On live video supported F2F May 9-11, 2016 Abingdon, Oxfordshire, UK

37 th EUGridPMA Abingdon – May David Groep – For the BIRCH and CEDAR Assurance [Vetting] should be based on a face-to-face meeting and should be confirmed via photo-identification and/or similar valid official documents. Identity vetting and validation should be based on  an in-person appearance before a trusted agent of the authority with presentation of a reliable photo-ID and/or valid official documents; or  be validated using notary-public attestations and/or official government data sources and supported by remote live video conversation; or  be performed according to Kantara LoA 2 or better.

37 th EUGridPMA Abingdon – May David Groep – Some current methods Most CAs support explicit F2F only  But may be designating RAs in many different ways Video-supported  Notary-public via postal mail + video: BR, TR  Government records: some TCS subscribers (universities with access to these databases) Kantara LoA 2  Some TCS countries (SE) for some of their applicants

37 th EUGridPMA Abingdon – May David Groep – On the notary public & govt. databases  In many countries, notaries are rather exclusive, and rather expensive to attest to documents (think ~€25 + half a day & travel for the appointment)  Access to databases to rather complex for most orgs  So e.g. HPCI and others are looking for alternatives By ‘chance’, I was exposed to another, quite interesting and rigorous process – which was easier – if you’re allowed to keep photographs … … and which some CAs (specifically HPCI, but I expect many others) would seriously want to consider!

37 th EUGridPMA Abingdon – May David Groep – Challenge-response live video 1.Send a registration form that can mostly be filled beforehand to the address of record 2.Start a video-conf (even just HD skype), and have the applicant write down some unique information on the form and sign it visibly during the chat. 3.Ask applicant to scan this form, and mail it to the RA 4.Have the applicant hold up the same form, a govt photoID, next to the face, and (I assume) have the RA take a screenshot for record 5.The RA can check if the form is correct, and – with the nonce – if it’s the same person (the video is ongoing) 6.The RA has validated the data, photoID, and a ‘video nonce’, and has the screenshot as proof

37 th EUGridPMA Abingdon – May David Groep – Open questions  The applicant needs a scanner & printer nearby – does that help for most applicants?  Is this an alternative acceptable process?  Is keeping the photograph a critical element?  If so: how can we document it in a way that is verifiable?