Subject: [dix] requirements

From: John Merrells <[email-masked]>
Date: Mon, 20 Feb 2006 21:01:25 -0800

In preparation for a W3C workshop on authentication I submitted a  
paper on
the requirements for a digital identity architecture. They're based  
on the Seven
Laws of Identity, documented by Kim Cameron, and were used to drive our
protocol design work at Sxip.

I thought it might be useful input to the conversation here.

John

Blog Post: http://www.identity20.com/

Full Paper Here: http://identity20.com/media/images/W3CWebAuth_Sxip.pdf

Kim's Work: http://www.identityblog.com/stories/2004/12/09/thelaws.html

Summary of the requirements....

1. Provide a mechanism for presenting users with the information that  
is being requested.

2. Provide a mechanism for users to identify the recipient of the  
identity information they
release.

3. Provide a mechanism for relying parties to inform users of the  
reason for requesting the
information and how the information will be used.

4. Provide a mechanism for users to compartmentalize their identity  
information according
to the context of the interaction.

5. Provide a mechanism that ensures that user information is only  
released after the user
consents to its release.

6. Provide a mechanism for the user to specify what the relying party  
can do with the
information.

7. Provide users with a mechanism for granular control over the  
information that they are
releasing.

8. Provide a mechanism for separating the transaction for acquiring a  
claim from the
transaction for presenting a claim.

9. Provide users with the ability to choose their identity storage  
agent.

10. Provide pairwise identifiers for anonymous identity transactions.

11. Provide identifiers for public identity transactions.

12. Provide interoperability with existing platforms and standards.

13. Provide a low barrier to entry.

14. Provide a consistent user experience by ensuring that the user  
always sees the same
agent, regardless of the context.

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: Thomas Roessler <[email-masked]>
Date: Tue, 21 Feb 2006 10:27:18 +0100

On 2006-02-20 21:01:25 -0800, John Merrells wrote:

> In preparation for a W3C workshop on authentication I
> submitted a paper on the requirements for a digital identity
> architecture.

> Kim's Work: http://www.identityblog.com/stories/2004/12/09/thelaws.html

Workshop web site, with links to all the position papers:

  http://www.w3.org/2005/Security/usability-ws/

Just FYI...

Regards,
-- 
Thomas Roessler, W3C   <[email-masked]>

---

From: Dave Crocker <[email-masked]>
Date: Tue, 21 Feb 2006 21:26:13 -0800

> Summary of the requirements....

While I understand that reading the cited material will, no doubt, answer basic 
questions, I'll use the fact that you provided a summary to justify asking a 
few, basic questions.  Your summary list does not seem to answer them, yet I 
believe the answers to these questions provide a basis for evaluating something 
like the summary list you provided.

That is, I see your summary list is mostly about mechanism, whereas my own 
questions are about motivating factors:

1. What problem does DIX solve and for whom? How is the problem currently manifest?

2. What does a basic scenario for using DIX look like?  That is, who are the 
typical actors and what are their typical interactions, for a single, "complete" 
use of DIX?

3. From the summary, I cannot tell what the actual "identity" is, where it comes 
from, and whether or how it is assured uniqueness.

Thanks.

d/
-- 

Dave Crocker
Brandenburg InternetWorking
<http://bbiw.net>

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 24 Feb 2006 10:09:57 -0700

Dave Crocker wrote:

> While I understand that reading the cited material will, no doubt,
> answer basic questions, I'll use the fact that you provided a summary to
> justify asking a few, basic questions.  Your summary list does not seem
> to answer them, yet I believe the answers to these questions provide a
> basis for evaluating something like the summary list you provided.
> 
> That is, I see your summary list is mostly about mechanism, whereas my
> own questions are about motivating factors:
> 
> 
> 2. What does a basic scenario for using DIX look like?  That is, who are
> the typical actors and what are their typical interactions, for a
> single, "complete" use of DIX?
> 
> 3. From the summary, I cannot tell what the actual "identity" is, where
> it comes from, and whether or how it is assured uniqueness.

Good questions.

I helped write the spec for a technology called Passel that attempted to
solve some problems in this space, and the whitepaper may be of interest
to those on this list:

http://passel.org/whitepaper.html

Peter

- --
Peter Saint-Andre
Jabber Software Foundation
http://www.jabber.org/people/stpeter.shtml

---

From: Dick Hardt <[email-masked]>
Date: Fri, 24 Feb 2006 09:17:51 -0800

On 24-Feb-06, at 9:09 AM, Peter Saint-Andre wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Dave Crocker wrote:
>

Peter, will you be at the BOF, and if so, would you present the  
Passel work?

-- Dick

---

From: Dave Crocker <[email-masked]>
Date: Fri, 24 Feb 2006 09:39:04 -0800

> http://passel.org/whitepaper.html

Something like that provides good input.

However...

I think the real issue is getting participants on the list to share a basic
model.  External papers won't do that.

The summary list that prompted my own questions was specifically useful for
making explicit, brief statements to the group, for the group to consider.  My
feeling is that we need to do same, simple, explicit thing for answering the
questions I asked.

Until we have that, and until we have converged on agreement about the answers,
we are likely -- actually I consider it a certainty -- to have folks wandering
about the mailing list with wildly different assumptions and expectations about
the work and the desired output.

d/

-- 

Dave Crocker

---

From: Lisa Dusseault <[email-masked]>
Date: Fri, 24 Feb 2006 10:18:19 -0800

Dave,

It's my hope that some illustrative examples, if presented briefly  
and succinctly more for their goals/differences than for their  
technical details, will be of great help.  Examples can:
  - help people understand abstract goals, and as importantly,  
understand them in the same way (I've seen people interpret a  
requirement like "privacy" very differently and not even realize  
their different interpretations, until concrete cases came up)
  - convince BOF attendees who haven't worked on such a system  
personally that such systems exist, are deployed, are not theoretical  
or research

I'll work with the BOF speakers to make sure that the presentations  
of existing solutions focus on high-level stuff: problem statement,  
goals and requirements, models and key differences.

I do agree with your list of questions and that they need to be  
answered, let's work on that.  I encourage the people involved in  
SXIP and Passel and anything else to post real use cases they feel  
are particularly illustrative.

In the meantime, I expect people participating on this list in  
advance of the BOF to read the documentary input.

Thanks,
Lisa

---

From: John Merrells <[email-masked]>
Date: Sun, 26 Feb 2006 21:01:38 -0800

On 21-Feb-06, at 9:26 PM, Dave Crocker wrote:

> 2. What does a basic scenario for using DIX look like?  That is,  
> who are the typical actors and what are their typical interactions,  
> for a single, "complete" use of DIX?

I'll write some scenarios that illustrate the problems being solved,  
which
  should answer both these questions.

> 3. From the summary, I cannot tell what the actual "identity" is,  
> where it comes from, and whether or how it is assured uniqueness.

Well, 'identity' is a bit of a philosophical term. Perhaps it is  
simpler to deal
with an 'identifier'. But, your question relates to implementation  
issues,
rather than design requirements.

In the implementation detailed in dmd0 the identifier is a defined to be
a URI, and a URL mechanism is detailed whereby a Delegation Tag is
placed in the page at the end of the URL that delegates authentication
to a list of Homesites. So, where it comes from is essentially a web  
server,
and its uniqueness is based on its reuse of the domain namespace.

John

---

From: Dave Crocker <[email-masked]>
Date: Mon, 27 Feb 2006 11:58:19 -0800

John,

> Well, 'identity' is a bit of a philosophical term. Perhaps it is simpler 
> to deal
> with an 'identifier'. But, your question relates to implementation issues,

My #3 question was really 3 questions, starting with concept and ending with a 
technical detail.  Since the word identity is quite literally central to D*I*X, 
the meaning of identity needs to be more than philosophical.

> to a list of Homesites. So, where it comes from is essentially a web 

All of this is fine-grained detail.  That nature of the questions I am asking 
are intended to provide answers that non-technical people can understand. 
Non-technical people are going to be using it, so it would help if the nature of 
this stuff could be explained to them, without language like delegation tag, etc.

> and its uniqueness is based on its reuse of the domain namespace.

ok.  so, domain name, but something within the domain name (nonce, or whatever), 
to ensure uniqueness.  Hence, each DNS administration is a sub-registry for DIX 
identities.

d/

-- 

Dave Crocker

---

From: John Merrells <[email-masked]>
Date: Mon, 27 Feb 2006 12:30:42 -0800

On 27-Feb-06, at 11:58 AM, Dave Crocker wrote:

> My #3 question was really 3 questions, starting with concept and  
> ending with a technical detail.  Since the word identity is quite  
> literally central to D*I*X, the meaning of identity needs to be  
> more than philosophical.

I think of 'digital identity' as one word. I'm not hung up on  
defining 'identity'.
The X.500/LDAP universe of discourse worked fine without drilling  
into it.
Have a stab at it if you think it'll help. The Internet Identity  
Workshop has
been kicking all this stuff about for a while. I'd rather this group  
focused on
the technical realization of an architecture for user-centric digital  
identity.

> All of this is fine-grained detail.  That nature of the questions I  
> am asking are intended to provide answers that non-technical people  
> can understand. Non-technical people are going to be using it, so  
> it would help if the nature of this stuff could be explained to  
> them, without language like delegation tag, etc.

Well, hopefully some use cases will cover that too.

> ok.  so, domain name, but something within the domain name (nonce,  
> or whatever), to ensure uniqueness.  Hence, each DNS administration  
> is a sub-registry for DIX identities.

Based on dmd0, where the identifier is a URL - Yes.

e.g.

http://www.bbiw.net/dave
http://www.bbiw.net/user1234
http://www.bbiw.net/ontimeuuid-1234-abcdef-4567-abcd

But, DIX could use some other namespace that has the right properties.
URIs, or as Phillip proposed email addresses.

John

---

From: Dick Hardt <[email-masked]>
Date: Mon, 27 Feb 2006 12:53:39 -0800

> literally central to D*I*X, the meaning of identity needs to be  

In my Identity 2.0 talk[1], I describe Identity as being who you are.  
This is a very broad statement, and is intended as such. What DIX is  
about is how can the user move any information concerning themselves  
around. Some of those properties are self asserted, and other  
properties tend to require assertion by trusted third parties. Your  
identity is the collection of all of these properties. This can be  
anything from my favorite movies and books so that I can rapidly  
educate an etailer what I like, to proof that I am canadian, over 21  
and that I work at Sxip. I even include transactions that you have  
been a party to. When I return a purchase to store, the identity that  
I am using is the receipt to show that it was I (or someone I am  
acting on behalf of) that made the purchase.

[1] http://www.identity20.com/media/OSCON2005/

---

From: Dave Crocker <[email-masked]>
Date: Mon, 27 Feb 2006 13:46:56 -0800

> I think of 'digital identity' as one word. I'm not hung up on defining 
> 'identity'.
> The X.500/LDAP universe of discourse worked fine without drilling into it.

By way of suggesting a line of discussion:

I think that the X.500 world has not worked all that fine at all, except within 
very constrained environments.  The scale and diversity of the open Internet has 
been a notable failure for the X.500 world, although that was its original ta

> The Internet Identity Workshop has
> been kicking all this stuff about for a while. I'd rather this group focused on
> the technical realization of an architecture for user-centric digital identity. 

That presumes an Internet community consensus about both the meaning of the term 
identity, as it will be used here,  and the architecture for it.

I haven't noticed either present in the IETF arena, so I suspect you have some 
educating to do.

> In my Identity 2.0 talk[1], I describe Identity as being who you are. This is a

"who you are" is a reasonable place to begin, but does not have quite enough 
substance to direct technical work.  For example, the difference between a 
person performing in one role, versus another, might or might not require 
different identities.  It might even require some sort of identity "hierarchy".

Yes, all of these issues have been discussed in specialized circles for some 
decades.

The issue I am raising, here, is that the engineering work to be pursued here 
needs to list specific choices for these things and has to have community 
agreement on those choices.

So, before there is any discussion of formats and protocol rules, there needs to 
be an understanding of the capabilities and constraints of the construct 
"identity" used for this work.
d/
-- 

Dave Crocker

---

From: John Merrells <[email-masked]>
Date: Mon, 27 Feb 2006 14:33:57 -0800

On 27-Feb-06, at 1:46 PM, Dave Crocker wrote:

> I think that the X.500 world has not worked all that fine at all,

You switched topics from 'X500/LDAP universe of discourse' to  
'success of X500'...

> except within very constrained environments.  The scale and  
> diversity of the open Internet has been a notable failure for the X. 
> 500 world, although that was its original ta

Hence LDAP.

And, by analogy DIX.

> That presumes an Internet community consensus about both the  
> meaning of the term identity, as it will be used here,  and the  
> architecture for it.
>
> I haven't noticed either present in the IETF arena, so I suspect  
> you have some educating to do.

You could join the IIW group.

> "who you are" is a reasonable place to begin, but does not have  
> quite enough substance to direct technical work.  For example, the  
> difference between a person performing in one role, versus another,  
> might or might not require different identities.  It might even  
> require some sort of identity "hierarchy".

Which motivates the desire for compartmentalization of identity.

> Yes, all of these issues have been discussed in specialized circles  
> for some decades.
>
> The issue I am raising, here, is that the engineering work to be  
> pursued here needs to list specific choices for these things and  
> has to have community agreement on those choices.
>
> So, before there is any discussion of formats and protocol rules,  
> there needs to be an understanding of the capabilities and  
> constraints of the construct "identity" used for this work.

Think we've come full circle Dave.

John

---

From: John Schnizlein <[email-masked]>
Date: Mon, 27 Feb 2006 17:40:59 -0500

What about using a Network Access Identifier (NAI) [RFC 4282]?

John

---

From: Dick Hardt <[email-masked]>
Date: Mon, 27 Feb 2006 14:41:02 -0800

> require some sort of identity "hierarchy".

I see that people will have many personas, but only one identity.  
Each persona presents a different facet of themselves.

> has to have community agreement on those choices.

Do we need to preclude what is and is not identity? ... if we have an  
open mechanism for adding to the identity data that can be moved  
around, we will have a platform for moving around any identity data.

In our ID, we intentionally left out describing the specifics of what  
could be moved around, our goal was to provide a mechanism for any  
organization to define properties that could be moved around and  
defining them as URIs.

> constraints of the construct "identity" used for this work.

Philips related post I think covers this a little, and his comments  
point out what I think is an important aspect of identity protocols.

There is an implicit and often overlooked aspect of identity, which  
is the identity of session between machines. I use the term session  
here quite broadly, I mean for it to be a way for one machine to know  
that a message it receives is related to a previous message.

When we talk about identity, there are two aspects, one is the  
property, and the other is who the property is about. Over 21 is  
rather useless. The entity at the other end of a session being over  
21 is useful. Let's call tying a property to an identifier a claim.  
In this case, the identifier is the session. But the identifier could  
be something else that has more permanence. Philip used [email-masked]  
as an example.  [[email-masked] is over 21] is a claim that will be  
true the rest of my life (as long as [email-masked] is associated with  
me :-)

This leads to me controlling who can say they are [email-masked]. If  
only I can claim that the a session is associated with [email-masked],  
then I will be the only where the claim [[email-masked] is over 21] is  
considered valid.

Does this clarify your question Dave, or am I missing something?

-- Dick

---

From: John Schnizlein <[email-masked]>
Date: Mon, 27 Feb 2006 18:16:34 -0500

On Feb 27, 2006, at 5:41 PM, Dick Hardt wrote:

>> "who you are" is a reasonable place to begin, but does not have quite 
>> enough substance to direct technical work.  For example, the 
> I see that people will have many personas, but only one identity. Each 
> persona presents a different facet of themselves.

Slippery slope alert!

This statement seems to mix the every-day meaning of identity with the 
formal definition that is necessary for technical progress.  What is 
the precise relationship between a persona and an identity?  Who gets 
to know that relationship?

John

---

From: David Boreham <[email-masked]>
Date: Mon, 27 Feb 2006 16:22:58 -0700

> require some sort of identity "hierarchy".

I think this is a rat hole that we don't need to go down.
Users do just fine with multiple 'identities' given to them, or assumed,
for whatever tasks they need to perform. We do not, for example,
get worked up because my state drivers licence does not refer
to my country passport number (and in my case the two are
issued by different countries which I'm sure makes for an interesting
hierarchy).

> pursued here needs to list specific choices for these things and has 
> to have community agreement on those choices.
>
> there needs to be an understanding of the capabilities and constraints 
> of the construct "identity" used for this work.

I think this is a red herring. It is not necessary to define what humans 
mean by 'identity' for this work.
Instead all we need to do is define what the computers that implement 
the DIX protocol mean by
'identity' : a much easier task IMHO.

I believe that all we need to know is that one identity needs to be 
differentiated from another one
and that we have 'stuff' that belongs to each identity.

---

From: Dave Crocker <[email-masked]>
Date: Mon, 27 Feb 2006 15:37:33 -0800

> and that we have 'stuff' that belongs to each identity.

The closer an IETF activity gets to humans and social activities, the less it 
seems to be possible to indulge in the view that the computer perspective is 
what counts.

Comments, so far, have tended to stress both the generality and the 
computer-side orientation of the DIX work, with an apparent lack of focus on 
specific human uses.

 From my own experience, it is not possible to raise flags that are higher or 
more red.

I wish this did not sound quite so reminiscent of the original X.500 work.

d/

-- 

Dave Crocker

---

From: Dick Hardt <[email-masked]>
Date: Mon, 27 Feb 2006 15:41:55 -0800

On 27-Feb-06, at 3:16 PM, John Schnizlein wrote:

>>> quite enough substance to direct technical work.  For example,  
>>> the difference between a person performing in one role, versus  
>>> another, might or might not require different identities.  It  
>>> might even require some sort of identity "hierarchy".
>>
> This statement seems to mix the every-day meaning of identity with  
> the formal definition that is necessary for technical progress.

Perhaps the formal definition should be adjusted to the everyday  
meaning so that it is more useful? ... and we user other terms that  
are nice and specific for clarity.

> What is the precise relationship between a persona and an identity?

I have an identity. It is all the properties about me. I want a means  
of moving that identity data to a site.

A persona is a set of properties aka. identity data.

>   Who gets to know that relationship?

The user.

---

From: Lisa Dusseault <[email-masked]>
Date: Mon, 27 Feb 2006 16:00:24 -0800

On Feb 27, 2006, at 3:22 PM, David Boreham wrote:
>
> I think this is a red herring. It is not necessary to define what  
> humans mean by 'identity' for this work.
> Instead all we need to do is define what the computers that  
> implement the DIX protocol mean by
I agree with the first paragraph.

The second not quite, I'm sure we'll need a little more.  Using my  
own terminology, an identity is also something that a client can  
assert, where that assertion will be backed up by an identity server,  
and where the ability to assert said identity is a sufficiently  
limited ability for the assertion to be a useful piece of information.

(For client, read agent if you prefer)

Lisa

---

From: Lisa Dusseault <[email-masked]>
Date: Mon, 27 Feb 2006 16:35:45 -0800

Some thoughts on that suggestion.

1. The terminology of RFC4282 assumes a "Network Access Server" but  
there's no structural reason that can't be any identity server, not  
just the one that's providing the user with network access.

2. The identity "redirects" of RFC4282 -- the part that requires the  
"!" (exclamation mark) separator between realms -- is of unclear  
purpose to me.  It might muddy the waters as I think assertable  
digital identity does not require redirects.  I may be wrong.

3.  Why aren't those identifiers in URI format?  URI format is very  
useful for building on many Web technologies.  If RF4282 were used, I  
would think it would have to be with a scheme added to be URI compliant.

Lisa

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Tue, 28 Feb 2006 04:11:56 +0100

At 00:22 28/02/2006, David Boreham wrote:
>differentiated from another one and that we have 'stuff' that 
>belongs to each identity.

I joined your debate only for a few days, so may be this is something 
you discussed and already killed?

For me a network identity is an information that entity A can send to 
entity B so entity B can uniquely, surely, reliably, consistently and 
permanently identify and internally document entity A among all the 
Internet entities, and possibly to carry an authentication. If 
possible without leaking any information on entities A and B during 
the process. I think there also should be the requirement that entity 
B can pass that information onto entity C and that entity C is then 
able to uniquely, etc. identify entity A.

I have no prerequisite about entities being a human, a machine, an 
application, a relation, an event, an information object, etc. or 
their avatars. However the entity carrying the identification must be 
able to process it (human or computer). Also, I tend to think that 
the best identity system is not protected, to reduce the risk of 
errors. Also, I think it should be as much as possible independent 
from any particular network technology.

The avatar issue (an entity having several different identity roots) 
is, IMHO, addressed by the identity consistency and permanence. The 
difference between persona and avatars I make is that a persona is a 
variation of the same identity root. An avatar uses another non 
related indenty root. An avatar can have different personas.

jfc

---

From: Ben Laurie <[email-masked]>
Date: Tue, 28 Feb 2006 10:46:29 +0000

John Schnizlein wrote:
> formal definition that is necessary for technical progress.  What is the
> precise relationship between a persona and an identity?  Who gets to
> know that relationship?

There is a document that defines all the terms you could need for this
discussion, and then some. I'd suggest we don't argue over terminology
and just adopt it:

"Anonymity, Unlinkability, Unobservability, Pseudonymity, and Identity
Management - A Consolidated Proposal for Terminology"

which can be found here:

http://dud.inf.tu-dresden.de/Anon_Terminology.shtml

Incidentally, it defines identity like this:

"An identity is any subset of attributes of an individual which
identifies this individual within any set of individuals. So usually
there is no such thing as “the identity”, but several of them."

The word "persona" does not come up at all. Which is probably a good thing.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Tue, 28 Feb 2006 15:45:09 +0100

At 11:46 28/02/2006, Ben Laurie wrote:
>there is no such thing as "the identity", but several of them."

I agree. My definition is more construed and can be used as part of 
an analysis.

>The word "persona" does not come up at all. Which is probably a good thing.

I understand persona as one of these subsets?
jfc

---

From: Dick Hardt <[email-masked]>
Date: Tue, 28 Feb 2006 11:26:01 -0800

> I agree. My definition is more construed and can be used as part of  

I can go with that definition. Would all of the attributes be "your  
identity"

Also, there would be an almost infinite number of combinations, so  
you have an unlimited number of identities.

> I understand persona as one of these subsets?

I would suggest that persona is a *persistent* identity.