meaning of "high assurance" isn't clear

[jogu]

We don't actually seem to state what the "high assurance" in the spec title actually means. We should try to mention what we mean.

(Mentioned on IOS 23220-3 TF call.)

[jogu]

Discussed on today's WG call:

Potentially we should mention the kind of properties we're trying to achieve - e.g. device bound credentials, privacy preserving things like single use credentials, higher security choices like mandating DPoP.

Any other suggestions?

[jogu]

Discussed on today's WG call: maybe clarifying the target audience / usage could at least help provide guidance to people as to whether the spec is applicable to them or not - e.g. expanding & retitling section 1.1.

[tlodderstedt]

In my opinion, high assurance means:

• there is a high assurance the claims in the credential are valid and bound to the holder (authentic and integer data)
• there is a high assurance the credential is actually presented by the holder (holder authentication)

The second requirement can be implemented in different ways.

1. The credential is bound to a key (public key in the credential). It is presented along with a cryptographic proof of possession for the corresponding private key. High assurance requires a high level of protection of the private key and of the user authentication required to unlock the key for signing.
2. The credential is bound through a biometric trait of the holder. Binding is checked by matching the biometric trait against the presenter of the credential.
3. The credential contains one or more claims identifying the holder, such as name and date of birth or a social security number. In this case, the actual validation whether a credential is presented by its holder will be based on using further measures, examples are another credential with the holders identifying claim(s) and a key or biometric binding is presented in the same context or the verifier already authenticated the holder using a user account.
   Example: An holder has a vaccination certificate, which also includes her name, family name, date of birth and data of place of the holder of the degree. If the certificate is presented, the holder could present her mDL or PID.

@martijnharing

[jogu]

Discussed on today's WG call - some consensus around Torsten's two bullet points:

• there is a high assurance the claims in the credential are valid and bound to the holder (authentic and integer data)
• there is a high assurance the credential is actually presented by the holder (holder authentication)

Agreed to move to a PR so people can see those bullet points in the context of the specification. Torsten agreed to do a PR.