Comments on OASIS Biometric Open Protocol (BOPS) TC

["Mangold, Kevin C." <kevin.mangold@nist.gov>]

The following are comments from the OASIS Biometrics TC in response to the Biometrics Open Protocol (BOPS) TC Proposed Charter (https://lists.oasis-open.org/archives/oasis-charter-discuss/201407/msg00000.html).

 

General

-                      If this project heavily involves web services, consider putting this project in the OASIS Biometrics TC, which already has both biometrics and web service experts involved, as well as liaison relationships with other relevant/similar committees in other SDOs. You can view the charter at https://www.oasis-open.org/committees/biometrics/charter.php

 

Section 1b

-                      Statement of Purpose is unclear; what is BOPS and what will it solve?

-                      NIST 800-52 Revision 1, Section 3.1, paragraphs 1-2 advise to use TLS 1.1+; remove SSL from SOP and clarify that TLS 1.0 shall not be used.

-                      “biometrics-agnostic standard API for registered developers” – What does it mean to be a “registered developer”? How would one register? Are there any fees involved? Will the chosen IPR mode conflict with this registration process?

 

Section 1c

-                      Scope is unclear; what is BOPS and what will it solve?

 

Section 2a

-                      Is there really NO other being done by another organization or SDO that has any similarities to BOPS? How is the IEEE P2410 BOPS project (http://standards.ieee.org/develop/project/2410.html, http://standards.ieee.org/develop/wg/BOP.html) related? For example, biometric image quality might use ISO standards, interfaces to matchers & sensors might use specifications developed by the OASIS Biometrics TC.

-                      Please explicitly state which committees within each SDO you plan to coordinate with. Will this be a liaison relationship or joint work?

·                     Current committees with Biometrics expertise are the OASIS Biometrics TC, INCITS M1, ISO/IEC JTC 1 SC 37. ISO/IEC JTC 1 SC 27 may be in scope as it contains IT Security and Identity Management experts.

 

Section 2b

-                      The first l TC meeting must have dial-in information (TC Process 2.3, paragraph 1; TC Process 2.10, paragraph 1)

 

---

Kevin Mangold

National Institute of Standards and Technology

Information Technology Lab / Information Access Division / Image Group / Biometric Clients Lab

Office: 301-975-5628