- Why would anyone care for the Identity Assurance Framework since we already have NIST SP 800-63?
Response: If it addresses other use cases than the US federal government: Yes - Is it true that identity assurance applies only to Identity Federation scenarios?
Response: Identity Assurance has several connotations: LoA, the IAF, and the information security related identity assertion of a remote user.
The LoA is an essential construct in federations (flat or somewhat hierarchical) to fight complexity. But any large system/organization can profit from LoA.
The same is true for the IAF: It provides a policy for federations or large organizations.
The identity assertion in the infosec-view is completely independent of federations.
- Am I correct is assuming that identity assurance is relevant only for PKI-based authentication?
Response: No. - I understand that identity assurance is about strong authentication, so Identity assurance = two-factor authentication, right?
Response: No, LoA 1 and LoA 2 are included as well. - There are no publicly available Identity Assurance standards, correct?
- Is Kantara Initiative