<div dir="ltr">Mike: I appreciate the reference to verified email and other subject supplied claims. In those cases the verifier is the RP client or OP as the case may be.<div>What is missing AFAICT is the concept of third party verification, which is what is needed here. Extending verified to this case may, or may not, be a good idea.</div><div>The current unmet problem of the verified claims is that, first of all, the {subject, client, whatever} needs to trust the verifier.</div><div>I have been building a solution to that problem based on the oidc federation draft. <br></div><div>This is a problem for which AFAICT no stds group has a solution.</div><div>One existing model is the attestation server of the TPM or the network policy server in windows.<br>would this group be prepared to deal with such a doc if i tried to create it?</div><div>Does anyone else need such a solution and would like to work on it?</div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Peace ..tom</div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jun 17, 2019 at 9:14 AM Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div dir="auto" style="direction:ltr;margin:0px;padding:0px;font-family:sans-serif;font-size:11pt;color:black">
Use of "verified" in this context with this meaning is already existing practice. For instance see the use of the "verified" term in the "phone_number_verified" and "email_verified" claims from
<a href="https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims" target="_blank">https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims</a> and
<a href="https://www.iana.org/assignments/jwt/jwt.xhtml#claims" target="_blank">https://www.iana.org/assignments/jwt/jwt.xhtml#claims</a>.<br>
<br>
</div>
<div dir="auto" style="direction:ltr;margin:0px;padding:0px;font-family:sans-serif;font-size:11pt;color:black">
We should continue using the same term in this context since it has the same meaning. Inventing another term for the same thing would only cause needless confusion.<br>
<br>
</div>
<div dir="auto" style="direction:ltr;margin:0px;padding:0px;font-family:sans-serif;font-size:11pt;color:black">
-- Mike<br>
</div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_-867678074508115385divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Anthony Nadalin<br>
<b>Sent:</b> Monday, June 17, 2019 5:42:35 PM<br>
<b>To:</b> Tom Jones; Artifact Binding/Connect Working Group<br>
<b>Cc:</b> Mike Jones; Torsten Lodderstedt<br>
<b>Subject:</b> RE: [Openid-specs-ab] Review of openid-connect-4-identity-assurance-04</font>
<div> </div>
</div>
<div>
<div class="gmail-m_-867678074508115385WordSection1">
<p class="MsoNormal">If I understand the meaning of “verified” here I would say that “registered claim” is a far better term, and gets away from the false sense of “verified”<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b>From:</b> Tom Jones <<a href="mailto:thomasclinganjones@gmail.com" target="_blank">thomasclinganjones@gmail.com</a>> <br>
<b>Sent:</b> Sunday, June 16, 2019 12:51 PM<br>
<b>To:</b> Artifact Binding/Connect Working Group <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Cc:</b> Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>>; Torsten Lodderstedt <<a href="mailto:torsten@lodderstedt.net" target="_blank">torsten@lodderstedt.net</a>>; Anthony Nadalin <<a href="mailto:tonynad@microsoft.com" target="_blank">tonynad@microsoft.com</a>><br>
<b>Subject:</b> Re: [Openid-specs-ab] Review of openid-connect-4-identity-assurance-04<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Ah Tony - the JWT definition seems good enough to me. Provide value can be a complex structure like an address.<u></u><u></u></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Arial,sans-serif;color:rgb(37,37,37)">Here is the definition in my glossary
<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftcwiki.azurewebsites.net%2Findex.php%3Ftitle%3DClaim%23Full_Title_or_Meme&data=04%7C01%7CMichael.Jones%40microsoft.com%7C738191bfa76a4dcafab008d6f3320a2f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636963793587060048%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C-1&sdata=H%2BGm3BdBGqLnj15KUeP6xVxLViXDRBmHb2yDKdflB7Y%3D&reserved=0" target="_blank">
A statement by or about a </a></span><a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftcwiki.azurewebsites.net%2Findex.php%3Ftitle%3DClaim%23Full_Title_or_Meme&data=04%7C01%7CMichael.Jones%40microsoft.com%7C738191bfa76a4dcafab008d6f3320a2f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636963793587070049%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C-1&sdata=%2BS7MFsmGx2mDkTWDCiZorn08wCm6MuQ7%2FE9uQe6cJ2w%3D&reserved=0" target="_blank">Subject is
a claim. If there is some corroboration of the claim, it is called a Validated claim. </a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Here is the definition from Skeats <span style="font-size:10.5pt;font-family:Arial,sans-serif;color:rgb(37,37,37)">
to call our for, or to publish, pretty much the same meaning as the Latin word <i>clarmare</i>.</span> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">the adjectives verified validated and registered should all work. I do like the historical precedent for registered myself. <u></u><u></u></p>
<div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Peace ..tom<u></u><u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Sat, Jun 15, 2019 at 8:04 PM Anthony Nadalin via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:Arial,sans-serif;color:black">It's a very very poor definition, you need to look at the real definition not a made up one
<u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif;color:black">Get
<a href="https://aka.ms/ghei36" target="_blank">Outlook for Android</a><u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif;color:black"><u></u> <u></u></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="gmail-m_-867678074508115385gmail-m_5985625740742696765divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> Mike Jones<br>
<b>Sent:</b> Saturday, June 15, 2019 7:37:55 AM<br>
<b>To:</b> Torsten Lodderstedt; Anthony Nadalin<br>
<b>Cc:</b> Artifact Binding/Connect Working Group<br>
<b>Subject:</b> RE: Review of openid-connect-4-identity-assurance-04</span> <u></u>
<u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">The normative definition of “Claim” for JWTs is this one from the JWT spec at
<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc7519%23section-2&data=04%7C01%7CMichael.Jones%40microsoft.com%7C738191bfa76a4dcafab008d6f3320a2f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636963793587070049%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C-1&sdata=K0G5SRStAquN9NSSxZlOB1ieGLYXwXuNkm9fIG9Qi1Y%3D&reserved=0" target="_blank">
https://tools.ietf.org/html/rfc7519#section-2</a>:</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:black;background:white"> Claim</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:black;background:white"> A piece of information asserted about a subject. A claim is</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:black;background:white"> represented as a name/value pair consisting of a Claim Name and a</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:black;background:white"> Claim Value.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">It says nothing about doubt – just that the information was asserted. Therefore, I continue to agree that Torsten’s suggested identifier “verified_claim”
is the right one.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"> -- Mike</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"> </span><u></u><u></u></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b>From:</b> Torsten Lodderstedt <<a href="mailto:torsten@lodderstedt.net" target="_blank">torsten@lodderstedt.net</a>>
<br>
<b>Sent:</b> Saturday, June 15, 2019 12:52 AM<br>
<b>To:</b> Anthony Nadalin <<a href="mailto:tonynad@microsoft.com" target="_blank">tonynad@microsoft.com</a>><br>
<b>Cc:</b> Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>>; Artifact Binding/Connect Working Group <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Subject:</b> Re: Review of openid-connect-4-identity-assurance-04<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><br>
Am 14.06.2019 um 18:48 schrieb Anthony Nadalin <<a href="mailto:tonynad@microsoft.com" target="_blank">tonynad@microsoft.com</a>>:<u></u><u></u></p>
</div>
<blockquote style="margin-top:5pt;margin-bottom:5pt">
<div>
<p class="MsoNormal">It’s not a claim then, it’s a statement, it does not matter who has the claim, the issuer or the beholder, it’s still in doubt. I don’t understand enough of the “verified” statement
since the language is vague in the specification, is it the provenance of the data or the truth of the data ?<u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<p class="MsoNormal">I would say first of all truth but backed by data about the provenance<u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Happy to incorporate your text proposals to improve the spec language <u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><u></u> <u></u></p>
<blockquote style="margin-top:5pt;margin-bottom:5pt">
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b>From:</b> Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>>
<br>
<b>Sent:</b> Friday, June 14, 2019 9:45 AM<br>
<b>To:</b> Anthony Nadalin <<a href="mailto:tonynad@microsoft.com" target="_blank">tonynad@microsoft.com</a>>; Artifact Binding/Connect Working Group <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>>; Torsten
Lodderstedt <<a href="mailto:torsten@lodderstedt.net" target="_blank">torsten@lodderstedt.net</a>><br>
<b>Subject:</b> Re: Review of openid-connect-4-identity-assurance-04<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:Arial,sans-serif;color:black">A claim is a statement made by the issuer. A verified claim is one with evidence backing it beyond the veracity of the issuer.
</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:Arial,sans-serif;color:black">Doubt or belief are both properties of the beholder - not the issuer.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif;color:black">-- Mike</span><u></u><u></u></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="1" width="98%" align="center">
</div>
<div id="gmail-m_-867678074508115385gmail-m_5985625740742696765divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> Anthony Nadalin<br>
<b>Sent:</b> Friday, June 14, 2019 6:44:29 PM<br>
<b>To:</b> Artifact Binding/Connect Working Group; Torsten Lodderstedt<br>
<b>Cc:</b> Mike Jones<br>
<b>Subject:</b> RE: Review of openid-connect-4-identity-assurance-04</span> <u></u>
<u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal">A claim is something in doubt, how can you have a verified claim?<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b>From:</b> Openid-specs-ab <<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>>
<b>On Behalf Of </b>Mike Jones via Openid-specs-ab<br>
<b>Sent:</b> Friday, June 14, 2019 8:42 AM<br>
<b>To:</b> Torsten Lodderstedt <<a href="mailto:torsten@lodderstedt.net" target="_blank">torsten@lodderstedt.net</a>><br>
<b>Cc:</b> Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>>;
<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> Re: [Openid-specs-ab] Review of openid-connect-4-identity-assurance-04<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:Arial,sans-serif;color:black">I agree with "verified_claims".</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif;color:black">Thanks!</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif;color:black">-- Mike</span><u></u><u></u></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="1" width="98%" align="center">
</div>
<div id="gmail-m_-867678074508115385gmail-m_5985625740742696765x_divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> Torsten Lodderstedt <<a href="mailto:torsten@lodderstedt.net" target="_blank">torsten@lodderstedt.net</a>><br>
<b>Sent:</b> Friday, June 14, 2019 5:47:17 PM<br>
<b>To:</b> Mike Jones<br>
<b>Cc:</b> Daniel Fett; <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">
openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> Re: Review of openid-connect-4-identity-assurance-04</span> <u></u>
<u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt">Hi Mike,<br>
<br>
Thanks a lot for your substantial feedback.<br>
<br>
While I'm incorporating it, I would like to sort out one question:<br>
<br>
> On 1. Jun 2019, at 02:16, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>> wrote:<br>
> <br>
> All Sections: Generalize kinds of verified claims. The most important issue is to generalize the goal of the document from defining how to use “verified person data” to defining how to use “verified data”. This work isn’t happening in a vacuum. There
are other efforts to define representations of verified claims in the industry, including
<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fw3c.github.io%2Fvc-data-model%2F&data=04%7C01%7CMichael.Jones%40microsoft.com%7C738191bfa76a4dcafab008d6f3320a2f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636963793587080034%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C-1&sdata=%2BlsNcGKOk2Hn3axOpeovB1Y9GDaDdiRJaUJb2PnEaAI%3D&reserved=0" target="_blank">
https://w3c.github.io/vc-data-model/</a>, that take this more general approach, but propose much more complicated data representations that are not based on JWTs. It would be highly beneficial to have a simple general JWT-based “verified data” representation
that is general-purpose. Indeed, that’s the possibility that excites me about this work. Don’t get me wrong – I believe that all the particulars for verified people data can and should remain. The main concrete change needed is to rename “verified_person_data”
to “verified_data”. <br>
<br>
I think “verified_claims” would fit even better. What do you think?<br>
<br>
best regards,<br>
Torsten. <br>
<br>
<u></u><u></u></p>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.openid.net%2Fmailman%2Flistinfo%2Fopenid-specs-ab&data=04%7C01%7CMichael.Jones%40microsoft.com%7C738191bfa76a4dcafab008d6f3320a2f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636963793587080034%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C-1&sdata=2K8aHamOCNr2QwvT3VlpdSN1%2B2M56O5EZ52mCPr78xk%3D&reserved=0" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote></div>