2024-10-17 IAWG Meeting Notes DRAFT

not quorate

Ready for review

TBD

Proposed syncable authenticator criteria from Richard/Jimmy (Found in Meeting Materials on IAWG Wiki).

Richard/Jimmy/Andrew

• 63B#1150: Wording was discussed and it was agreed to avoid enabling the cloning of Sfcs authenticated secret keys onto multiple devices.  Should it  be Sfcs, key authenticators, or final passkeys?

• Fido Passkeys vs. Sfcs Key Authenticators: Richard Wilsher suggested being technology-specific and creating a profile for Fido passkeys v. Sfcs key authenticators (done in such a way to relate/overlay to the criteria if invoked by CSP,  eliminating a need to change the 63B criteria).  Jimmy + others debated the necessity of such specificity.  Concerns about the complexity and practicality of implementing it.  Andrew H points out that the supplement is tech-specific (FIDO).

• ACTION: Richard Wilsher to draft a potential profile for Fido passkeys.

• Agreement to changing to syncing from cloning (despite the terms not being exact equals) to prevent confusion.

• 63B#1270: Multifactor - wording should be changed to match single factor.

• 63B#1290: Remove exclusion text, keep parenthetical to point to guidance

• Notice: Should have a reference associated with it (needs to be findable online)--notice should be published at the same the criteria go out

• Risk Assessment: Tim Anderson suggested a risk-based acceptance approach for syncable authenticators, which was supported by others as a potential solution.

  1. Noted preference (as a CSP) for Kantara to include these authenticators in an assessment and be able to include them within scope of an approval as customers (that consume NIST credentials) look to see what Kantara has reviewed/approved.

  2. CSPs would make an affirmative statement of what is being provided and how risk is accepted and/or mitigated.