Tuesday, March 19, 2024 8:43 PM *To:* Jimmy Jung ; wg-idassurance@kantarainitiative.org *Subject:* RE: [WG-IDAssurance] FAL?

I have to assume that by '63C compliant' you mean 'conformant to the Kantara 63C_SAC criteria', because you'd have a hard job determining conformity/compliance against the NIST doc as published (which NIST have admitted was a bit of a 'suck it and see' approach - nice to notice that the idea of a Fedn Agrmnt has been adopted for rev.4).

We invented the notions of a Fedn Agrmnt and a Fedn Authy because without certainly the former one would have little against which to assess, and the latter, well, it's just good to have someone in charge (or to put it another way, at whom to point one's finger). So I reckon it's a 'No', a 'Yes, if you must' – I mean, I'd want to see that it functioned as a genuine cooperative, because if there was only a single entity appearing to run the show then ... aren't they the authority?

And on your third question, I'd tend towards a definitive 'No' – I don't see how can you have a federation without a federation ??

You should have your wife listen to the next IAWG call – she'd certainly be arranging to have you taken away to the funny farm!

That's my Fedora thrown into the ring.

*Richard G. WILSHER** *CEO & Founder, Zygma Inc.* *www.Zygma.biz* *+1 714 797 9942**

*From:* Jimmy Jung [mailto:jimmy.jung@slandala.com] *Sent:* Tuesday, March 19, 2024 19:00 *To:* wg-idassurance@kantarainitiative.org *Subject:* [WG-IDAssurance] FAL?

I recall us working on the FAL criteria, and I even recall when we came up with the concept of a Federation Agreement, I even recall my wife thinking we were all quite daft, listening to one of our meetings as we drove down to the beach; but I don't recall much more. So, as I was glancing through the criteria, I was struggling to answer the following:

Can you be 63C compliant, without a federation agreement, a federation authority or a federation. I think the answers are no, yes and I don't think so.

That is to say, I think our criteria is set up to require an agreement, and folks that you are agreeing with – even if no one is "in-charge." I will eventually get into it deeper, but I base this on our criteria that says, "in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves."

jimmy

_______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantara... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurance

_______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantara... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurance

"Now, a federation of federations?? That’s going to need a good malt to help one think it through!" I recall that some years back GTRI (Wandelt & co.) had a look at cross-federation. I believe the conclusion was that unless the two (or more) federations had identical controls and participation commitments, there would have to be a lot of new functionality added to make sure relying-party participants could efficiently (i.e., automatically) limit their cross-federation transactions based on the different controls/commitments in the partner federation. Martin --- Martin Smith 703 389-3224 ________________________________ From: Richard G. WILSHER (@Zygma Inc.) Sent: Wednesday, March 20, 2024 12:20 PM To: wg-idassurance@kantarainitiative.org Subject: [WG-IDAssurance] Re: FAL? More than one federation, assuming that Approval was being sought, would be two separate assessments each with its own Fedn Agrmnt. Now, a federation of federations?? That’s going to need a good malt to help one think it through! What I’ve not quite got together is this: Does a 63C assessment cover only the Fedn Agrmnt and the Fedn Authy? What about the other Fedn members / participants. My chicken-hearted approach is to ask what the Fedn Authy does about allowing members and leaving it up to them. I’d want to see hard evidence that they fulfilled their obligations in that regard but I’m not very keen on assessing every member of the fedn and I doubt if any of them want to be subjected to an assessment. If the Fedn Agrment imposes an explicit requirement that members are individually Kantara Approved then whoopee (or maybe not)! re. “… where it's hardly up to Kantara to define what they must do.” I think the scope of what Kantara can define is: a) reflecting the language of 800-63C through its criteria which I suggest provide a clearer basis against which claims of conformity cab be assessed; and b) what it needs to make an assessment and a subsequent Approval possible and meaningful. We created the requirement for a Fedn Agrmnt because otherwise one might not know what one was assessing against. If you read the criteria carefully you will note that the term ‘SHALL’ is used for those things expressly mandated by or otherwise inferred from 800-63C as being mandatory, whereas the phrase “SHALL consider” is used for those things which in drafting we felt were highly desirable. In my mind if you SHALL consider ‘topic x’ then a blank response is not good enough (“DID you really consider it?”) whereas a documented ‘TOPIC X: No stipulation’ is conformant. It is the acknowledgement of deciding to do nothing through choice, not through ignorance. R Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942 From: mhaeaking@freeuk.com [mailto:mhaeaking@freeuk.com] Sent: Wednesday, March 20, 2024 10:21 To: Jimmy Jung Cc: Richard G. WILSHER (@Zygma Inc.); wg-idassurance@kantarainitiative.org Subject: Re: [WG-IDAssurance] Re: FAL? The sound of one hand clapping? It's also quite possible to be in more than one federation, and I'm not sure how that is covered. The parties presumably do not have to be currently active. The EU cross-border provisions of eIDAS have a lot of one-way requirements (even if couched in 'Mutual' language) but the 'first to market' must be allowed in, even if there is nobody else yet to play with. Five-Eyes arguably have no federation agreement, just five sovereign decisions to play nicely with the rest of the group. Passports also in theory comply with standards by peer-pressure, and there are presumably North American 'States/provinces rights' issues on driving/drivers licences/licenses where it's hardly up to Kantara to define what they must do. On 2024-03-20 09:47, Jimmy Jung wrote: That was a possibility I was considering, but I think our criteria would seem to specifically prohibit it; "in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves." "Federation participants SHALL inter-operate in accordance with a documented Federation Agreement which SHALL define the obligations upon participants within the applicable Federation." NIST seems to imply that there will be a Federation Authority enforcing a standard; we seem to allow for not having an "authority," but still needing a standard/federation. In your case, perhaps the law defining the PKI and prohibiting the closed monopoly is the standard/agreement; which begs the question, can a party-of-one organize the creation of a Federation Agreement JUST between themselves. From: mhaeaking@freeuk.com Sent: Wednesday, March 20, 2024 2:59 AM To: Richard G. WILSHER (@Zygma Inc.) Cc: Jimmy Jung ; wg-idassurance@kantarainitiative.org Subject: Re: [WG-IDAssurance] Re: FAL? Could the context be federable, i.e. has all the links in to make it connect to any equivalent competition should there be any? My example is the West Australian system with a (privately-provided) PKI for those dealing in property and the land registry (I do not have the exact names to hand). The law is careful to demand that this is not setting up as a closed monopoly, even if nobody is interested in setting up a competitor. Thus the one provider should be checked out as being standards compliant and open to federation, even if no such federation is expected to emerge? Mark On 2024-03-20 02:39, Richard G. WILSHER (@Zygma Inc.) wrote: In-line, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttp://www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Wednesday, March 20, 2024 01:21 To: Richard G. WILSHER (@Zygma Inc.); wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: RE: [WG-IDAssurance] FAL? My thinking follows your; no, yes and how-would-you-even-do-that. That being said, I believe somewhere in the various US federal standards there is something that say you must be IAL, AAL and FAL compliant. No doubt written by someone who thought it safer to be comprehensive and didn't quite think it through, consequently the FAL question does get asked where there is no federation. RGW: I would have to assume the unwritten/unspoken 'as applicable'. Also, I see situations where someone sort of seems to be in charge, but seem uninterested in the mantle of "FEDERATION AUTHORITY." RGW: Just talking a wag at that poss situation: Is there a Fedn Agrmnt which states how the Fedn is to operate, who approves the document? If it says that decisions as to the Agrmnt are determined by a majority, then show me the records of that happening, show me how a revised doc is approved. Someone has to take these steps, even if they rotate the responsibility annually (or even monthly!). If no control can be deomstrated by some rule / process then that's a nonconformity in my mind, and I'm tending towards it being Major. If you can't show decent management of a Fedn iaw its Agrmnt it isn't worthy of Approval (imho: h = 'hasty'). There may be many ways to construct, control, operate a Fedn, and I have no preferences, nor limitations, as to how that might be accomplished, so long as the 63C_SAC criteria can be met and that means there has to be a working Fedn Agrmnt and effective 'authority' over it (note, small 'a'). jimmy From: Richard G. WILSHER (@Zygma Inc.) mailto:RGW@Zygma.biz> Sent: Tuesday, March 19, 2024 8:43 PM To: Jimmy Jung mailto:jimmy.jung@slandala.com>; wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: RE: [WG-IDAssurance] FAL? I have to assume that by '63C compliant' you mean 'conformant to the Kantara 63C_SAC criteria', because you'd have a hard job determining conformity/compliance against the NIST doc as published (which NIST have admitted was a bit of a 'suck it and see' approach - nice to notice that the idea of a Fedn Agrmnt has been adopted for rev.4). We invented the notions of a Fedn Agrmnt and a Fedn Authy because without certainly the former one would have little against which to assess, and the latter, well, it's just good to have someone in charge (or to put it another way, at whom to point one's finger). So I reckon it's a 'No', a 'Yes, if you must' – I mean, I'd want to see that it functioned as a genuine cooperative, because if there was only a single entity appearing to run the show then ... aren't they the authority? And on your third question, I'd tend towards a definitive 'No' – I don't see how can you have a federation without a federation ?? You should have your wife listen to the next IAWG call – she'd certainly be arranging to have you taken away to the funny farm! That's my Fedora thrown into the ring. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttp://www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Tuesday, March 19, 2024 19:00 To: wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: [WG-IDAssurance] FAL? I recall us working on the FAL criteria, and I even recall when we came up with the concept of a Federation Agreement, I even recall my wife thinking we were all quite daft, listening to one of our meetings as we drove down to the beach; but I don't recall much more. So, as I was glancing through the criteria, I was struggling to answer the following: Can you be 63C compliant, without a federation agreement, a federation authority or a federation. I think the answers are no, yes and I don't think so. That is to say, I think our criteria is set up to require an agreement, and folks that you are agreeing with – even if no one is "in-charge." I will eventually get into it deeper, but I base this on our criteria that says, "in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves." jimmy _______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.orgmailto:staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantara... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurance

Nice Bryan !! You google “Federation hub” and the first 3 items are Ping 😊 – “A federation hub that supports multiple identity standards, like PingFederate, makes it faster and more cost effective to provide secure access for all users.” and based on that quick overview, I take them to be opposite approaches to the same problem. One is bureaucracy supporting interoperability through standards and the other is technology supporting interoperability by bridging those disparities? PS - I think I’ve become comfortable with my original FAL question - it extended from someone wanting to be federated, BUT NOT wanting to be the federation authority (which I think is fine, but there still needs to be an agreement) jimmy From: Bryan Rosensteel via WG-IDAssurance Sent: Wednesday, March 27, 2024 12:18 PM To: Martin Smith Cc: Richard G. WILSHER (@Zygma Inc.) ; wg-idassurance@kantarainitiative.org Subject: [WG-IDAssurance] Re: FAL? ...sounds like a Federation Hub. This is something I have been doing a lot of research into lately... V/r, Bryan [Ping Identity]https://www.pingidentity.com/ Bryan Rosensteel US Federal CTO bryanrosensteel@pingidentity.commailto:bryanrosensteel@pingidentity.com Connect with us: [Glassdoor logo]https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,2... [LinkedIn logo] https://www.linkedin.com/company/21870 [twitter logo] https://twitter.com/pingidentity [facebook logo] https://www.facebook.com/pingidentitypage [youtube logo] https://www.youtube.com/user/PingIdentityTV [Blog logo] https://www.pingidentity.com/en/blog.html On Wed, Mar 27, 2024 at 12:11 PM Martin Smith mailto:martin@bfcmclean.com> wrote: "Now, a federation of federations?? That’s going to need a good malt to help one think it through!" I recall that some years back GTRI (Wandelt & co.) had a look at cross-federation. I believe the conclusion was that unless the two (or more) federations had identical controls and participation commitments, there would have to be a lot of new functionality added to make sure relying-party participants could efficiently (i.e., automatically) limit their cross-federation transactions based on the different controls/commitments in the partner federation. Martin --- Martin Smith 703 389-3224 ________________________________ From: Richard G. WILSHER (@Zygma Inc.) mailto:RGW@Zygma.biz> Sent: Wednesday, March 20, 2024 12:20 PM To: wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org mailto:wg-idassurance@kantarainitiative.org> Subject: [WG-IDAssurance] Re: FAL? More than one federation, assuming that Approval was being sought, would be two separate assessments each with its own Fedn Agrmnt. Now, a federation of federations?? That’s going to need a good malt to help one think it through! What I’ve not quite got together is this: Does a 63C assessment cover only the Fedn Agrmnt and the Fedn Authy? What about the other Fedn members / participants. My chicken-hearted approach is to ask what the Fedn Authy does about allowing members and leaving it up to them. I’d want to see hard evidence that they fulfilled their obligations in that regard but I’m not very keen on assessing every member of the fedn and I doubt if any of them want to be subjected to an assessment. If the Fedn Agrment imposes an explicit requirement that members are individually Kantara Approved then whoopee (or maybe not)! re. “… where it's hardly up to Kantara to define what they must do.” I think the scope of what Kantara can define is: a) reflecting the language of 800-63C through its criteria which I suggest provide a clearer basis against which claims of conformity cab be assessed; and b) what it needs to make an assessment and a subsequent Approval possible and meaningful. We created the requirement for a Fedn Agrmnt because otherwise one might not know what one was assessing against. If you read the criteria carefully you will note that the term ‘SHALL’ is used for those things expressly mandated by or otherwise inferred from 800-63C as being mandatory, whereas the phrase “SHALL consider” is used for those things which in drafting we felt were highly desirable. In my mind if you SHALL consider ‘topic x’ then a blank response is not good enough (“DID you really consider it?”) whereas a documented ‘TOPIC X: No stipulation’ is conformant. It is the acknowledgement of deciding to do nothing through choice, not through ignorance. R Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttp://www.Zygma.biz +1 714 797 9942 From: mhaeaking@freeuk.commailto:mhaeaking@freeuk.com [mailto:mhaeaking@freeuk.commailto:mhaeaking@freeuk.com] Sent: Wednesday, March 20, 2024 10:21 To: Jimmy Jung Cc: Richard G. WILSHER (@Zygma Inc.); wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: Re: [WG-IDAssurance] Re: FAL? The sound of one hand clapping? It's also quite possible to be in more than one federation, and I'm not sure how that is covered. The parties presumably do not have to be currently active. The EU cross-border provisions of eIDAS have a lot of one-way requirements (even if couched in 'Mutual' language) but the 'first to market' must be allowed in, even if there is nobody else yet to play with. Five-Eyes arguably have no federation agreement, just five sovereign decisions to play nicely with the rest of the group. Passports also in theory comply with standards by peer-pressure, and there are presumably North American 'States/provinces rights' issues on driving/drivers licences/licenses where it's hardly up to Kantara to define what they must do. On 2024-03-20 09:47, Jimmy Jung wrote: That was a possibility I was considering, but I think our criteria would seem to specifically prohibit it; "in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves." "Federation participants SHALL inter-operate in accordance with a documented Federation Agreement which SHALL define the obligations upon participants within the applicable Federation." NIST seems to imply that there will be a Federation Authority enforcing a standard; we seem to allow for not having an "authority," but still needing a standard/federation. In your case, perhaps the law defining the PKI and prohibiting the closed monopoly is the standard/agreement; which begs the question, can a party-of-one organize the creation of a Federation Agreement JUST between themselves. From: mhaeaking@freeuk.commailto:mhaeaking@freeuk.com mailto:mhaeaking@freeuk.com> Sent: Wednesday, March 20, 2024 2:59 AM To: Richard G. WILSHER (@Zygma Inc.) mailto:RGW@zygma.biz> Cc: Jimmy Jung mailto:jimmy.jung@slandala.com>; wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: Re: [WG-IDAssurance] Re: FAL? Could the context be federable, i.e. has all the links in to make it connect to any equivalent competition should there be any? My example is the West Australian system with a (privately-provided) PKI for those dealing in property and the land registry (I do not have the exact names to hand). The law is careful to demand that this is not setting up as a closed monopoly, even if nobody is interested in setting up a competitor. Thus the one provider should be checked out as being standards compliant and open to federation, even if no such federation is expected to emerge? Mark On 2024-03-20 02:39, Richard G. WILSHER (@Zygma Inc.) wrote: In-line, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttp://www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Wednesday, March 20, 2024 01:21 To: Richard G. WILSHER (@Zygma Inc.); wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: RE: [WG-IDAssurance] FAL? My thinking follows your; no, yes and how-would-you-even-do-that. That being said, I believe somewhere in the various US federal standards there is something that say you must be IAL, AAL and FAL compliant. No doubt written by someone who thought it safer to be comprehensive and didn't quite think it through, consequently the FAL question does get asked where there is no federation. RGW: I would have to assume the unwritten/unspoken 'as applicable'. Also, I see situations where someone sort of seems to be in charge, but seem uninterested in the mantle of "FEDERATION AUTHORITY." RGW: Just talking a wag at that poss situation: Is there a Fedn Agrmnt which states how the Fedn is to operate, who approves the document? If it says that decisions as to the Agrmnt are determined by a majority, then show me the records of that happening, show me how a revised doc is approved. Someone has to take these steps, even if they rotate the responsibility annually (or even monthly!). If no control can be deomstrated by some rule / process then that's a nonconformity in my mind, and I'm tending towards it being Major. If you can't show decent management of a Fedn iaw its Agrmnt it isn't worthy of Approval (imho: h = 'hasty'). There may be many ways to construct, control, operate a Fedn, and I have no preferences, nor limitations, as to how that might be accomplished, so long as the 63C_SAC criteria can be met and that means there has to be a working Fedn Agrmnt and effective 'authority' over it (note, small 'a'). jimmy From: Richard G. WILSHER (@Zygma Inc.) mailto:RGW@Zygma.biz> Sent: Tuesday, March 19, 2024 8:43 PM To: Jimmy Jung mailto:jimmy.jung@slandala.com>; wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: RE: [WG-IDAssurance] FAL? I have to assume that by '63C compliant' you mean 'conformant to the Kantara 63C_SAC criteria', because you'd have a hard job determining conformity/compliance against the NIST doc as published (which NIST have admitted was a bit of a 'suck it and see' approach - nice to notice that the idea of a Fedn Agrmnt has been adopted for rev.4). We invented the notions of a Fedn Agrmnt and a Fedn Authy because without certainly the former one would have little against which to assess, and the latter, well, it's just good to have someone in charge (or to put it another way, at whom to point one's finger). So I reckon it's a 'No', a 'Yes, if you must' – I mean, I'd want to see that it functioned as a genuine cooperative, because if there was only a single entity appearing to run the show then ... aren't they the authority? And on your third question, I'd tend towards a definitive 'No' – I don't see how can you have a federation without a federation ?? You should have your wife listen to the next IAWG call – she'd certainly be arranging to have you taken away to the funny farm! That's my Fedora thrown into the ring. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttp://www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Tuesday, March 19, 2024 19:00 To: wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: [WG-IDAssurance] FAL? I recall us working on the FAL criteria, and I even recall when we came up with the concept of a Federation Agreement, I even recall my wife thinking we were all quite daft, listening to one of our meetings as we drove down to the beach; but I don't recall much more. So, as I was glancing through the criteria, I was struggling to answer the following: Can you be 63C compliant, without a federation agreement, a federation authority or a federation. I think the answers are no, yes and I don't think so. That is to say, I think our criteria is set up to require an agreement, and folks that you are agreeing with – even if no one is "in-charge." I will eventually get into it deeper, but I base this on our criteria that says, "in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves." jimmy _______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.orgmailto:staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantara... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurance _______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.orgmailto:staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantara... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurance CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.

Check out Exostar.com for federation hub they are PingFedearate based. Not sure they claim to be a fed hub but that is basically how we used their partnership when I was at Boeing. Thanks, Chris From: Bryan Rosensteel via WG-IDAssurance Date: Wednesday, March 27, 2024 at 9:50 AM To: Jimmy Jung Cc: Martin Smith , Richard G. WILSHER (@Zygma Inc.) , wg-idassurance@kantarainitiative.org Subject: [WG-IDAssurance] Re: FAL? This Message is From an External Sender Caution: Do not click links or open attachments unless you recognize the sender and know the content is safe. I'm just saying...don't reinvent the wheel... ;) With that said, I've been working through the ATARC Identity Management Working Group to drive policy adoption to initiate a federation bridge for the government. Federation interoperability does not scale if every IdP needs to talk with every other IdP for authentication. This becomes more critical when we examine the elements within NIST SP 800-157r1 ipd and NIST SP 800-217 idp. V/r, Bryan [Image removed by sender. Ping Identity]https://urldefense.com/v3/__https:/www.pingidentity.com/__;!!Om87Lau1Cg!L71D... Bryan Rosensteel US Federal CTO bryanrosensteel@pingidentity.commailto:bryanrosensteel@pingidentity.com Connect with us: [Image removed by sender. Glassdoor logo]https://urldefense.com/v3/__https:/www.glassdoor.com/Overview/Working-at-Pin... [Image removed by sender. LinkedIn logo] https://urldefense.com/v3/__https:/www.linkedin.com/company/21870__;!!Om87La... [Image removed by sender. twitter logo] https://urldefense.com/v3/__https:/twitter.com/pingidentity__;!!Om87Lau1Cg!L... [Image removed by sender. facebook logo] https://urldefense.com/v3/__https:/www.facebook.com/pingidentitypage__;!!Om8... [Image removed by sender. youtube logo] https://urldefense.com/v3/__https:/www.youtube.com/user/PingIdentityTV__;!!O... [Image removed by sender. Blog logo] https://urldefense.com/v3/__https:/www.pingidentity.com/en/blog.html__;!!Om8... On Wed, Mar 27, 2024 at 12:45 PM Jimmy Jung mailto:jimmy.jung@slandala.com> wrote: Nice Bryan !! You google “Federation hub” and the first 3 items are Ping 😊 – “A federation hub that supports multiple identity standards, like PingFederate, makes it faster and more cost effective to provide secure access for all users.” and based on that quick overview, I take them to be opposite approaches to the same problem. One is bureaucracy supporting interoperability through standards and the other is technology supporting interoperability by bridging those disparities? PS - I think I’ve become comfortable with my original FAL question - it extended from someone wanting to be federated, BUT NOT wanting to be the federation authority (which I think is fine, but there still needs to be an agreement) jimmy From: Bryan Rosensteel via WG-IDAssurance mailto:wg-idassurance@kantarainitiative.org> Sent: Wednesday, March 27, 2024 12:18 PM To: Martin Smith mailto:martin@bfcmclean.com> Cc: Richard G. WILSHER (@Zygma Inc.) mailto:RGW@zygma.biz>; wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: [WG-IDAssurance] Re: FAL? ...sounds like a Federation Hub. This is something I have been doing a lot of research into lately... V/r, Bryan [Image removed by sender. Ping Identity]https://urldefense.com/v3/__https:/www.pingidentity.com/__;!!Om87Lau1Cg!L71D... Bryan Rosensteel US Federal CTO bryanrosensteel@pingidentity.commailto:bryanrosensteel@pingidentity.com Connect with us: [Image removed by sender. Glassdoor logo]https://urldefense.com/v3/__https:/www.glassdoor.com/Overview/Working-at-Pin... [Image removed by sender. LinkedIn logo] https://urldefense.com/v3/__https:/www.linkedin.com/company/21870__;!!Om87La... [Image removed by sender. twitter logo] https://urldefense.com/v3/__https:/twitter.com/pingidentity__;!!Om87Lau1Cg!L... [Image removed by sender. facebook logo] https://urldefense.com/v3/__https:/www.facebook.com/pingidentitypage__;!!Om8... [Image removed by sender. youtube logo] https://urldefense.com/v3/__https:/www.youtube.com/user/PingIdentityTV__;!!O... [Image removed by sender. Blog logo] https://urldefense.com/v3/__https:/www.pingidentity.com/en/blog.html__;!!Om8... On Wed, Mar 27, 2024 at 12:11 PM Martin Smith mailto:martin@bfcmclean.com> wrote: "Now, a federation of federations?? That’s going to need a good malt to help one think it through!" I recall that some years back GTRI (Wandelt & co.) had a look at cross-federation. I believe the conclusion was that unless the two (or more) federations had identical controls and participation commitments, there would have to be a lot of new functionality added to make sure relying-party participants could efficiently (i.e., automatically) limit their cross-federation transactions based on the different controls/commitments in the partner federation. Martin --- Martin Smith 703 389-3224 ________________________________ From: Richard G. WILSHER (@Zygma Inc.) mailto:RGW@Zygma.biz> Sent: Wednesday, March 20, 2024 12:20 PM To: wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org mailto:wg-idassurance@kantarainitiative.org> Subject: [WG-IDAssurance] Re: FAL? More than one federation, assuming that Approval was being sought, would be two separate assessments each with its own Fedn Agrmnt. Now, a federation of federations?? That’s going to need a good malt to help one think it through! What I’ve not quite got together is this: Does a 63C assessment cover only the Fedn Agrmnt and the Fedn Authy? What about the other Fedn members / participants. My chicken-hearted approach is to ask what the Fedn Authy does about allowing members and leaving it up to them. I’d want to see hard evidence that they fulfilled their obligations in that regard but I’m not very keen on assessing every member of the fedn and I doubt if any of them want to be subjected to an assessment. If the Fedn Agrment imposes an explicit requirement that members are individually Kantara Approved then whoopee (or maybe not)! re. “… where it's hardly up to Kantara to define what they must do.” I think the scope of what Kantara can define is: a) reflecting the language of 800-63C through its criteria which I suggest provide a clearer basis against which claims of conformity cab be assessed; and b) what it needs to make an assessment and a subsequent Approval possible and meaningful. We created the requirement for a Fedn Agrmnt because otherwise one might not know what one was assessing against. If you read the criteria carefully you will note that the term ‘SHALL’ is used for those things expressly mandated by or otherwise inferred from 800-63C as being mandatory, whereas the phrase “SHALL consider” is used for those things which in drafting we felt were highly desirable. In my mind if you SHALL consider ‘topic x’ then a blank response is not good enough (“DID you really consider it?”) whereas a documented ‘TOPIC X: No stipulation’ is conformant. It is the acknowledgement of deciding to do nothing through choice, not through ignorance. R Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttps://urldefense.com/v3/__http:/www.Zygma.biz__;!!Om87Lau1Cg!L71DZUfEYF4zE... +1 714 797 9942 From: mhaeaking@freeuk.commailto:mhaeaking@freeuk.com [mailto:mhaeaking@freeuk.commailto:mhaeaking@freeuk.com] Sent: Wednesday, March 20, 2024 10:21 To: Jimmy Jung Cc: Richard G. WILSHER (@Zygma Inc.); wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: Re: [WG-IDAssurance] Re: FAL? The sound of one hand clapping? It's also quite possible to be in more than one federation, and I'm not sure how that is covered. The parties presumably do not have to be currently active. The EU cross-border provisions of eIDAS have a lot of one-way requirements (even if couched in 'Mutual' language) but the 'first to market' must be allowed in, even if there is nobody else yet to play with. Five-Eyes arguably have no federation agreement, just five sovereign decisions to play nicely with the rest of the group. Passports also in theory comply with standards by peer-pressure, and there are presumably North American 'States/provinces rights' issues on driving/drivers licences/licenses where it's hardly up to Kantara to define what they must do. On 2024-03-20 09:47, Jimmy Jung wrote: That was a possibility I was considering, but I think our criteria would seem to specifically prohibit it; "in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves." "Federation participants SHALL inter-operate in accordance with a documented Federation Agreement which SHALL define the obligations upon participants within the applicable Federation." NIST seems to imply that there will be a Federation Authority enforcing a standard; we seem to allow for not having an "authority," but still needing a standard/federation. In your case, perhaps the law defining the PKI and prohibiting the closed monopoly is the standard/agreement; which begs the question, can a party-of-one organize the creation of a Federation Agreement JUST between themselves. From: mhaeaking@freeuk.commailto:mhaeaking@freeuk.com mailto:mhaeaking@freeuk.com> Sent: Wednesday, March 20, 2024 2:59 AM To: Richard G. WILSHER (@Zygma Inc.) mailto:RGW@zygma.biz> Cc: Jimmy Jung mailto:jimmy.jung@slandala.com>; wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: Re: [WG-IDAssurance] Re: FAL? Could the context be federable, i.e. has all the links in to make it connect to any equivalent competition should there be any? My example is the West Australian system with a (privately-provided) PKI for those dealing in property and the land registry (I do not have the exact names to hand). The law is careful to demand that this is not setting up as a closed monopoly, even if nobody is interested in setting up a competitor. Thus the one provider should be checked out as being standards compliant and open to federation, even if no such federation is expected to emerge? Mark On 2024-03-20 02:39, Richard G. WILSHER (@Zygma Inc.) wrote: In-line, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttps://urldefense.com/v3/__http:/www.Zygma.biz__;!!Om87Lau1Cg!L71DZUfEYF4zE... +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Wednesday, March 20, 2024 01:21 To: Richard G. WILSHER (@Zygma Inc.); wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: RE: [WG-IDAssurance] FAL? My thinking follows your; no, yes and how-would-you-even-do-that. That being said, I believe somewhere in the various US federal standards there is something that say you must be IAL, AAL and FAL compliant. No doubt written by someone who thought it safer to be comprehensive and didn't quite think it through, consequently the FAL question does get asked where there is no federation. RGW: I would have to assume the unwritten/unspoken 'as applicable'. Also, I see situations where someone sort of seems to be in charge, but seem uninterested in the mantle of "FEDERATION AUTHORITY." RGW: Just talking a wag at that poss situation: Is there a Fedn Agrmnt which states how the Fedn is to operate, who approves the document? If it says that decisions as to the Agrmnt are determined by a majority, then show me the records of that happening, show me how a revised doc is approved. Someone has to take these steps, even if they rotate the responsibility annually (or even monthly!). If no control can be deomstrated by some rule / process then that's a nonconformity in my mind, and I'm tending towards it being Major. If you can't show decent management of a Fedn iaw its Agrmnt it isn't worthy of Approval (imho: h = 'hasty'). There may be many ways to construct, control, operate a Fedn, and I have no preferences, nor limitations, as to how that might be accomplished, so long as the 63C_SAC criteria can be met and that means there has to be a working Fedn Agrmnt and effective 'authority' over it (note, small 'a'). jimmy From: Richard G. WILSHER (@Zygma Inc.) mailto:RGW@Zygma.biz> Sent: Tuesday, March 19, 2024 8:43 PM To: Jimmy Jung mailto:jimmy.jung@slandala.com>; wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: RE: [WG-IDAssurance] FAL? I have to assume that by '63C compliant' you mean 'conformant to the Kantara 63C_SAC criteria', because you'd have a hard job determining conformity/compliance against the NIST doc as published (which NIST have admitted was a bit of a 'suck it and see' approach - nice to notice that the idea of a Fedn Agrmnt has been adopted for rev.4). We invented the notions of a Fedn Agrmnt and a Fedn Authy because without certainly the former one would have little against which to assess, and the latter, well, it's just good to have someone in charge (or to put it another way, at whom to point one's finger). So I reckon it's a 'No', a 'Yes, if you must' – I mean, I'd want to see that it functioned as a genuine cooperative, because if there was only a single entity appearing to run the show then ... aren't they the authority? And on your third question, I'd tend towards a definitive 'No' – I don't see how can you have a federation without a federation ?? You should have your wife listen to the next IAWG call – she'd certainly be arranging to have you taken away to the funny farm! That's my Fedora thrown into the ring. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttps://urldefense.com/v3/__http:/www.Zygma.biz__;!!Om87Lau1Cg!L71DZUfEYF4zE... +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Tuesday, March 19, 2024 19:00 To: wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: [WG-IDAssurance] FAL? I recall us working on the FAL criteria, and I even recall when we came up with the concept of a Federation Agreement, I even recall my wife thinking we were all quite daft, listening to one of our meetings as we drove down to the beach; but I don't recall much more. So, as I was glancing through the criteria, I was struggling to answer the following: Can you be 63C compliant, without a federation agreement, a federation authority or a federation. I think the answers are no, yes and I don't think so. That is to say, I think our criteria is set up to require an agreement, and folks that you are agreeing with – even if no one is "in-charge." I will eventually get into it deeper, but I base this on our criteria that says, "in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves." jimmy _______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.orgmailto:staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantara...https://urldefense.com/v3/__https:/mailman.kantarainitiative.org/hyperkitty/... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurancehttps://urldefense.com/v3/__https:/kantara.atlassian.net/wiki/spaces/WG-IDAs... _______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.orgmailto:staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantara...https://urldefense.com/v3/__https:/mailman.kantarainitiative.org/hyperkitty/... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurancehttps://urldefense.com/v3/__https:/kantara.atlassian.net/wiki/spaces/WG-IDAs... CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you. CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.

I recognize that. I was saying that our criteria compared t NIST, seem to require the agreement even without the authority. PS, you know which system has me pondering such things Sent from my Verizon, Samsung Galaxy smartphone -------- Original message -------- From: "Richard G. WILSHER (@Zygma Inc.)" Date: 3/20/24 12:29 PM (GMT-05:00) To: IA WG Subject: [WG-IDAssurance] Re: FAL? Easy Jimmy, the quoted text is NOT NIST’s – look in column D of 63C_SAC and you will find the comment “Kantara-specific criterion to bring into effect the need to have a documented Fedn Agrmnt”. What you cite is that Kantara-specific text (criterion). Silly as it might be, I consider a Fedn of 1 to be viable. Conformity would hopefully be easy to determine and pathetic if it couldn’t be demonstrated. I see no prohibition. Algebraically, if one can conceive of a null set then a set of 1 is easy! Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttp://www.Zygma.biz +1 714 797 9942 From: Jimmy Jung via WG-IDAssurance [mailto:wg-idassurance@kantarainitiative.org] Sent: Wednesday, March 20, 2024 09:48 To: mhaeaking@freeuk.com; Richard G. WILSHER (@Zygma Inc.) Cc: wg-idassurance@kantarainitiative.org Subject: [WG-IDAssurance] Re: FAL? That was a possibility I was considering, but I think our criteria would seem to specifically prohibit it; "in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves.” “Federation participants SHALL inter-operate in accordance with a documented Federation Agreement which SHALL define the obligations upon participants within the applicable Federation.” NIST seems to imply that there will be a Federation Authority enforcing a standard; we seem to allow for not having an “authority,” but still needing a standard/federation. In your case, perhaps the law defining the PKI and prohibiting the closed monopoly is the standard/agreement; which begs the question, can a party-of-one organize the creation of a Federation Agreement JUST between themselves. From: mhaeaking@freeuk.com Sent: Wednesday, March 20, 2024 2:59 AM To: Richard G. WILSHER (@Zygma Inc.) Cc: Jimmy Jung ; wg-idassurance@kantarainitiative.org Subject: Re: [WG-IDAssurance] Re: FAL? Could the context be federable, i.e. has all the links in to make it connect to any equivalent competition should there be any? My example is the West Australian system with a (privately-provided) PKI for those dealing in property and the land registry (I do not have the exact names to hand). The law is careful to demand that this is not setting up as a closed monopoly, even if nobody is interested in setting up a competitor. Thus the one provider should be checked out as being standards compliant and open to federation, even if no such federation is expected to emerge? Mark On 2024-03-20 02:39, Richard G. WILSHER (@Zygma Inc.) wrote: In-line, Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttp://www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Wednesday, March 20, 2024 01:21 To: Richard G. WILSHER (@Zygma Inc.); wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: RE: [WG-IDAssurance] FAL? My thinking follows your; no, yes and how-would-you-even-do-that. That being said, I believe somewhere in the various US federal standards there is something that say you must be IAL, AAL and FAL compliant. No doubt written by someone who thought it safer to be comprehensive and didn't quite think it through, consequently the FAL question does get asked where there is no federation. RGW: I would have to assume the unwritten/unspoken 'as applicable'. Also, I see situations where someone sort of seems to be in charge, but seem uninterested in the mantle of "FEDERATION AUTHORITY." RGW: Just talking a wag at that poss situation: Is there a Fedn Agrmnt which states how the Fedn is to operate, who approves the document? If it says that decisions as to the Agrmnt are determined by a majority, then show me the records of that happening, show me how a revised doc is approved. Someone has to take these steps, even if they rotate the responsibility annually (or even monthly!). If no control can be deomstrated by some rule / process then that's a nonconformity in my mind, and I'm tending towards it being Major. If you can't show decent management of a Fedn iaw its Agrmnt it isn't worthy of Approval (imho: h = 'hasty'). There may be many ways to construct, control, operate a Fedn, and I have no preferences, nor limitations, as to how that might be accomplished, so long as the 63C_SAC criteria can be met and that means there has to be a working Fedn Agrmnt and effective 'authority' over it (note, small 'a'). jimmy From: Richard G. WILSHER (@Zygma Inc.) mailto:RGW@Zygma.biz> Sent: Tuesday, March 19, 2024 8:43 PM To: Jimmy Jung mailto:jimmy.jung@slandala.com>; wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: RE: [WG-IDAssurance] FAL? I have to assume that by '63C compliant' you mean 'conformant to the Kantara 63C_SAC criteria', because you'd have a hard job determining conformity/compliance against the NIST doc as published (which NIST have admitted was a bit of a 'suck it and see' approach - nice to notice that the idea of a Fedn Agrmnt has been adopted for rev.4). We invented the notions of a Fedn Agrmnt and a Fedn Authy because without certainly the former one would have little against which to assess, and the latter, well, it's just good to have someone in charge (or to put it another way, at whom to point one's finger). So I reckon it's a 'No', a 'Yes, if you must' – I mean, I'd want to see that it functioned as a genuine cooperative, because if there was only a single entity appearing to run the show then ... aren't they the authority? And on your third question, I'd tend towards a definitive 'No' – I don't see how can you have a federation without a federation ?? You should have your wife listen to the next IAWG call – she'd certainly be arranging to have you taken away to the funny farm! That's my Fedora thrown into the ring. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.bizhttp://www.Zygma.biz +1 714 797 9942 From: Jimmy Jung [mailto:jimmy.jung@slandala.com] Sent: Tuesday, March 19, 2024 19:00 To: wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org Subject: [WG-IDAssurance] FAL? I recall us working on the FAL criteria, and I even recall when we came up with the concept of a Federation Agreement, I even recall my wife thinking we were all quite daft, listening to one of our meetings as we drove down to the beach; but I don't recall much more. So, as I was glancing through the criteria, I was struggling to answer the following: Can you be 63C compliant, without a federation agreement, a federation authority or a federation. I think the answers are no, yes and I don't think so. That is to say, I think our criteria is set up to require an agreement, and folks that you are agreeing with – even if no one is "in-charge." I will eventually get into it deeper, but I base this on our criteria that says, "in the absence of a Federation Authority, the parties in the federation must organize the creation of a Federation Agreement between themselves." jimmy _______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance@kantarainitiative.orgmailto:wg-idassurance@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.orgmailto:staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantara... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurance