Assurance

[Nick Roy <>]

Has anyone from the InCommon community looked at this and/or thought about commenting on it?

Best,

Nick

-------- Forwarded Message --------

Subject:	[REFEDS assurance] Feedback for REFEDS SFA Profile draft
Date:	Wed, 18 Oct 2017 13:03:23 +0000
From:	Ziegler, Jule
Reply-To:	Ziegler, Jule
To:	,
CC:	Maarten Kremers , Lukas Hämmerle , Schmidt, Michael , Mikael Linden

Dear REFEDS Assurance WG,

 

as you all know, the RAF references the Single-Factor Authentication (short „SFA“) Profile, for which we now have prepared a first draft which can be found here:

 

https://docs.google.com/document/d/1HOcM2o4N7Ly9elRd5OQH2dCmfjY83WBv7ZCPgFysNmE/edit

 

We kindly ask you to please have a look at the SFA profile draft and provide us your feedback in the google doc until the REFEDS Assurance WG Call in around 2 1/2 weeks time.

 

During the last REFEDS Assurance WG Calls we decided to use NIST 800-63B requirements as criteria for single factors instead of defining our own set of criteria.

Additionally, we plan to provide a BCP for commonly used standard SFA scenarios (in the first stage only for passwords covering e.g. Active Directory). Conformance to one of the BCP standard SFA scenarios would automatically qualify for communicating the usage of SFA. We’ve set the baseline for standard tools a bit lower than as for self implemented solutions (see criteria 1).

Since the BCP is still work in progress it will be published here later.

 

We’re looking forward for helpful discussions.

 

Thanks,

Jule&Michael