<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jul 7, 2017, at 2:26 AM, Dimitris Zacharopoulos <<a href="mailto:jimmy@it.auth.gr" class="">jimmy@it.auth.gr</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 6/7/2017 7:36 μμ, Peter Bowen via Netsec wrote:<br class=""><blockquote type="cite" class="">What about changing 2(m) to “multi-factor or multi-party authentication”? This would allow offline systems to use HSM controls to meet the requirement.<br class=""></blockquote><br class="">"Multi-factor" authentication is currently not defined in the document (it would be nice to add it). Usually, the different factors are "something you know", "something you have", "something you are" so you need a combination of these to achieve "multi-factor". Adding "multi-party" authentication makes sense but we would probably need to also define it.<br class=""></div></div></blockquote><div><br class=""></div><div>I would prefer to hold off of any major work here, including adding definitions, and instead have us consider adopting NIST 800-63B language as a future revision. <a href="https://pages.nist.gov/800-63-3/sp800-63b.html" class="">https://pages.nist.gov/800-63-3/sp800-63b.html</a> has very clear definitions and also provides the concept of “Authenticator Assurance Levels” which abstract specific technologies into allowed combinations. </div><div><br class=""></div><div>I was hoping adding “or multi-party” would be a simple change as “multi-party” is already used in WebTrust for CAs and ISO 21188 illustrative controls. I’m happy to use a different term.</div><br class=""><blockquote type="cite" class=""><div class=""><div class="">So, to better understand the suggestion, for 2(m) we would need either "multi-factor authentication by a single person" OR "single-factor authentication by multiple persons". Is that right?</div></div></blockquote><br class=""></div><div>Yes, that was my intention.</div><div><br class=""></div><div>Thanks,</div><div>Peter</div></body></html>