notes from July 24 call

["Mary Ruddy" <mary@meristic.com>]

Minutes for the meeting of the Electronic Identity Credential Trust Elevation Methods (Trust Elevation) Technical Committee

July 24, 2014.

1. Call to Order and Welcome.

 

2. Roll Call

 

 

Attending (please notify me if you attended the meeting but are not on the list below)

 

Abbie Barbir, Bank of America  - y

Anil Saldhana, Red Hat  

Bob Sunday

Brendan Peter, CA

Carl Mattocks, Bofa 

Cathy Tilton, Daon  - y 

Charline Duccans, DHS

Duane DeCouteau

Calvin

Colin Wallis, New Zealand Government 

Dale Rickards, Verizon Business 

David Brossard, Axiomatics 

Dazza Greenwood 

Debbie Bucci, NIH 

Deborah Steckroth, RouteOne LLC

Detlef Huehnlein, Federal Office for Information

Diana Proud-Madruga - y   

Diego Matute, Centrify

Don Thibeau, Open Identity Exchange - y   

Doron Cohen, SafeNet

Doron Grinstein, BiTKOO

Gershon Janssen    

Ilene Bridges 

Ivonne Thomas, Hasso Plattner Institute

Jaap Kuipers, Amsterdam  

James Clark – Oasis

Jeff Broburg, CA

John Bradley 

John "Mike" Davis, Veteran's Affairs 

John Walsh, Sypris Electronics

Jonas Hogberg

Julian Hamersley, Adv Micro Devices

Kevin Mangold, NIST  - y 

Lucy Lynch  ISOC

Marcus Streets, Thales e-Security

Marty Schleiff, The Boeing Company

Mary Ruddy, Identity Commons  - y

Massimiliano Masi, Tiani "Spirit" GmbH 

Mike Harrop

Mohammad Jafari, ESC - 

Peter Alterman, SAFE-BioPharma  

Peter Jones -

Rainer Hoerbe -

Rebecca Nielsen, Booz Allen Hamilton 

Rich Furr

Ronald Perez, Advanced Micro Devices

Scott Fitch Lockeed Martin

Shaheen Abdul Jabbar, JPMorgan Chase Bank, N.A. - y  

Shahrokh Shahidzadeh (Intel Corp 

Suzanne Gonzales-Webb, VA  - y 

Tony Rutkowski

Tony Nadlin

Thomas Hardjono, M.I.T.  

William Barnhill, Booz Allen Hamilton

Adrianne James, VA 

Patrick, Axiomatics

Steve Olshansky 

Andrew Nash - y

 

75 percent of the voting members were present at the meeting.  We did have quorum.

 

2. Agenda review and approval

We used the following chat room for the call: http://webconf.soaphub.org/conf/room/trust-el

   chat room text is included at the end of the minutes.

The agenda was approved.

 

 

3. Approval of the Minutes

 

 

Abbie asked for a motion to approve the minutes from June 26.

Cathy moved to approve.

Shaheen seconded.

There were no objections.

The minutes were approved.

4. Editor update

We had an editor’s call and have a plan to move forward.

Andrew said we need to define an architectural entity that would be the service end of the protocol. There was a conversation about what that might look like. We also talked about engaging with Eve and some other folks.  He spoke with Eve about how trust-el might work with UMA.  She agreed that it would be helpful to have an entity to work with.  He also talked with the XML folks.

Abbie asked do you think it makes sense to have Eve part of the next call?

Andrew replied yes.  It would be good to have a more formal discussion.

Abbie said at one stage we didn’t want to do a protocol.  But previously Eve was disappointed that we didn’t have a protocol. Glad she spoke up.  Talking with Eve to get her point of view from the UMA side is good.  Having a request response protocol is not that difficult. We can have the abstraction, and then can bind it to other protocols.  I want to see how UMA would like to see it. Who would like to talk to Eve about this?

Andrew replied that he has paved the way. In your role would be good to reach out to Eve.

*** Abbie took and action item to reach out to Eve.

Cathy asked from a NIST perspective do you have an opinion on how our protocol would fit (there is also FCCX) within a proper privacy framework? From her perspective there are 3 aspects:

·         That biometrics are included (unlike 800-63).  Also today in SAML it isn’t one of the authNcontexts. 

·         Equivalences and stepping up and looking at a variety of methods, how do we deal with equivalences of combinations of methods?

·         If biometrics are included use existing bio standards for interoperability.  Also WS for biometrics.  Kevin do you have others?

Kevin commented those are two he would mention as well.

Abbie asked do we care about the exchange of biometrics? Or do we want the exchange of attestation or attributes?  Cathy uses authN using fingerprint equivalent of LOA-2 for example. 

Cathy replied that speaks to the architecture alternatives. If you aren’t getting into how the authentication itself is done, but if the protocol allows the bio to be sent back to a server based verifier, you may open that door.  That is a big question.

Abbie we are now at a stage that we need to firm our assumptions. If we will use stuff from BIAS, we need to get them involved so that we are doing it right. The attribute that we use, do we care how it is done?  From an architectural perspective how far down the stack do we need to go?  Number 2 is discovery.  It isn’t the same from each mobile device and whether you are roaming. When you do an interaction do we required the discovery service to know how you go up in the process. Is there a charge?  Do we require (or support) that?  These are the issues. We don’t want the protocol to be so complex that no-one uses it. We need a track record that the TC collectively made a decision.

Cathy agrees this is a basic decision. There are pros and cons. On the biometric side it would appear that local matching is good, but it implies a lot of things on the local side that may or may not be true. There is a wide variation in strength and how the biometric is protected.

Abbie stated if we can’t replace UN/PW with the protocol than we have failed.  We need to design it so that there is end to end trust up to a reliability factor. We are not competing with FIDO.

Shaheen said he is on the same page. We need to build that architecture. The most important thing is how do we fit into the existing frameworks. We don’t want to sit in a silo. It is important to have those conversations right away.  

Abbie will be traveling and will miss the next editor’s call.  Between now and the next call, we can synchronize with Eve and suggest some core decisions. So between Andrew and me (anyone who wants to participate can) we need to make some architectural decisions and then validate it with other entities before we get too far along to make sure we are solving the right problem.  

Shaheen asked so what date?  August 14th?  We can agree on the time for this special “editor’s” call.

Abbie said we should also present our finding to NSTIC standards committees.

Cathy volunteered I think we could do that. 

Don can present to the TC standards group.

Abbie said we also need to align with IDAP.

Don has been working on a collaborating between IDAP and the TC.  IDAP will need trust-elevation. Don asked Abbie if he will be in UK next week. Don will be in the UK the first week of September.  He will try to coordinate a meeting for next week. He is also planning on meeting with Cathy about profiles of ODIC.

Don said at CIS he talked with Jeremy and his Canadian counterpart. They and Chris Fergusson were trying to have a lose coupling.

Abbie asked about what SecureKey is doing.

Don said SecureKey has an OIX pilot in UK and a FCCX pilot.

Abbie asked can we get SecureKey to participate in the TC so that we don’t get fragmentation?

Don responded as the UK publishes its requirements for an attribute exchange hub via OIX in September he will facilitate coordination.

Abbie said there is an underlying assumption about LOA that is missing. We should start the discussion today. Part of our architecture needs to be to plug into existing frameworks.  

Don said we have an opportunity with the US and UK pilots. They all required an open standard for trust-el.

Abbie said some of this may seem obvious, but it is pioneering.  Some think OTP solves everything. But it doesn’t.  Everyone doesn’t understand that yet.  So we need to keep pushing and coordinating. So I think we have a plan any other comments?

Diana said so do we have a list of existing frameworks we want to interoperate with? FCCX, SecureKey, Canada, UK and US, UMA, SAML, XACML, OAuth and OIDC. But the assumptions are big.  OIDC has a discovery service – it should plug and play there.

5. Adjourn

Abbie asked for a motion to adjourn.

Diana made the motion.

Don seconded the motion.                                  

The meeting was adjourned.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 

anonymous morphed into Shaheen