Proposed Metric: Percentage Asymmetric Credentials (PAC)

[nynymike]

Identity is key to accountability. More asymmetric authentication = more effective identity program.

PAC is asymmetric-authenticated invocations ÷ invocations with a known authentication method. Report unknown authentication separately, otherwise missing evidence can artificially improve PAC. Should the bar be set at asymmetric credentials, or private keys protected by hardware? IMHO a different metric can track % of asymmetric credentials which are non-exportable hardware keys.

[rohitkhare]

The term “Asymmetric” might not connote the range of concepts indicated?
[I don’t like to raise issues without proposing alternatives or solutions to anchor a productive discussion, but…]
These are personal opinions, off the cuff:

• in cryptography, it suggests the boundary between shared-key and public-key encryption (…and almost all practical public-key protocols set up a symmetric or shared key for sessions)
• in cloud infrastructure, it suggests using PKI certificates for services, along the lines of SPIFFE/SPIRE/WIMSE
• in authentication or identity-governance, it suggests the difference between passwords and passkeys
  Mostly, I would like to pressure-test whether this metric could be “gamed”: is it possible to get a better score without accomplishing what was intended (Goodheart’s Law)