...
Finalize proposed text (if any) regarding use of "presentation attack detection" (PAD.)
RQ: were going to consult with RW and Kay present.
KD: postpone.
Short answer "no" but discussed clarification.
Varun: easy dynamics. familiar with PAD. wondered what KI was thinking.
RQ: 63-3b "should" And 90 percent.
KD: again let's wait.
Put to be by week of Sept 1,. to mid nov-start Dec. Need to meet on 19 and maybe 26th.Roger Q. noted we wanted to discuss this matter with both Richard W. and Kay C. present.
Ken D agreed and said we will have to postpone wrap-up of this issue since neither is present today.
Martin S. asked if Ken thought it was definite that we would want to include some change to the existing Kantara criteria in the package we are currently preparing. Ken said the short answer is "no."
Ken went on to provide a brief summary of the origin of the issue and discussion to date. The initial impetus for consideration of the issue was a question from Phil Lam at GSA to Kay C. He asked if Kantara required the use of PAD for certification of conformity with 63A. Kay owes Phil a response, and the basic answer is "no," but we wanted to review the issue first to see if we might want to clarify or elaborate the language of the relevant criterion. Since Kay's meeting with Phil, there have been some email exchanges between Richard W and Ken, but Ken feels further discussion within the WG is needed.
Varun L said he is familiar with PAD and was wondering what Kantara was thinking. Roger Q. noted that although NIST 800-63-3 does not explicitly require use of PAD ("SHALL"), it does specifically recommend its use in remote proofing ("SHOULD") and even specifies the level of assurance that PAD should attain.
Ken D. agreed that it seems that NIST strongly recommends use of PAD and might make it a normative requirement in 800-63-4. However, he noted that Kantara does not add requirements beyond those that NIST specifies, so we would not want to make use of PAD a SHALL in our criteria unless NIST does.
He added that we really have to wait to discuss this with Richard W. and Kay C. present at our next meeting. He noted that we want to submit the consolidated criteria change package (with or without added PAD-related language) no later than the end of August to have it published by the end of November or very early December. We should therefore meet in one week and plan for another meeting the following week to be sure to finish the work.
Confirmation of other non-substantive changes to criteria to be included in the package to be submitted.
kick to 19th
Varun Lal – thanksKen said that Richard W. has a spreadsheet of these proposed non-substantive changes, so in his absence we would postpone this discussion to the next IAWG meeting as well.
Other Business:
Next Meeting: August 19, and then August 26 if necessary to finalize the criteria change package for submission to Kantara review.
...