Credential Lifecycle Guide - Revision history

Jeff.Krug: /* Revocation */

2019-04-10T20:29:48Z

Revocation

← Older revision		Revision as of 20:29, 10 April 2019
Line 40:		Line 40:
	===Revocation===		===Revocation===
	* Mark credential as no longer valid.		* Mark credential as no longer valid.
			* For FIDO/ThumbSignIn this is done within the ThumbSignIn control panel.

2019-04-10T20:20:16Z

Expiration

← Older revision		Revision as of 20:20, 10 April 2019
Line 35:		Line 35:
	* Credential no longer valid		* Credential no longer valid
	* FIDO likely not configured to have expiration.		* FIDO likely not configured to have expiration.
			** The underlying account (online identity) may have expiration rules independent of the authenticator's expiration rules though.
			** Does DI3 have expiration rules? Inactivity leading to automatically disabled accounts?

	===Revocation===		===Revocation===
	* Mark credential as no longer valid.		* Mark credential as no longer valid.

2019-04-10T20:18:30Z

Expiration

← Older revision		Revision as of 20:18, 10 April 2019
Line 35:		Line 35:
	* Credential no longer valid		* Credential no longer valid
	* FIDO likely not configured to have expiration.		* FIDO likely not configured to have expiration.
	** The account (online identity) associated with a FIDO credential may have an inactivity expiration time though.
	** May be a good question for Jim's team, do DI3 accounts currently have inactivity timeouts/expirations?

	===Revocation===		===Revocation===
	* Mark credential as no longer valid.		* Mark credential as no longer valid.

2019-04-10T20:17:27Z

Expiration

← Older revision		Revision as of 20:17, 10 April 2019
Line 35:		Line 35:
	* Credential no longer valid		* Credential no longer valid
	* FIDO likely not configured to have expiration.		* FIDO likely not configured to have expiration.
			** The account (online identity) associated with a FIDO credential may have an inactivity expiration time though.
			** May be a good question for Jim's team, do DI3 accounts currently have inactivity timeouts/expirations?

	===Revocation===		===Revocation===
	* Mark credential as no longer valid.		* Mark credential as no longer valid.

2019-04-10T19:49:44Z

Expiration

← Older revision		Revision as of 19:49, 10 April 2019
Line 34:		Line 34:
	* Trigger reissuance before expiration		* Trigger reissuance before expiration
	* Credential no longer valid		* Credential no longer valid
			* FIDO likely not configured to have expiration.

	===Revocation===		===Revocation===
	* Mark credential as no longer valid.		* Mark credential as no longer valid.

2019-04-10T19:49:24Z

Reissuance

← Older revision		Revision as of 19:49, 10 April 2019
Line 23:		Line 23:
	* Replace credential		* Replace credential
	** Near expiration time, may reissue (for example password changes).		** Near expiration time, may reissue (for example password changes).
	** For FIDO ~~reissuance~~ is likely not an issue, credentials would not ~~likely~~ have expiration times.		** For FIDO reissuing is likely not an issue, credentials would not have expiration times and backup authenticators likely not strong enough to allow direct enrollment.
	* In-person		* In-person
	** Depending on availability of multiple authenticators, reissuance may require in-person processes.		** Depending on availability of multiple authenticators, reissuance may require in-person processes.

2019-04-10T19:48:05Z

Reissuance

← Older revision		Revision as of 19:48, 10 April 2019
Line 22:		Line 22:
	===Reissuance===		===Reissuance===
	* Replace credential		* Replace credential
			** Near expiration time, may reissue (for example password changes).
			** For FIDO reissuance is likely not an issue, credentials would not likely have expiration times.
	* In-person		* In-person
			** Depending on availability of multiple authenticators, reissuance may require in-person processes.
	* Necessitate new enrollment?		* Necessitate new enrollment?
			** Without multiple authenticators, may necessitate a new enrollment (new online identity / account).
	* Viable via redundant credentials.		* Viable via redundant credentials.
			** In some cases (and particularly for lower strength authenticators), you can reissue an authenticator via a channel established with another authenticator.

	===Expiration===		===Expiration===
	* Trigger reissuance before expiration		* Trigger reissuance before expiration

2019-04-10T19:17:49Z

Lost Authenticator

← Older revision		Revision as of 19:17, 10 April 2019
Line 15:		Line 15:
	==Use Cases==		==Use Cases==
	===Lost Authenticator===		===Lost Authenticator===
	* Other login methods (potentially for reissuance).		* Reporting loss.
	* Reporting loss ~~(potentially trigger revocation)~~.
	** CSP must have clear and readily available instructions for users that lose their authenticators.		** CSP must have clear and readily available instructions for users that lose their authenticators.
			** CSP may revoke existing authenticator
			** Initiate reissuance via backup authenticator (if possible).

	===Reissuance===		===Reissuance===

2019-04-10T19:02:09Z

Lost Authenticator

← Older revision		Revision as of 19:02, 10 April 2019
Line 17:		Line 17:
	* Other login methods (potentially for reissuance).		* Other login methods (potentially for reissuance).
	* Reporting loss (potentially trigger revocation).		* Reporting loss (potentially trigger revocation).
	** CSP must have clear and readily available instructions for ~~user's~~ that lose their authenticators.		** CSP must have clear and readily available instructions for users that lose their authenticators.

	===Reissuance===		===Reissuance===

2019-04-10T19:01:53Z

Lost Authenticator

← Older revision		Revision as of 19:01, 10 April 2019
Line 17:		Line 17:
	* Other login methods (potentially for reissuance).		* Other login methods (potentially for reissuance).
	* Reporting loss (potentially trigger revocation).		* Reporting loss (potentially trigger revocation).
			** CSP must have clear and readily available instructions for user's that lose their authenticators.

	===Reissuance===		===Reissuance===
	* Replace credential		* Replace credential