Subject: [VoT] VoT – Strawman B

From: Rainer Hoerbe <[email-masked]>
Date: Wed, 15 Oct 2014 15:07:54 +0200

So far some respondees questioned the viability of a model with orthogonal vectors in principle. To integrate ideas from Justin’ document with those thoughts I am proposing an alternative VoT strawman, which can be developed and discussed in parallel.
To keep things simple I am delineating a contrasting approach – later mergers and confluences are possible and wanted.
 
First thing to note is that I am missing a write-up of the Terms of Reference for VoT. Taking statements from the workshop notes and the preceeding contributions on the list I think that the ToR would contain this:
1) Federation should extend trust beyond the local jurisdiction or community
2) Assurance using LoA (for entity authentication assurance) is operational in some pretty large federations, but rare to be common accross the boundaries mentioned in (1)
3) At the same time the perception is that LoA does not accommodate „cross border/sector federation“ because RPs require different controls.
4) Related topics need to be solved as well, such as common terminology and attribute assurance.
 
So what vectors should we have? Instead of refining the LoA definition in 800-63 VoT shall have only 2 vectors:
a) Liability
b) LoA
 
a) Trust because of liability
Liability has to be defined on a contractual base for a service that the RP has with an IDP (or however represents a federation). In practical terms such a contract could look like this:
„RP buys 100,000 assertions for 0,10€/transaction with a liability limit of 50€ per assertion. Each assertion shall assure that whoever can proof to own the authentication factor(s) will be issued with the registered attributes of a targeted identifier, first and last name, gender and DoB“.
There might be liability limitations, such as gross negligence by the end-user or non-fatal spelling errors in attributes, but in principle the IDP should take the complete risk of identifying the user to the RP.
 
The idea behind this scheme is twofold: (i) The IDP has skin in the game, and will optimize rules and procedures to match liability requirements. E.g., if document fraud would suddenly rise significantly, better training for ROs or additional background checks could be deployed quickly and on a flexible basis, i.e. without a slow agreement processes. (ii) Liability amounts are very easy to communicate, and do not suffer from the unorthogonality of a bag of controls. I think that money is a truly linear scale.
 
IDPs can base a business model on liability. At the basic level, there is no liability, only reputation, as it is practice in the R&E federations. At higher levels RPs can negotiate how much risk they need to transfer.
If the RP’s asset at risk has a value of 1m€, the RP might require a liability of 10k€ and keep 990k€ as residual risk, considering that 10k€ liabilty per transaction will motivate the IDP’s liability insurance to require proper controls.
 
b) LoA for legally required controls
A RP cannot translate mandatory controls into a monetary risk. E.g. Anti-Money-Laundering rules require payment providers to enforce certain KYC rules. Or some jurisdictions require a car rental service to give a car only to persons with a valid driving license. Therefore IDPs must follow certain vetting procedures or other controls.
 
This kind of LoA might have a similar granularity as ISO29115 or 800-63. It could consist of conformance requirements by broadly available security regimes, such as ECB Payment Service Directive, eIDAS/high or 800-63.
 
It might turn out that RPs have quite different policy requirements. In this case the complexity of policy negotiation could be significantly reduced by having trust in the liabilty regime. In addition only a minimal set of mandatory controls needs to be imposed in the IDP.

Issues to be discussed:
-       Is certification better than liability?
-       How would organizations be handled who are authoritative, but reject to take any liabilty identification or attributes? (Like goverment bodies, doctor’s professional organizations, chambers of commerces)

Regards, Rainer

---

From: Mikael Linden <[email-masked]>
Date: Thu, 16 Oct 2014 15:40:29 +0300 (EEST)

Hi,
I'm afraid there is a cultural difference here between the non-profit 
Research&Education federations and the commercial federations/IdPs. 
Liability is the commercial world's approach to trust metrics. Universities 
become IdPs to enable their employees/students to do their job/studies more 
easily. Becoming liable for it may make the universities to withdraw from 
their role as an IdP.

The R&E federation policies that I know exclude liabilities to the extent 
possible. In general, liability is not seen as an LoA issue in R&E 
federations.

Cheers,
mikael

-----Original Message-----
From: vot [mailto:[email-masked]] On Behalf Of Rainer Hoerbe
Sent: 15. lokakuuta 2014 16:08
To: [email-masked]
Subject: [VoT] VoT – Strawman B

So far some respondees questioned the viability of a model with orthogonal 
vectors in principle. To integrate ideas from Justin’ document with those 
thoughts I am proposing an alternative VoT strawman, which can be developed 
and discussed in parallel.
To keep things simple I am delineating a contrasting approach – later 
mergers and confluences are possible and wanted.

First thing to note is that I am missing a write-up of the Terms of 
Reference for VoT. Taking statements from the workshop notes and the 
preceeding contributions on the list I think that the ToR would contain 
this:
1) Federation should extend trust beyond the local jurisdiction or community
2) Assurance using LoA (for entity authentication assurance) is operational 
in some pretty large federations, but rare to be common accross the 
boundaries mentioned in (1)
3) At the same time the perception is that LoA does not accommodate „cross 
border/sector federation“ because RPs require different controls.
4) Related topics need to be solved as well, such as common terminology and 
attribute assurance.

So what vectors should we have? Instead of refining the LoA definition in 
800-63 VoT shall have only 2 vectors:
a) Liability
b) LoA

a) Trust because of liability
Liability has to be defined on a contractual base for a service that the RP 
has with an IDP (or however represents a federation). In practical terms 
such a contract could look like this:
„RP buys 100,000 assertions for 0,10€/transaction with a liability limit of 
50€ per assertion. Each assertion shall assure that whoever can proof to own 
the authentication factor(s) will be issued with the registered attributes 
of a targeted identifier, first and last name, gender and DoB“.
There might be liability limitations, such as gross negligence by the 
end-user or non-fatal spelling errors in attributes, but in principle the 
IDP should take the complete risk of identifying the user to the RP.

The idea behind this scheme is twofold: (i) The IDP has skin in the game, 
and will optimize rules and procedures to match liability requirements. 
E.g., if document fraud would suddenly rise significantly, better training 
for ROs or additional background checks could be deployed quickly and on a 
flexible basis, i.e. without a slow agreement processes. (ii) Liability 
amounts are very easy to communicate, and do not suffer from the 
unorthogonality of a bag of controls. I think that money is a truly linear 
scale.

IDPs can base a business model on liability. At the basic level, there is no 
liability, only reputation, as it is practice in the R&E federations. At 
higher levels RPs can negotiate how much risk they need to transfer.
If the RP’s asset at risk has a value of 1m€, the RP might require a 
liability of 10k€ and keep 990k€ as residual risk, considering that 10k€ 
liabilty per transaction will motivate the IDP’s liability insurance to 
require proper controls.

b) LoA for legally required controls
A RP cannot translate mandatory controls into a monetary risk. E.g. 
Anti-Money-Laundering rules require payment providers to enforce certain KYC 
rules. Or some jurisdictions require a car rental service to give a car only 
to persons with a valid driving license. Therefore IDPs must follow certain 
vetting procedures or other controls.

This kind of LoA might have a similar granularity as ISO29115 or 800-63. It 
could consist of conformance requirements by broadly available security 
regimes, such as ECB Payment Service Directive, eIDAS/high or 800-63.

It might turn out that RPs have quite different policy requirements. In this 
case the complexity of policy negotiation could be significantly reduced by 
having trust in the liabilty regime. In addition only a minimal set of 
mandatory controls needs to be imposed in the IDP.

Issues to be discussed:
-       Is certification better than liability?
-       How would organizations be handled who are authoritative, but reject 
to take any liabilty identification or attributes? (Like goverment bodies, 
doctor’s professional organizations, chambers of commerces)

Regards, Rainer
_______________________________________________
vot mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/vot

---

From: Rainer Hoerbe <[email-masked]>
Date: Thu, 16 Oct 2014 16:14:18 +0200

Hi Mikael,

I do not see a conflict there, liability = 0€ ist just the lowest level of the scale, where only reputation is left to underpin trust. I think that I took care of this with the phrase "At the basic level, there is no liability, only reputation, as it is practice in the R&E federations".

Cheers, Rainer