- From: =JeffH via GitHub <sysbot+gh@w3.org>
- Date: Fri, 02 Jul 2021 21:53:09 +0000
- To: public-webauthn@w3.org
@ve7jtb wrote: > In conversations with some government RP around national ID programs, there seems to be a requirement that **(A) keys not be exportable or shared**. [ ... ] In some cases, the RP may also want to **(B) guide the user to an authenticator with a particular certification**. As an example, a US Fedramp high application may need a FIPS-140-L2 certified authenticator. Overall, it would be good to have the fine-grained use cases & requirements from the eID folks. Requirement (A) seems to actually be two requirements: * (A.1), the credential (aka key) be device-bound (in hardware), and * (A.2), only be usable by the RP ID and specific app (browser or native app?) that created it (I'm not sure how workable that is...). Regarding (A.2) and (B), they would seem to be things that would foster fragmentation (users needing multiple authnrs for specific purposes and/or RPs) in the consumer context, and so would seem more applicable to the enterprise context ...? Regarding (A.1), it may turn out to be addressed by the device-bound key we are envisioning in answer to issue #1546. -- GitHub Notification of comment by equalsJeffH Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1449#issuecomment-873273850 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Friday, 2 July 2021 21:53:11 UTC