Subject: [plasma] Levels of assurance

From: "Fitch, Scott C" <[email-masked]>
Date: Tue, 25 Oct 2011 18:56:11 +0000

Is it necessary to require levels of assurance in the Basic Policy requirements? I definitely think it's appropriate for Advanced Policies. But I wonder whether including levels of assurance in Basic Policies will impede adoption.

Also, the fact that there are multiple LOA frameworks out there makes it difficult to meet the requirement to NOT require a priori bilateral agreements between the sender and recipient for Basic Policies. If the sender and recipient use different LOA scales, then some type of prior agreement must be in place to map the two scales. I don't think plasma wants to get into the business of creating a standard LOA mapping for interoperability.

-Scott

---

From: Leif Johansson <[email-masked]>
Date: Wed, 26 Oct 2011 09:37:26 +0200

> Also, the fact that there are multiple LOA frameworks out there makes it difficult to meet the requirement to NOT require a priori bilateral agreements between the sender and recipient for Basic Po…

Supporting multiple LOA frameworks is partly a technical issue and
partly a policy issue. The technical issue is that we need a way to
communicate LOA per transaction.

In SAML WebSSO there are technical controls (AuthenticationContext)
for communicating LOA [1]

[1]
http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-assurance-profile.html

	Cheers Leif

---

From: Trevor Freeman <[email-masked]>
Date: Wed, 26 Oct 2011 22:03:47 +0000

I think it's a fair question as to why basic policy should have this one variable. Why not require any form of LoA to be an advanced policy.

>From an implementation perspective it would be a huge tax on applications to require they support advanced polices. It would be reasonable to require they support basic policy under this profile and to do that we need to make it a lightweight as possible. However, a very frequent request is to require something better than a simple password for authentication. 

What I don't want is to see a lot of use cases broken because policy wants something better than a password and the client only supports basic policy.  Having the LoA in basic policy was my attempt to make sure that gap did not happen. 

If there is some other way to ensure we can support things better than passwords while not mandating LoA support in the policy  I would welcome it as I do want basic to be a simple as possible.

Trevor

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Leif Johansson
Sent: Wednesday, October 26, 2011 12:37 AM
To: [email-masked]
Subject: Re: [plasma] Levels of assurance

> Also, the fact that there are multiple LOA frameworks out there makes it difficult to meet the requirement to NOT require a priori bilateral agreements between the sender and recipient for Basic Po…

Supporting multiple LOA frameworks is partly a technical issue and partly a policy issue. The technical issue is that we need a way to communicate LOA per transaction.

In SAML WebSSO there are technical controls (AuthenticationContext) for communicating LOA [1]

[1]

	Cheers Leif
_______________________________________________
plasma mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/plasma

---

From: Trevor Freeman <[email-masked]>
Date: Fri, 28 Oct 2011 17:24:29 +0000

I forgot to address the second part - general acceptability of LoA framework.

There are environments where they operate sometime by consensus rather than bilateral agreements e.g. healthcare. While Healthcare does has some bilateral agreements, there are so many potential relationships it is impractical to set up all you may need. The last thing you would want is for access to an out of town ER patients record to be blocked because if the lack of a bilateral agreement.  
 
Within any organization, there are ad-hoc communications which happen where you have not yet established a relationship. If you don't accept some form of LoA with basic policy, then those communications would be forced to be implicitly level 1. Equally if you organization is to against accepting a LoA, you could just use level 1 - which practically is the same thing.

I was not thinking we would map LoA scales. The challenge for Plasma is get consensus for a specific LoA scale that we could all adopt for basic policy.  It will likely be like UN treaty negotiation where nobody is relay happy with the outcome but it's something that you can live with. 

Trevor

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Fitch, Scott C
Sent: Tuesday, October 25, 2011 11:56 AM
To: [email-masked]
Subject: [plasma] Levels of assurance

-Scott