Difference between revisions of "Proof of Control"
From MgmtWiki
(Created page with "==Full Title== Proof of Control applies to credentials that are meant to show that the user at the end of a communications link has control of that credential. ==Context=...") |
(→References) |
||
| Line 19: | Line 19: | ||
==References== | ==References== | ||
* This wiki is part of the larger problem of [[Apps on User Devices]]. | * This wiki is part of the larger problem of [[Apps on User Devices]]. | ||
| + | * Also part of the wiki page on [[Proof of Presence]]. | ||
* A related problem is described in the [https://wiki.idesg.org/wiki/index.php/Over_21_with_Proof_of_Presence_Use_Case Over 21 with Proof of Presence Use Case]. | * A related problem is described in the [https://wiki.idesg.org/wiki/index.php/Over_21_with_Proof_of_Presence_Use_Case Over 21 with Proof of Presence Use Case]. | ||
Revision as of 23:10, 24 January 2021
Contents
Full Title
Proof of Control applies to credentials that are meant to show that the user at the end of a communications link has control of that credential.
Context
- Decentralized ID presents a problem with assurance of the trustworthiness of the wallet apps.
Goal: to convert establish a level of assurance that he user is who they claim to be.
Level 1 - the user signs a nonce with their credential and returns it to the requester. Level 2 - the user signs a nonce and provides proof of the security of the device holding the credential.
Solution
there are two ways to get a trusted signer on the phone.
- register an app that is trusted. If that is the method the easiest way is to register the actual instance of the wallet itself to the user.
- depend on the trusted element in the phone to boot up an assurance element - the TPM code in the TEE could do that, but it depends on a trusted server in the could. All of these depend on a web of trust that is not based on any human intervention. Not sure what the rWOT guys think about that? (nb this could be accomplished with a webauthn token like that from Yubikey)
References
- This wiki is part of the larger problem of Apps on User Devices.
- Also part of the wiki page on Proof of Presence.
- A related problem is described in the Over 21 with Proof of Presence Use Case.
