Re: Solutions to the NASCAR problem?

On 11/21/2015 03:12 PM, David Chadwick wrote:
> your system has some similarities to one we developed 4 years ago 
> under the EC TAS3 project. I gave a demo and presentation at the W3C 
> meeting in Mountain View in 2011. The slides are here
> 
> http://www.w3.org/2011/identity-ws/slides/Chadwick.pdf

Hey David, very interesting - lots of similarities between what you
presented and the design of the Identity Credentials ecosystem (and Dick
Hardt's work from 2006).

> The technical details are in a paper I presented at the ARES 
> conference in 2013 (if anyone is interested).

Yes, very interested. Got a link to the paper?

> However, things have moved on significantly since then. My latest 
> design is based on FIDO, and it does not need IdPs anymore. IdPs 
> morph into attribute authorities (AAs) as now they only assert user 
> attributes (credentials) for the user. The user can authenticate 
> himself to the SP and the AAs with his FIDO keys. Un/pws are no 
> longer needed (unless you use the U2F model instead of UAF).

What is an SP? Is it a relying party?

To map your terminology to this community's terminology:

AAs -> Issuer
SP  -> Credential Consumer
FIDO Device -> identity vault?

> Credentials are digitally signed by their issuers (AAs) so the trust
>  model is the same as yours.

+1

> No discovery of IdPs or AAs is needed, as AAs are recorded in the 
> FIDO metadata.

I'd be interested to understand how this works with multiple FIDO
devices. What happens when you lose a FIDO device? What does the AA set
as the subject of the attribute assertion (how does it identify the user
that the attribute belongs to)?

> DIDs are now the users keys with SOP.

What happens when the user loses their key? Does their identity
disappear as well? For example, if you tie a university degree to the
user's key, if you lose the key, do you lose your university degree?

> The user stores his credentials on his FIDO device and so has full 
> control of them.

What happens if the user has two FIDO devices (since this is best
practice, I expect everyone will have at least two devices)?

> I suspect this system is simpler than the one you describe below

It is, with one potentially bad side effect - you lose your FIDO device,
you lose your identity. Very interested to hear how you overcame this
pitfall.

-- manu

-- 
Manu Sporny (skype: msporny, twitter: manusporny, G+: +Manu Sporny)
Founder/CEO - Digital Bazaar, Inc.
blog: Web Payments: The Architect, the Sage, and the Moral Voice
https://manu.sporny.org/2015/payments-collaboration/

Received on Saturday, 21 November 2015 21:32:45 UTC