Level 3 and 4 Credentials in the Exosystem (3H)

Level 3 & 4 Credentials in the Ecosystem (3H)

Convener: Mike Magrath

Notes-taker(s): Mike Magrath

Tags for the session - technology discussed/ideas considered:

Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:

• Question on Levels and their meaning ,and benefit, and what the level mean
• Use Cases: Sensitive, personal info such as healthcare and financial institutions
• Other bodies have other definitions
• Europe has only one level
• Need policy for what can be done at what level (e.g. how much credit you can get with a credential)
• Bindings, proofing, etc. are criteria in various levels
• US Federal Government is not liable, but there is liability in Europe
• FIPS 201 and SP800-63 is for government and for G2C, G2B, C2G, etc.
  • o SP800-63 written for issuer and relying party
• How does the consumer use Level 3 in the commercial world?
• Use out of band transactions to verify identity to obtain a higher level credential
• Actually care about the attributes involved for a transaction rather than an arbitrary assurance level
• Back end fraud protection is what give value to PayPal and eBay rather than the authentication
• Identity credentials are not transaction credentials and the same authentication might not be appropriate
• Open Identity Exchange exists and is a starting point so Trust Frameworks can be formed
• It is not just about the authentication, but the validation of the source that counts
• Does one have to notify when a street identity is “invalid?”
• There is also an issue of confidence level of attribute – How old is it?
  • o Police accept a Driver’s License address that is 5 years old
• Will people use a smartphone to logon to a computer?
• If embedded in phone (ubiquitous terminalization) it will be more accepted
  • o Low payment only?
  • o Healthcare?
  • o When do you need the higher assurance?
• If pervasive smartphones bring down cost, the gap for acceptance and use of high assurance goes away
• Do we use the Carrot or the Stick?