REFEDS Assurance wg call
Monday 8 January 2018 at 15:30 CET/8:30 CST
CERN’s Vidyo portal: https://www.nikhef.nl/grid/video/?m=rawg

Tom
Pål
Michael and Jule
Alan
David L
Mikael

Notes

• Single-factor authentication profile and associated minimum requirements(Michael, Jule)
  • SFA profile: https://docs.google.com/document/d/1HOcM2o4N7Ly9elRd5OQH2dCmfjY83WBv7ZCPgFysNmE/edit?usp=sharing
    • add OIDC acr value to the profile
    • keep a reference to NIST 800-63B that people remember it has been the underlying standard
  • Minimum requirements documents
    • approximates compliance with 800-63B
    • each new minimum requirement document (earlier: “template”) will be approved by REFEDS after a public consultation
    • keep the process to approve new minimum requirements outside this document (described in the website)
    • currently one: minimum requirements for passwords https://docs.google.com/document/d/1iUp9ls7FLlk1_xGHDLBsa1LuBxqFWTv4PyYr2cefI3A/edit?usp=sharing
    • in the future we may have also minimum requirements for one-time passwords, soft certificates, etc
    • add extension points that there can be also compensating controls to mitigate the risk
    • take into account that the components integrate with others -- what matters is that together they need to cover the requirements
  • Recipe documents
    • describe how the minimum requirements can be met with particular products or combination of products
    • REFEDS can publish them when it adds value but they are not exposed to a public consultation
    • currently we have: recipe to meet minimal requirements for passwords with AD and with OpenLDAP

• mounting REFEDS Assurance Framework on OIDC
  • please contribute: https://docs.google.com/document/d/12tqvUcZ224PQTGr4INrb346aTZH7J5hch-WbifWlqXA/edit#

•  next call
  • Monday 22 Jan at 15:30 CET/8:30 CST