One document matched: draft-richer-vectors-of-trust-00.xml


<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
<?rfc toc="yes"?>
<?rfc tocompact="yes"?>
<?rfc tocdepth="3"?>
<?rfc tocindent="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes"?>
<?rfc comments="yes"?>
<?rfc inline="yes"?>
<?rfc compact="yes"?>
<?rfc subcompact="no"?>
<rfc category="std" docName="draft-richer-vectors-of-trust-00"
     ipr="trust200902">
  <front>
    <title abbrev="vectors-of-trust">Vectors of Trust</title>

    <author fullname="Justin Richer" initials="J." role="editor"
            surname="Richer">
      <organization>Bespoke Engineering</organization>

      <address>
        <email>ietf@justin.richer.org</email>
      </address>
    </author>

    <author fullname="Leif Johansson" initials="L." surname="Johansson">
      <organization>Swedish University Network</organization>

      <address>
        <postal>
          <street>Thulegatan 11</street>

          <city>Stockholm</city>

          <region/>

          <code/>

          <country>Sweden</country>
        </postal>

        <phone/>

        <facsimile/>

        <email>leifj@sunet.se</email>

        <uri>http://www.sunet.se</uri>
      </address>
    </author>

    <date day="26" month="June" year="2015"/>

    <abstract>
      <t>This document defines a mechanism for describing and signaling
      several aspects that go into a determination of trust placed in a
      digital identity transaction.</t>
    </abstract>

    <note title="Requirements Language">
      <t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
      "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
      document are to be interpreted as described in <xref
      target="RFC2119">RFC 2119</xref>.</t>
    </note>
  </front>

  <middle>
    <section anchor="Introduction" title="Introduction">
      <t>This document defines a mechanism for describing and signaling
      several aspects that go into a determination of trust placed in a
      digital identity transaction. Instead of communicating</t>

      <section title="Terminology">
        <t><list style="hanging">
            <t hangText="Identity Provider (IdP)">A system that manages
            identity information and is able to assert this information across
            the network through an identity API.</t>

            <t hangText="Relying Party (RP)">A system that consumes identity
            information from an IdP for the purposes of logging users in.</t>

            <t hangText="Trust Framework">A document containing business rules
            and legal clauses that defines how different parties in an
            identity transaction may act.</t>

            <t hangText="Trustmark">A verifiable attestation that a party has
            proved to follow the constraints of a trust framework.</t>

            <t hangText="Trustmark Provider">A system that issues and provides
            verification for trustmarks.</t>

            <t hangText="Vector">A multi-part data structure, used here for
            conveying information about an authentication transaction.</t>

            <t hangText="Vector Component">One of several constituent parts
            that make up a vector.</t>
          </list></t>
      </section>
    </section>

    <section anchor="Background" title="Background and Motivation">
      <t>The NIST special publication <xref target="SP-800-63">800-63</xref>
      defines a linear scale Level of Assurance (LoA) measure that combines
      multiple attributes about an identity transaction into a single measure
      of the level of trust a relying party should place on an identity
      transaction. Even though this definition was originally made for a
      specific government use cases, the LoA scale appeared to be applicable
      with a wide variety of authentication use cases. This has led to a
      proliferation of incompatible interpretations of the same scale in
      different trust frameworks, preventing interoperability between these
      frameworks in spite of their common measurement. </t>

      <t>Since identity proofing strength increases linearly along with
      credential strength, the LoA scale is also too limited for describing
      many valid and useful forms of an identity transaction. For example, an
      anonymously assigned hardware token can be used in cases where the real
      world identity of the subject cannot be known or is verified through
      some out of band mechanism. </t>

      <t>This work seeks to decompose the elements of the LoA values in a way
      that they can be independently communicated from an Identity Provider to
      a Relying Party, making comparison between trust frameworks
      possible.</t>

      <section anchor="Model" title="An Identity Model">
        <t>This document assumes the following (incomplete) model for
        identity.</t>

        <t>The identity subject (aka user) is associated with an identity
        provider which acts as a trusted 3rd party on behalf of the user with
        regard to a relying party by making identity assertions about the user
        to the relying party.</t>

        <t>The real-world person represented by the identity subject is in
        possession of a (cryptographic) primary credential bound to the user
        by (an agent of) identity provider in such a way that the binding
        between the credential and the real-world user is a representation of
        the identity proofing process performed by the (agent of) the identity
        provider to verify the identity of the real-world person.</t>
      </section>

      <section anchor="Architecture" title="Component Architecture">
        <t>The term Vectors of Trust is based on the mathematical construct of
        a Vector, which is defined as an item composed of multiple independent
        scalar values. A vector is a set of coordinates that specifies a point
        in a (multi-dimensional) Cartesian coordinate space. The reader is
        encouraged to think of a vector of trust as a point in a coordinate
        system, in the simples form (described below) a 3 dimensional space
        that is intended to be a recognizable, if somewhat elided, model of
        identity subject trust.</t>

        <t>An important goal for this work is to balance the need for
        simplicity (particularly on the part of the relying party) with the
        need for expressiveness. As such, this vector construct is designed to
        be composable and extensible. </t>

        <t>All components of the vector construct MUST be orthogonal in the
        sense that no aspect of a component overlap an aspect of another
        component.</t>

        <t>The values assigned to each component of a vector is sometimes
        written as an ordinal number (e.g. an integer) but MUST NOT be assumed
        as having inherent ordinal properties when compared to the same or
        other components in the vector space. In other words, 1 is different
        from 2, but it is dangerous to assume that 2 is always "more" (better)
        than 1.</t>
      </section>
    </section>

    <section anchor="Components" title="Core components">
      <t>This specification defines three orthogonal components: identity
      proofing, credential binding, and assertion presentation. These
      dimensions (as described below) are intentionally elided and SHOULD be
      combined with other information to form trust frameworks can be used as
      a basis for audits of identity providers and relying parties.</t>

      <t>This specification also defines values for each component to be used
      in the absence of a more specific trust framework. It is expected that
      trust frameworks will provide context, semantics, and mapping to legal
      statutes and business rules for each value in each component.
      Consequently, a particular vector value can only be compared with
      vectors defined in the same context. The RP MUST understand and take
      into account the trust framework context in which a vector is being
      expressed in order for it to be processed securely.</t>

      <t>It is anticipated that trust frameworks will also define additional
      components.</t>

      <section anchor="IdentityProofing" title="Identity Proofing">
        <t>The Identity Proofing dimension defines, overall, how strongly the
        set of identity attributes have been verified and vetted, and how
        strongly they are tied to a particular credential set. In other words,
        this dimension describes how likely it is that a given digital
        identity corresponds to a particular (real-world) identity
        subject.</t>

        <t>This dimension SHALL be represented by the <spanx style="verb">P</spanx>
        demarcator and a level value, such as <spanx style="verb">P1</spanx>,
        <spanx style="verb">P2</spanx>, etc.</t>
      </section>

      <section anchor="Credential" title="Credential Management">
        <t>Below we use the term "credential" to denote the credential used by
        the identity subject to authenticate to the identity provider.</t>

        <t>The Credential Binding dimension defines how strongly the
        credential can be verified by the IdP and trusted to be presented by
        the party represented by a given credential. In other words, this
        dimension describes how likely it is that the right person is
        presenting the credential to the identity provider, and how easily
        that credential could be spoofed or stolen. This component is intended
        to be a general category</t>

        <t>This dimension SHALL be represented by the <spanx style="verb">C</spanx>
        demarcator and a level value, such as <spanx style="verb">C1</spanx>,
        <spanx style="verb">C2</spanx>, etc. Multiple credential factors MAY
        be communicated simultaneously, such as when Multi-Factor
        Authentication is used.</t>
      </section>

      <section anchor="AssertionPresentation" title="Assertion Presentation">
        <t>The Assertion Presentation dimension defines how well the given
        digital identity can be communicated across the network without
        information leaking to unintended parties, and without spoofing. In
        other words, this dimension describes how likely it is that a given
        digital identity asserted was actually asserted by a given identity
        provider for a given transaction.</t>

        <t>This dimension SHALL be represented by the <spanx style="verb">A</spanx>
        demarcator and a level value, such as <spanx style="verb">A1</spanx>,
        <spanx style="verb">A2</spanx>, etc.</t>
      </section>
    </section>

    <section anchor="default-components"
             title="Vectors of Trust Inititial component definitions">
      <t>This specification defines the following general-purpose component
      definitions, which MAY be used when a more specific set is unavailable.
      These component values are referenced in a trustmark definition</t>

      <t><list style="hanging">
          <t hangText="P0">No proofing is done, data is not guaranteed to be
          persistent across sessions</t>

          <t hangText="P1">Attributes are self-asserted but consistent over
          time, potentially pseudonymous</t>

          <t hangText="P2">Identity has been proofed either in person or
          remotely using trusted mechanisms (such as social proofing)</t>

          <t hangText="P3">There is a legal or contractual relationship
          between the identity provider and the identified party (such as
          signed/notarized documents, employment records)</t>
        </list><list style="hanging">
          <t hangText="C0">No credential is used / anonymous public service /
          simple session cookies (with nothing else)</t>

          <t hangText="C1">Shared secret such as a username and password
          combination</t>

          <t hangText="C2">Known device with trusted enrollment process</t>

          <t hangText="C3">Cryptographic proof of key possession using shared
          key</t>

          <t hangText="C4">Cryptographic proof of key possession using
          asymmetric key</t>

          <t hangText="C5">Sealed hardware token / trusted biometric /
          TPM-backed keys</t>
        </list><list style="hanging">
          <t hangText="A0">No protection / unsigned bearer identifier (such as
          a session cookie)</t>

          <t hangText="A1">Signed and verifiable token, passed through the
          browser</t>

          <t hangText="A2">Signed and verifiable token, passed through a back
          channel</t>

          <t hangText="A3">Token encrypted to the relying parties key and
          audience protected</t>
        </list></t>
    </section>

    <section anchor="Combining" title="Communicating Vector Values to RPs">
      <t>All three of these dimensions (and others, as they are defined in
      extension work) MUST be combined into a single vector that can be
      communicated across the wire unbroken.</t>

      <t>All vector components MUST be individually available, MUST NOT be
      "collapsed" into a single value without also presenting the constituent
      dimensions as well.</t>

      <t>When communicating the vectors across the wire, they MUST be
      protected in transit and signed by the asserting authority (such as the
      IdP).</t>

      <section title="On the Wire Representation">
        <t>The vector MUST be represented as a period-separated ('.') list of
        vector components, with no specific order. A vector component type MAY
        occur multiple times within a single vector, separated by periods, in
        which case it is considered an AND of the two values. In order to
        simplify processing by RPs, it is RECOMMENDED that trust framework
        definitions carefully define component values such that they are
        mutually exclusive or subsumptive in order to avoid this situation
        where possible.</t>

        <t>Vector components MAY be omitted from a vector. No holding space is
        left for an omitted vector component. If a vector component is
        omitted, the IdP is making no claim for that category.</t>

        <t>For example, the vector value <spanx style="verb">P1.C3.A2</spanx>
        translates to pseudonymous, proof of shared key, signed back-channel
        verified token in the context of this specification's <xref
        target="default-components">definitions</xref>.</t>

        <t>Vector values MUST be communicated along side of a trustmark
        definition to give the components context.</t>
      </section>

      <section anchor="OIDC" title="In OpenID Connect">
        <t>In <xref target="OpenID">OpenID Connect</xref>, the IdP MUST send
        the vector value as a string with the <spanx style="verb">vot</spanx>
        (vector of trust) claim in the ID token. The <xref
        target="Trustmark">trustmark</xref> that applies to this vector MUST
        be sent as an HTTPS URL in the <spanx style="verb">vtm</spanx> (vector
        trust mark) claim to provide context to the vector.</t>

        <t>For example:</t>

        <figure>
          <artwork><![CDATA[{ 
    "iss": "https://idp.example.com/", 
    "sub": "jondoe1234", 
    "vot": "P1.C3.A2",
    "vtm": "https://trustmark.example.org/trustmark/idp.example.com"
}]]></artwork>
        </figure>
      </section>

      <section anchor="SAML" title="In SAML">
        <t>In SAML a VoT vector is communicated as an
        AuthenticationContextClassRef, a sample definition of which might look
        something like this:</t>

        <figure>
          <artwork><![CDATA[<?xml version="1.0" encoding="UTF-8"?>
<xs:schema
     targetNamespace="urn:x-vot:P1:C3:A2"
     xmlns:xs="http://www.w3.org/2001/XMLSchema" 
     xmlns="urn:x-vot:P1:C3:A2"
     finalDefault="extension"
     blockDefault="substitution"
     version="2.0">
     <xs:redefine 
         schemaLocation="saml-schema-authn-context-loa-profile.xsd"/>
 <xs:annotation>
    <xs:documentation>VoT vector P1.C3.A2</xs:documentation>
 </xs:annotation>
 <xs:complexType name="GoverningAgreementRefType">
    <xs:complexContent>
       <xs:restriction base="GoverningAgreementRefType">
          <xs:attribute name="governingAgreementRef"
             type="xs:anyURI"
             fixed="draft-ietf-vot-this-document-00.txt"
             use="required"/>
       </xs:restriction>
    </xs:complexContent>
 </xs:complexType>
 </xs:redefine>
</xs:schema>]]></artwork>
        </figure>
      </section>
    </section>

    <section anchor="RequestingVector" title="Requesting Vector Values">
      <t>In some identity protocols, the RP can request that particular
      attributes be applied to a given identity transaction.</t>

      <section anchor="RequestingOIDC" title="In OpenID Connect">
        <t>In <xref target="OpenID">OpenID Connect</xref>, the client can
        request a set of acceptable VoT values with the <spanx style="verb">vtr</spanx>
        (vector of trust request) claim request as part of the Request Object.
        The value of this field is an array of JSON strings, each string
        identifying an acceptable set of vector components. The components are
        ANDed together while the individual vector strings are ORed together.
        Vector request values MAY omit components, indicating that any value
        is acceptable. </t>

        <figure>
          <artwork><![CDATA[{
    "vtr": ["P1.C2.C3.A2", "C5.A2"]
}]]></artwork>
        </figure>
      </section>
    </section>

    <section anchor="DiscoveryAndVerification"
             title="Discovery and Verification">
      <section anchor="Trustmark" title="Trustmark">
        <t>When an RP receives a specific vector from an IdP, it needs to make
        a decision to trust the vector within a specific context. A trust
        framework can provide such a context, allowing legal and business
        rules to give weight to an IdP's claims. A trustmark is a verifiable
        claim to conform to a specific component of a trust framework, such as
        a verified identity provider. The trustmark conveys the root of
        trustworthiness about the claims and assertions made by the IdP. </t>

        <t>The trustmark MUST be available from an HTTPS URL by the trust
        framework provider. The contents of this URL are a <xref
        target="RFC7159">JSON</xref> document with the following fields:</t>

        <t><list style="hanging">
            <t hangText="sub">The issuer URL of the identity provider that
            this trustmark pertains to. This MUST match the corresponding
            issuer claim in the identity token, such as the OpenID Connect
            <spanx style="verb">iss</spanx> field. This MUST be an HTTPS
            URL.</t>

            <t hangText="iss">The issuer URL of the trustmark provider that
            issues this trustmark. The URL that a trustmark is fetched from
            MUST start with the <spanx style="verb">iss</spanx> URL in this
            field. This MUST be an HTTPS URL.</t>

            <t hangText="P">Array of strings containing identity proofing
            values for which the identity provider has been assessed and
            approved</t>

            <t hangText="C">Array of strings containing credential strength
            values for which the identity provider has been assessed and
            approved</t>

            <t hangText="A">Array of strings containing assertion strength
            values for which the identity provider has been assessed and
            approved</t>
          </list></t>

        <t>For example, the following trustmark provided by the
        trustmark.example.org organization applies to the idp.example.org
        identity provider:</t>

        <figure>
          <artwork><![CDATA[{
  "sub": "https://idp.example.org/",
  "iss": "https://trustmark.example.org/",
  "P": ["0", "1"],
  "C": ["1", "2", "3"],
  "A": ["2", "3"]
}]]></artwork>
        </figure>

        <t>A client wishing to check the claims made by an IdP can fetch the
        information from the trustmark provider about what claims the IdP is
        allowed to make in the first place and process them accordingly.</t>

        <t>The means by which the RP decides which trustmark providers it
        trusts is out of scope for this specification and is generally
        configured out of band.</t>

        <t>Though most trust frameworks will provide a third-party independent
        verification service for components, an IdP MAY host its own
        trustmark. For example, a self-hosted trustmark would look like:</t>

        <figure>
          <artwork><![CDATA[{
  "sub": "https://idp.example.org/",
  "iss": "https://idp.example.org/",
  "P": ["0", "1"],
  "C": ["1", "2", "3"],
  "A": ["2", "3"]
}]]></artwork>
        </figure>
      </section>

      <section anchor="discovery" title="Discovery">
        <t>The IdP MAY list all of its available trustmarks as part of its
        discovery document. Trustmarks are listed in the trustmarks element
        which contains a single <xref target="RFC7159">JSON</xref> object. The
        keys of this JSON object are trustmark provider issuer URLs and the
        values of this object are the corresponding trustmarks for this
        IdP.</t>

        <figure>
          <artwork><![CDATA[{
    "trustmark": {
         "https://trustmark.example.org/": "https://trustmark.example.org/trustmark/idp.example.org/
    }
}]]></artwork>
        </figure>
      </section>
    </section>

    <section anchor="Acknowledgements" title="Acknowledgements">
      <t>The authors would like to thank the members of the Vectors of Trust
      mailing list in the IETF for discussion and feedback on the concept and
      document.</t>
    </section>
  </middle>

  <back>
    <references title="Normative References">
      <?rfc include='http://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml'?>

      <?rfc include='http://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.7159.xml'?>

      <reference anchor="OpenID">
        <front>
          <title>OpenID Connect Core 1.0</title>

          <author fullname="Nat Sakimura" initials="N." surname="Sakimura">
            <organization abbrev="NRI">Nomura Research Institute,
            Ltd.</organization>
          </author>

          <author fullname="John Bradley" initials="J." surname="Bradley">
            <organization abbrev="Ping Identity">Ping Identity</organization>
          </author>

          <author fullname="Michael B. Jones" initials="M.B." surname="Jones">
            <organization abbrev="Microsoft">Microsoft</organization>
          </author>

          <date day="8" month="November" year="2014"/>
        </front>

        <format target="http://openid.net/specs/openid-connect-core-1_0.html"
                type="HTML"/>
      </reference>
    </references>

    <references title="Informative References">
      <reference anchor="SP-800-63">
        <front>
          <title>Electronic Authentication Guideline</title>

          <author fullname="William E. Burr">
            <organization/>
          </author>

          <author fullname="Donna F. Dodson">
            <organization/>

            <address>
              <postal>
                <street/>

                <city/>

                <region/>

                <code/>

                <country/>
              </postal>

              <phone/>

              <facsimile/>

              <email/>

              <uri/>
            </address>
          </author>

          <author fullname="Elaine M. Newton">
            <organization/>

            <address>
              <postal>
                <street/>

                <city/>

                <region/>

                <code/>

                <country/>
              </postal>

              <phone/>

              <facsimile/>

              <email/>

              <uri/>
            </address>
          </author>

          <author fullname="Ray A. Perlner">
            <organization/>

            <address>
              <postal>
                <street/>

                <city/>

                <region/>

                <code/>

                <country/>
              </postal>

              <phone/>

              <facsimile/>

              <email/>

              <uri/>
            </address>
          </author>

          <author fullname="W. Timothy Polk">
            <organization/>

            <address>
              <postal>
                <street/>

                <city/>

                <region/>

                <code/>

                <country/>
              </postal>

              <phone/>

              <facsimile/>

              <email/>

              <uri/>
            </address>
          </author>

          <author fullname="Sarbari Gupta">
            <organization/>

            <address>
              <postal>
                <street/>

                <city/>

                <region/>

                <code/>

                <country/>
              </postal>

              <phone/>

              <facsimile/>

              <email/>

              <uri/>
            </address>
          </author>

          <author fullname="Emad A.  Nabbus">
            <organization/>

            <address>
              <postal>
                <street/>

                <city/>

                <region/>

                <code/>

                <country/>
              </postal>

              <phone/>

              <facsimile/>

              <email/>

              <uri/>
            </address>
          </author>

          <date month="August" year="2013"/>
        </front>

        <format type="PDF"/>
      </reference>
    </references>

    <section title="Document History">
      <t>- 00</t>

      <t><list style="symbols">
          <t>Created initial IETF drafted based on strawman proposal discussed
          on VoT list.</t>

          <t>Split vector component definitions into their own section to
          allow extension and override.</t>

          <t>Solidified trustmark document definition.</t>
        </list></t>
    </section>
  </back>
</rfc>

PAFTECH AB 2003-20262026-04-23 11:13:02