This document summarizes the various use cases of DI4R. The use cases are categorized by role: whether an entity is a consumer or a producer of attributes.
Branco to add first model here based on stuff fro chapter 8
Here provided comparative overviews illustrate the transition toward distributed identities.
COms, SRAMs?
Add Social to 4.2?
also compare trust model to federation/eduGAIN
How does verification actually work in IRMA?
https://irma.app/docs/overview/
Any entity that normally relies on an authentication flow that also aggregates attributes may use IRMA or another service for login. In this process, the user is challenged with a QR Code to brandish attributes with the help of the wallet app. The wallet app reads the QR code and engages in user interaction: it shows what is requested by the service and which "cards" - previously-stored attributes accommodate the request if any. Alternatively, in this flow, the user may acquire new cards to fulfil the request. The wallet then sends the attributes to the service, which can verify them with a background call.
With this method the Verifier no longer trusts an IdP (something that is exposed on the public internet) but trusts the authentication and the possession to the wallet. Arguably, this provides the opportunity to a stronger level of assurance (i.e. two factors to the wallet+possession of the device).
An obvious source of "cards" is a SAML federation. In order for a SAML attribute of a user to be converted to a card, the user needs to visit an entity that acts as a proxy. This proxy needs to behave as a SAML SP towards the user and the SAML federation. The user needs to visit the site with the intent of adding a card to their IRMA app so that the IRMA infrastructure can store the data as a card. The user will be logged in to this SAML SP which will consume the attributes from an IdP / AA then store it to the IRMA infrastructure.
An authentication source may already have to support multiple protocols, (for instance, SAML and OIDC) in order to cater for the modern web environment. A logical extension of this idea is to support an additional protocol, the card Issuer.
In a traditional SAML flow, the following happens. The goal is to enable user Aladár (A) to manage the authorisation of user Béla (B) authorization to service S, but in a way that this information is not maintained in S but in an external source, the Membership Management Service (MMS).
With the introduction of DI4R, the flow may be significantly simplified.
With this solution, B does not have to use the same login (i.e. the MMS and the target S do not need to be in the same federation). Possibly, B can receive the card at a page maintained by the DI4R provider.
Or, perhaps the DI4R provider's web interface serves as a landing page for the invitation?
An an academic peer review process honest opinions from an expert of the field is crucial.
There is an inevitable tendency for specialization in science, because any modern problems can only tackled in focused, carreer-long efforts, so in most subdisciplines the researchers will have a tendency of knowing each other.
This, however, presents a challenge for the review process. In order to overcome the challenge, in most widely used review processes a degree of anonimity is introduced.
The "Single Blind" process is considered to be a minimum requirement - in this case, the author does not learn the identity of the reviewer. For most journals this is considered insufficient, since the reviewers still know the identity of the author and they may be biased in one way or the other. Yet, in some cases, especially in less common language there is no true alternative as the content of the article drastically narrows down the set of possible authors, sometimes to one. In these cases the more anonymous methods are disingenous.
The "Double Blind" process means that neither the authors learn the identity of the reviewers or the reviewers of the authors. This is the most common type of peer review process. But it still leaves significant control in the hands of the editor, who knows the identity of both, plus, due to the structure of the fields of science, she may personally know all parties and have their own iterest. The editor may also know the review styles of particular reviewers based on previous engagements. Therefore it is possible to pick a lenient or a strict reviewer for a given paper for instance.
The Triple Blind method prevents this problem as the identities of the author, editor, reviewer are uknown to each other. However, this is the hardest to implements, as the editor still needs to be sure about the expertise of the reviewer, moreover, she should also know that the author does not temper with the process by being its own reviewer or bringing in friendly reviewers. At this point the scientific process becomes somewhat analoguous with e-voting systems.
Furthermore, all three types of blind reviews have a common problem, which is that the work of the reviewer cannot be easily credited to them. This disincetivises the reviewers form participating and therefore is a drawback for the the entire scientific process.
https://irma.app/docs/revocation/