...
- Comments on IAL1 update #1, https://github.com/usnistgov/800-63-4/issues/1:
- Eric commented that it seems that the opportunity is to create an interim level, self-attestation and at least fair evidence verification and validation. Moreover, he said that it raises the question about the risk matrix low-moderate-high impact. Furthermore, he stressed that there are no definitions or guidelines for fraud or financial impact. It's very open and generic, so it would be worth to develop guidelines around what insignificant or inconsequential means versions serious to help agencies determine whether or not it's a low or moderate risk.
- Colin added that Federal Agencies were looking for an Enhanced IAL1.
Ken mentioned the Canadian solution, which they do zero data associated with a credential that is issued to a an individual and it's up to the RP to collect the identity data, once they get that credential and enrol the person. So, it is the basically the breaking apart of the login from the identity management.
- Richard said that Kantara criteria provide consistent definition of what xIAL or xAL "n" mean, so a provider can be assessed to meet the minimum requirements regarding a specific AL. In the case there's a defined meaning to IAL1 or "enhanced IAL1" then the RP can use that to decide which service to take.
UK DCMS Update
- Colin It was commented that UK DCMS requested feedback and offered engagement sessions with industry stakeholders on the UK’s Digital Identity and Attributes Trust Framework
alpha. They made questions about compatibility with money laundering regulations; Trust Mark; Portability of digital identities. The deadline to provide inputs is April 30th. Full details can be found at: https://docs.google.com/document/d/1e6pILWpMA09rAZxTmvkzLkGb-0BtMI5eWMELzefqiYI/edit?usp=sharing - Moreover, it was reported that DCMS plans to share the draft certification documents with stakeholders before end of June. In July it , DCMS expects to provide the next iteration of the trust framework and areis
considering a formal consultation on legislation and governance this starting in July-August. - It was agreed to provide high level comments on this. A GDoc to develop comments/responses will be shared with the participants.
Others
- Richard commented that NIST wants to convert 63A/B/C rev4. into an international standard.
- The group continued the discussion on considerations about subject-focused criteria on the OP-SAC and necessary changes were made to address the component service consumer perspective. Richard has made the corresponding revisions to the OP_SAC.
...