Credential - Revision history

Tom: /* Solutions */

2024-10-29T22:22:33Z

‎Solutions

2024-08-06T22:57:34Z

‎Full Title or Meme

2023-12-22T20:41:51Z

‎References

2021-12-02T00:54:34Z

‎Problems

2021-12-02T00:32:48Z

‎W3C Credential

2021-12-02T00:23:59Z

‎Verifiable Credential

2021-12-02T00:23:20Z

‎Verifiable Credential

2021-12-02T00:14:51Z

‎Problems

2021-12-02T00:07:40Z

‎Context

2021-12-02T00:07:03Z

@@ Line 70: / Line 70: @@
 * [[Web Authentication]] defines a Public Key Credential as data one entity presents to another in order to authenticate the former to the latter [RFC4949]. The term public key credential refers to one of: a public key credential source, the possibly-attested credential public key corresponding to a public key credential source, or an authentication assertion. Which one is generally determined by context. In other words, this credential is evidence that the user holds the private key, while in rfc 4949 and in this wiki, the credential is the object held that can be used multiple times (i.e. the private key).
 * The best known [[Credential]] of the day (2020) is a [[Private Key Component]].
+* [https://github.com/digitalcredentials  Digital Credentials Consortium's GitHub] We are building an infrastructure for digital academic credentials that can support the education systems of the future. Find out more about us at [https://digitalcredentials.mit.edu/ our website.]
 ===[[Verifiable Credential]]===
 The [https://www.w3.org/TR/vc-data-model/ W3C recommendation] for a [[Verifiable Credential]] (VC) allows all sorts of modifications of the concept of [[Credential]] which takes it far beyond what is described here.

@@ Line 1: / Line 1: @@
 ==Full Title or Meme==
-A [[Credential]] in the digital realm is a structure which contains, at a minimum, a secret value which can be used in [[Authentication]] of a [[Subject]].
+A [[Credential]] in the digital realm is a structure which contains, at a minimum, a secret value which can be used in [[Authentication]] of a [[Subject]] or [[Authorization]] to access a resource.
 ==Context==

@@ Line 59: / Line 59: @@
 * The secret in the credential cannot be shared in any know scalable secure manner, so it must simply be the source of some [[Authentication]] response that is secure from spoofing and replay.
 * If a credential is used to acquire access to a critical resource, like a patients financial or health assets, some method for recovery of that access must be available. The recovery could be restoration of the credential if it has not be compromised, and replacement of the credential if it has.
 ==Solutions==

← Older revision		Revision as of 00:32, 2 December 2021
Line 77:		Line 77:

	* [https://www.w3.org/2021/11/08-wpwg-spc-minutes What are requirements when more than one SPC credential matches?] Was addressed by the W3C SPC ([[Secure Payment Confirmation]]) Task Force with John Bradley representing FIDO. 2021-11-08		* [https://www.w3.org/2021/11/08-wpwg-spc-minutes What are requirements when more than one SPC credential matches?] Was addressed by the W3C SPC ([[Secure Payment Confirmation]]) Task Force with John Bradley representing FIDO. 2021-11-08
		+
		+
		+	===Misc. Credentials===
		+	Some private solutions for replacing passwords are:
		+	* [https://www.newswire.com/news/idramp-announces-passwordless-credential-orchestration-manager-is-now-21562624 IdRamp] announced (2021-11-24) that "Passwordless Credential Orchestration Manager is Now Available in the Oracle Cloud Marketplace". The link will take you to a collection of VCs that encoded as QR codes that lead to a user sign-in to Oracle. These really are just long passwords. It is not clear how they are protected from misuse.

	===Recovery by Restoration===		===Recovery by Restoration===

@@ Line 71: / Line 71: @@
 * As a general rule the credential is protected by a [[Decentralized ID]] or did with a published method. The entire security of the VC is limited by the control of the issuance and protect storage of any issued credential.
 ** Issuance of a bogus credential is always possible given the low bar for an issuer. If the [[Relying Party]] can be fooled into accepting a bogus credential, there is no recourse that the user has withing the VC ecosystem. Any recourse needs to come from the real-world - that is from outside the system.
-** Protection of a credential in a user's possession. If the attacker is able to either steal the user's private keys, or to fool the user into using those private keys, then they can succeed at ''[[Identity Theft]]'', a legal term that usually requires the proof of lose of significant value to the user, similar to use of a credit card to purchase a TV.
+** Protection of a credential in a user's possession. If the attacker is able to either steal the user's private keys, or to fool the user into using those private keys, then they can succeed at ''[[Identity Theft]]'', a legal term that usually requires the proof of loss of significant value to the user, similar to use of a credit card to purchase a TV.
 ===W3C Credential===

@@ Line 56: / Line 56: @@
 ** Control in this case means that only the user can use the [[Credential]] to acquire access.
 ** In this definition, if an attacker can use the [[Credential]] in an [[Authentication]], then the user does not control it.
 * The secret in the credential cannot be shared in any know scalable secure manner, so it must simply be the source of some [[Authentication]] response that is secure from spoofing and replay.
-* If a credential is used to acquire access to a critical resource, like a patients financial or health assets, some method for recovery of that access must be available. The recovery could be restoration of the credential if it has not be compromised, and placement of the credential if it has.
+* If a credential is used to acquire access to a critical resource, like a patients financial or health assets, some method for recovery of that access must be available. The recovery could be restoration of the credential if it has not be compromised, and replacement of the credential if it has.
 ==Solutions==

@@ Line 5: / Line 5: @@
 * The original digital [[Credential]] was just a shared secret, usually called a [[Password]].
 * More secure [[Credential]]s keep private keys which are used to build an [[ID Token]] which can include anti-replay elements, that (with [[User Consent]]) is sent to a requester.
-* There are a large number of proposed alternates to passwords, which seem to be little more than an attempt to make the password longer and hide that long password in some secret place.
+* There are a large number of proposed alternates to passwords, many of which seem to be little more than an attempt to make the password longer and hide that long password in some secret place.
 ===RFC 4949 Definition===

@@ Line 7: / Line 7: @@
 * There are a large number of proposed alternates to passwords, which seem to be little more than an attempt to make the password longer and hide that long password in some secret place.
 ===RFC 4949 Definition===
 The following taken from RFC 4949 (2007-08) gives some history and some challenges around the use of the word [[Credential]].
@@ Line 58: / Line 52: @@
 This wiki does not accept the concept that the user's certificate is a credential and neither do any [[Identifier or Attribute Provider]]s. Since the certificate is a public document, anyone could have a copy and the [[Presentation]] of a copy is not in any way proof of anything without verification of the signer or the holder.
 ==Solutions==