Difference between revisions of "Credential Service Provider"
From MgmtWiki
(→Context) |
(→Solutions) |
||
| Line 9: | Line 9: | ||
* The secret in the credential cannot be shared in any know scalable secure manner, so it must simple be the source of some [[Authentication]] response that is secure from spoofing and replay. | * The secret in the credential cannot be shared in any know scalable secure manner, so it must simple be the source of some [[Authentication]] response that is secure from spoofing and replay. | ||
==Solutions== | ==Solutions== | ||
| − | |||
* Often there is also a binding to some sort of real-world credential, typically a piece of paper with a seal. | * Often there is also a binding to some sort of real-world credential, typically a piece of paper with a seal. | ||
* NIST 800-63 (all versions) describe a [[Credential Service Provider]] which is designed to issue credentials to users after they by had the [[Identity Proofing]] prior to employment by the government. This flow can be substantially different in commercial systems, but there is always a need to verify the security of the user's private key or other secret that is a part of a credential. | * NIST 800-63 (all versions) describe a [[Credential Service Provider]] which is designed to issue credentials to users after they by had the [[Identity Proofing]] prior to employment by the government. This flow can be substantially different in commercial systems, but there is always a need to verify the security of the user's private key or other secret that is a part of a credential. | ||
Revision as of 13:39, 5 July 2019
Full Title or Meme
A Credential Service Provider provides Credential Management Services for a Credential assign to a Subject.
Context
- The all digital Credentials come with a secret which is used to help in Authentication of the Subject.
Problems
- The only truly secure Credential is one with a secret that the Subject owns and controls.
- The secret in the credential cannot be shared in any know scalable secure manner, so it must simple be the source of some Authentication response that is secure from spoofing and replay.
Solutions
- Often there is also a binding to some sort of real-world credential, typically a piece of paper with a seal.
- NIST 800-63 (all versions) describe a Credential Service Provider which is designed to issue credentials to users after they by had the Identity Proofing prior to employment by the government. This flow can be substantially different in commercial systems, but there is always a need to verify the security of the user's private key or other secret that is a part of a credential.
