IAWG Off Cycle Meeting Notes - 2010-04-07

SCOPE – The framework is for international and non-government use as well as government use. Therefore cannot be driven solely by Federal government requirements but should take them into consideration.

• GOAL: Focus on what is NOT being covered
  • Not defining the standard for breeder documents but rather a mapping.
  • Not doing cross jurisdiction mapping
• We are attempting to establish proof of what?
  • 800-63 Identity proofing simply to prevent the theft of the credential
    • Value of having a name and address – to have a way (at least a starting point) to investigate that person in the event the person does something bad.
  • Attributes to provide to RP as part of registration process
• We have to define the problem then define the scope.
  • The identity proofing tends to be CSP centric as opposed to RP centric
  • How identity proofing occurs at a specific level of assurance.
  • What’s currently in IAF is too 800-63 centric
  • Give that requirement a more concrete direction.
  • How do you define a trusted entity:
    • Notary public?
    • Utility bill?
• Focus on the goals of 800-63 and not the details and define our goals and ensure they align with 800-63.
• 800-63 drivers around identity proofing.
  • Someone in the world exists with that specific name (as verified by a picture document)
  • Some hope of trying to find that person if something goes wrong

Jurisdictions

• What is sufficient to prove an identity at a particular assurance level across jurisdictions?
  • What we have today has a jurisdiction implied because we have government issued IDs however should it be?
• Better to discuss the steps and processes to verify the individual’s identity instead of the credibility of the jurisdiction or documents.

Credibility

• In addition to levels of assurance we’ll end up having levels of credibility of the documents used to generate the identity.
  • The acceptance of that will be dependent upon the Relying Party.
• The CSP publishes the criteria that they use for issuance of credentials and the RP determines if they would choose to accept that.
• Keep to a broad level and not specific to a jurisdiction.
• What we’re looking to do in the identity proofing is to define with more clarity the trust characteristics of a document that a CSP uses to provide credentials at specific assurance levels.
• Might be helpful to develop jurisdiction based profiles.