Proof of Control - Revision history

Tom: /* Context */

2021-01-25T22:08:41Z

‎Context

Tom: /* Context */

2021-01-25T22:07:54Z

‎Context

Tom: /* DID CORE doc on Persistence */

2021-01-25T22:07:09Z

‎DID CORE doc on Persistence

Tom: /* Context */

2021-01-25T22:06:47Z

‎Context

Tom: /* References */

2021-01-25T06:10:13Z

‎References

Tom: Created page with "==Full Title== Proof of Control applies to credentials that are meant to show that the user at the end of a communications link has control of that credential. ==Context=..."

2021-01-25T02:59:31Z

Created page with "==Full Title== Proof of Control applies to credentials that are meant to show that the user at the end of a communications link has control of that credential. ==Context=..."

New page

==Full Title==
[[Proof of Control]] applies to credentials that are meant to show that the user at the end of a communications link has control of that credential.

==Context==
* [[Decentralized ID]] presents a problem with assurance of the trustworthiness of the wallet apps.

'''Goal''': to convert establish a level of assurance that he user is who they claim to be.

Level 1 - the user signs a nonce with their credential and returns it to the requester.
Level 2 - the user signs a nonce and provides proof of the security of the device holding the credential.

==Solution==
there are two ways to get a trusted signer on the phone.
# register an app that is trusted. If that is the method the easiest way is to register the actual instance of the wallet itself to the user.
# depend on the trusted element in the phone to boot up an assurance element - the TPM code in the TEE could do that, but it depends on a trusted server in the could. All of these depend on a web of trust that is not based on any human intervention. Not sure what the rWOT guys think about that? (nb this could be accomplished with a webauthn token like that from Yubikey)

==References==
* This wiki is part of the larger problem of [[Apps on User Devices]].
* A related problem is described in the [https://wiki.idesg.org/wiki/index.php/Over_21_with_Proof_of_Presence_Use_Case Over 21 with Proof of Presence Use Case].

[[Category: Glossary]]
[[Category: Authentication]]
[[Category: Assurance]]

@@ Line 6: / Line 6: @@
 '''Goal''': to convert establish a level of assurance that he user is who they claim to be.
+# the user signs a nonce with their credential and returns it to the requester.
-Level 1 - the user signs a nonce with their credential and returns it to the requester.
+# the user signs a nonce and provides proof of the security of the device holding the credential.
 ===DID CORE doc on Persistence===

@@ Line 11: / Line 11: @@
 ===DID CORE doc on Persistence===
 DIDs are designed to be persistent in the sense that no administrator can
 take control away from the controller, nor can an administrator prevent
@@ Line 20: / Line 17: @@
 capability of removing an individual's—or an organization's identifier—nor
 can they render it inoperable.
-      </p>
 However, it is important to note that in all DID Methods that enable
 cryptographic proof-of-control, the means of proving control can always be
@@ Line 28: / Line 24: @@
 identifier over time regularly check to ensure that the identifier is, in
 fact, still under the control of the intended party.
-      </p>
 Unfortunately, it is impossible to determine from the cryptography alone
 whether or not the private key material associated with a given proof
 mechanism has been compromised. It may well be that the expected controller still has access to the private keys—and as such can execute a
 proof-of-control as part of a verification process—while at the same time, a bad actor also has access to (or a copy of) those same keys.
-      </p>
 As such, cryptographic proof-of-control should only be used as one
 factor in evaluating the level of identity assurance for a given
@@ Line 43: / Line 37: @@
 not infallible. Services that perform sensitive, high value, or
 life-critical operations should use additional factors as appropriate.
 ==Solution==

@@ Line 11: / Line 11: @@
 ===DID CORE doc on Persistence===
-    <section>
        <p>
      </section>

@@ Line 19: / Line 19: @@
 ==References==
 * This wiki is part of the larger problem of [[Apps on User Devices]].
 * A related problem is described in the [https://wiki.idesg.org/wiki/index.php/Over_21_with_Proof_of_Presence_Use_Case Over 21 with Proof of Presence Use Case].