Subject: Re: [VoT] vot Digest, Vol 2, Issue 20

From: Peter Alterman <[email-masked]>
Date: Wed, 15 Oct 2014 15:10:42 -0400

Hello, folks.

eIDAS high is QCP, e.g., PKI comparable to somewhere between FBCA Basic and
FBCA Medium (last time I looked).

Another point that's been sticking in my mind: token/credential strength
must must must include the policies and practices around management of
same. It's not just the binding of the identity proofing outcome.

Every single process for assigning trustworthiness (rat hole alert) is
based on a risk/mitigation determination, both on the issuance/management
side and on the authentication/consumption side, so between 29115 and
800-53 there is a basal affinity and each promotes a path towards
quantifying risk and mitigation.If vot were to focus on teasing out the
terms of that affinity and standardize agreement on same, that would be a
major accomplishment.  Looked at this way, liability is simply another risk
mitigation strategy, albeit a fairly complex, non-technical one.

Peter

------------------------------------------------------------
Peter Alterman, Ph.D.
Chief Operating Officer
SAFE-BioPharma Association
cell: 301-943-7452

On Wed, Oct 15, 2014 at 3:01 PM, <[email-masked]> wrote:

> Send vot mailing list submissions to
>         [email-masked]
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://www.ietf.org/mailman/listinfo/vot
> or, via email, send a message with subject or body 'help' to
>         [email-masked]
>
> You can reach the person managing the list at
>         [email-masked]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of vot digest..."
>
> Today's Topics:
>
>    1. VoT ? Strawman B (Rainer Hoerbe)
>
>
> ---------- Forwarded message ----------
> From: Rainer Hoerbe <[email-masked]>
> To: [email-masked]
> Cc:
> Date: Wed, 15 Oct 2014 15:07:54 +0200
> Subject: [VoT] VoT – Strawman B
> So far some respondees questioned the viability of a model with orthogonal
> vectors in principle. To integrate ideas from Justin’ document with those
> thoughts I am proposing an alternative VoT strawman, which can be developed
> and discussed in parallel.
> To keep things simple I am delineating a contrasting approach – later
> mergers and confluences are possible and wanted.
>
> First thing to note is that I am missing a write-up of the Terms of
> Reference for VoT. Taking statements from the workshop notes and the
> preceeding contributions on the list I think that the ToR would contain
> this:
> 1) Federation should extend trust beyond the local jurisdiction or
> community
> 2) Assurance using LoA (for entity authentication assurance) is
> operational in some pretty large federations, but rare to be common accross
> the boundaries mentioned in (1)
> 3) At the same time the perception is that LoA does not accommodate „cross
> border/sector federation“ because RPs require different controls.
> 4) Related topics need to be solved as well, such as common terminology
> and attribute assurance.
>
> So what vectors should we have? Instead of refining the LoA definition in
> 800-63 VoT shall have only 2 vectors:
> a) Liability
> b) LoA
>
> a) Trust because of liability
> Liability has to be defined on a contractual base for a service that the
> RP has with an IDP (or however represents a federation). In practical terms
> such a contract could look like this:
> „RP buys 100,000 assertions for 0,10€/transaction with a liability limit
> of 50€ per assertion. Each assertion shall assure that whoever can proof to
> own the authentication factor(s) will be issued with the registered
> attributes of a targeted identifier, first and last name, gender and DoB“.
> There might be liability limitations, such as gross negligence by the
> end-user or non-fatal spelling errors in attributes, but in principle the
> IDP should take the complete risk of identifying the user to the RP.
>
> The idea behind this scheme is twofold: (i) The IDP has skin in the game,
> and will optimize rules and procedures to match liability requirements.
> E.g., if document fraud would suddenly rise significantly, better training
> for ROs or additional background checks could be deployed quickly and on a
> flexible basis, i.e. without a slow agreement processes. (ii) Liability
> amounts are very easy to communicate, and do not suffer from the
> unorthogonality of a bag of controls. I think that money is a truly linear
> scale.
>
> IDPs can base a business model on liability. At the basic level, there is
> no liability, only reputation, as it is practice in the R&E federations. At
> higher levels RPs can negotiate how much risk they need to transfer.
> If the RP’s asset at risk has a value of 1m€, the RP might require a
> liability of 10k€ and keep 990k€ as residual risk, considering that 10k€
> liabilty per transaction will motivate the IDP’s liability insurance to
> require proper controls.
>
> b) LoA for legally required controls
> A RP cannot translate mandatory controls into a monetary risk. E.g.
> Anti-Money-Laundering rules require payment providers to enforce certain
> KYC rules. Or some jurisdictions require a car rental service to give a car
> only to persons with a valid driving license. Therefore IDPs must follow
> certain vetting procedures or other controls.
>
> This kind of LoA might have a similar granularity as ISO29115 or 800-63.
> It could consist of conformance requirements by broadly available security
> regimes, such as ECB Payment Service Directive, eIDAS/high or 800-63.
>
> It might turn out that RPs have quite different policy requirements. In
> this case the complexity of policy negotiation could be significantly
> reduced by having trust in the liabilty regime. In addition only a minimal
> set of mandatory controls needs to be imposed in the IDP.
>
>
> Issues to be discussed:
> -       Is certification better than liability?
> -       How would organizations be handled who are authoritative, but
> reject to take any liabilty identification or attributes? (Like goverment
> bodies, doctor’s professional organizations, chambers of commerces)
>
> Regards, Rainer
>
>
> _______________________________________________
> vot mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/vot
>
>

---

From: Rainer Hoerbe <[email-masked]>
Date: Thu, 16 Oct 2014 18:40:13 +0200

Am 15.10.2014 um 21:10 schrieb Peter Alterman <[email-masked]>:

> Hello, folks.
> 
> Every single process for assigning trustworthiness (rat hole alert) is based on a risk/mitigation determination,
Yes, trust is just a floppy word for risk management in this context. That should go into the ToR.

> both on the issuance/management side and on the authentication/consumption side, so between 29115 and 800-53 there is a basal affinity and each promotes a path towards quantifying risk and mitigation.If vot were to focus on teasing out the terms of that affinity and standardize agreement on same, that would be a major accomplishment.  Looked at this way, liability is simply another risk mitigation strategy, albeit a fairly complex, non-technical one. 
Liability may be more complex than LoA or not, but it is a much simpler interface between IPD and RP, which is key to scalability.

Complexity is not the only problem. LoA policy adoption is a slow multi-stakeholder process, but threats appear fast. Also there is very little data to justify particular controls, because breach notification is hard to do outside organizations.

- Rainer

> So far some respondees questioned the viability of a model with orthogonal vectors in principle. To integrate ideas from Justin’ document with those thoughts I am proposing an alternative VoT strawman, which can be developed and discussed in parallel.
> To keep things simple I am delineating a contrasting approach – later mergers and confluences are possible and wanted.
> 
> First thing to note is that I am missing a write-up of the Terms of Reference for VoT. Taking statements from the workshop notes and the preceeding contributions on the list I think that the ToR would contain this:
> 1) Federation should extend trust beyond the local jurisdiction or community
> 2) Assurance using LoA (for entity authentication assurance) is operational in some pretty large federations, but rare to be common accross the boundaries mentioned in (1)
> 3) At the same time the perception is that LoA does not accommodate „cross border/sector federation“ because RPs require different controls.
> 4) Related topics need to be solved as well, such as common terminology and attribute assurance.
> 
> So what vectors should we have? Instead of refining the LoA definition in 800-63 VoT shall have only 2 vectors:
> a) Liability
> b) LoA
> 
> Liability has to be defined on a contractual base for a service that the RP has with an IDP (or however represents a federation). In practical terms such a contract could look like this:
> „RP buys 100,000 assertions for 0,10€/transaction with a liability limit of 50€ per assertion. Each assertion shall assure that whoever can proof to own the authentication factor(s) will be issued with the registered attributes of a targeted identifier, first and last name, gender and DoB“.
> There might be liability limitations, such as gross negligence by the end-user or non-fatal spelling errors in attributes, but in principle the IDP should take the complete risk of identifying the user to the RP.
> 
> The idea behind this scheme is twofold: (i) The IDP has skin in the game, and will optimize rules and procedures to match liability requirements. E.g., if document fraud would suddenly rise significantly, better training for ROs or additional background checks could be deployed quickly and on a flexible basis, i.e. without a slow agreement processes. (ii) Liability amounts are very easy to communicate, and do not suffer from the unorthogonality of a bag of controls. I think that money is a truly linear scale.
> 
> IDPs can base a business model on liability. At the basic level, there is no liability, only reputation, as it is practice in the R&E federations. At higher levels RPs can negotiate how much risk they need to transfer.
> If the RP’s asset at risk has a value of 1m€, the RP might require a liability of 10k€ and keep 990k€ as residual risk, considering that 10k€ liabilty per transaction will motivate the IDP’s liability insurance to require proper controls.
> 
> A RP cannot translate mandatory controls into a monetary risk. E.g. Anti-Money-Laundering rules require payment providers to enforce certain KYC rules. Or some jurisdictions require a car rental service to give a car only to persons with a valid driving license. Therefore IDPs must follow certain vetting procedures or other controls.
> 
> This kind of LoA might have a similar granularity as ISO29115 or 800-63. It could consist of conformance requirements by broadly available security regimes, such as ECB Payment Service Directive, eIDAS/high or 800-63.
> 
> It might turn out that RPs have quite different policy requirements. In this case the complexity of policy negotiation could be significantly reduced by having trust in the liabilty regime. In addition only a minimal set of mandatory controls needs to be imposed in the IDP.
> 
> 
> Issues to be discussed:
> -       How would organizations be handled who are authoritative, but reject to take any liabilty identification or attributes? (Like goverment bodies, doctor’s professional organizations, chambers of commerces)
> 
> Regards, Rainer
> 
>