{"action":"created","issue":{"url":"https://api.github.com/repos/usnistgov/800-63-3/issues/221","repository_url":"https://api.github.com/repos/usnistgov/800-63-3","labels_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/221/labels{/name}","comments_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/221/comments","events_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/221/events","html_url":"https://github.com/usnistgov/800-63-3/issues/221","id":170304858,"number":221,"title":"Suggestion for AAL 2 ","user":{"login":"hitoshikokumai","id":20733106,"avatar_url":"https://avatars.githubusercontent.com/u/20733106?v=3","gravatar_id":"","url":"https://api.github.com/users/hitoshikokumai","html_url":"https://github.com/hitoshikokumai","followers_url":"https://api.github.com/users/hitoshikokumai/followers","following_url":"https://api.github.com/users/hitoshikokumai/following{/other_user}","gists_url":"https://api.github.com/users/hitoshikokumai/gists{/gist_id}","starred_url":"https://api.github.com/users/hitoshikokumai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hitoshikokumai/subscriptions","organizations_url":"https://api.github.com/users/hitoshikokumai/orgs","repos_url":"https://api.github.com/users/hitoshikokumai/repos","events_url":"https://api.github.com/users/hitoshikokumai/events{/privacy}","received_events_url":"https://api.github.com/users/hitoshikokumai/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/usnistgov/800-63-3/labels/63B","name":"63B","color":"c5def5"},{"url":"https://api.github.com/repos/usnistgov/800-63-3/labels/decline","name":"decline","color":"b60205"}],"state":"closed","locked":false,"assignee":{"login":"jimfenton","id":1020212,"avatar_url":"https://avatars.githubusercontent.com/u/1020212?v=3","gravatar_id":"","url":"https://api.github.com/users/jimfenton","html_url":"https://github.com/jimfenton","followers_url":"https://api.github.com/users/jimfenton/followers","following_url":"https://api.github.com/users/jimfenton/following{/other_user}","gists_url":"https://api.github.com/users/jimfenton/gists{/gist_id}","starred_url":"https://api.github.com/users/jimfenton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimfenton/subscriptions","organizations_url":"https://api.github.com/users/jimfenton/orgs","repos_url":"https://api.github.com/users/jimfenton/repos","events_url":"https://api.github.com/users/jimfenton/events{/privacy}","received_events_url":"https://api.github.com/users/jimfenton/received_events","type":"User","site_admin":false},"assignees":[{"login":"jimfenton","id":1020212,"avatar_url":"https://avatars.githubusercontent.com/u/1020212?v=3","gravatar_id":"","url":"https://api.github.com/users/jimfenton","html_url":"https://github.com/jimfenton","followers_url":"https://api.github.com/users/jimfenton/followers","following_url":"https://api.github.com/users/jimfenton/following{/other_user}","gists_url":"https://api.github.com/users/jimfenton/gists{/gist_id}","starred_url":"https://api.github.com/users/jimfenton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimfenton/subscriptions","organizations_url":"https://api.github.com/users/jimfenton/orgs","repos_url":"https://api.github.com/users/jimfenton/repos","events_url":"https://api.github.com/users/jimfenton/events{/privacy}","received_events_url":"https://api.github.com/users/jimfenton/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/usnistgov/800-63-3/milestones/4","html_url":"https://github.com/usnistgov/800-63-3/milestones/Iteration%204","labels_url":"https://api.github.com/repos/usnistgov/800-63-3/milestones/4/labels","id":1742377,"number":4,"title":"Iteration 4","description":"","creator":{"login":"pgrassi-nist","id":13986911,"avatar_url":"https://avatars.githubusercontent.com/u/13986911?v=3","gravatar_id":"","url":"https://api.github.com/users/pgrassi-nist","html_url":"https://github.com/pgrassi-nist","followers_url":"https://api.github.com/users/pgrassi-nist/followers","following_url":"https://api.github.com/users/pgrassi-nist/following{/other_user}","gists_url":"https://api.github.com/users/pgrassi-nist/gists{/gist_id}","starred_url":"https://api.github.com/users/pgrassi-nist/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pgrassi-nist/subscriptions","organizations_url":"https://api.github.com/users/pgrassi-nist/orgs","repos_url":"https://api.github.com/users/pgrassi-nist/repos","events_url":"https://api.github.com/users/pgrassi-nist/events{/privacy}","received_events_url":"https://api.github.com/users/pgrassi-nist/received_events","type":"User","site_admin":false},"open_issues":20,"closed_issues":25,"state":"open","created_at":"2016-05-02T13:07:42Z","updated_at":"2016-09-02T23:05:32Z","due_on":"2016-09-17T04:00:00Z","closed_at":null},"comments":6,"created_at":"2016-08-10T00:53:10Z","updated_at":"2016-09-06T02:02:07Z","closed_at":"2016-09-01T05:02:40Z","body":"**Organization**: 3\r\n \r\n**Type**:  Security design\r\n \r\n**Document (63-3, 63A, 63B, or 63C)**: 63B\r\n\r\n**Reference (Include section and paragraph number)**:   Executive Summary AAL 2, Introduction AAL 2 and 4.2. Authenticator Assurance Level 2\r\n \r\n**Comment (Include rationale for comment)**:  Two different factors can be operated in two ways - (1) by AND/Conjunction (we need to go through both of the two) or (2) by OR/Disjunction (we need only to go through either of the two).  \r\n\r\nIf two different factors are used by OR/Disjunction, we will only obtain the level of security lower than AAL 1.  AAL 2 can be achieved only by (1) AND/Conjunction.  \r\n\r\nFor further details of the rationale, you could refer to my earlier comment #193.\r\n\r\n**Suggested Change**:  Such a sentence as \" The two different factors shall be used by AND/Conjunction (we need to go through both of the two), not by (2) by OR/Disjunction (we need only to go through either of the two.)\" should be explicitly included in all the relevant sections.\r\n \r\n---\r\n \r\nOrganization: 1 = Federal, 2 = Industry, 3 = Other \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/usnistgov/800-63-3/issues/comments/244832912","html_url":"https://github.com/usnistgov/800-63-3/issues/221#issuecomment-244832912","issue_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/221","id":244832912,"user":{"login":"hitoshikokumai","id":20733106,"avatar_url":"https://avatars.githubusercontent.com/u/20733106?v=3","gravatar_id":"","url":"https://api.github.com/users/hitoshikokumai","html_url":"https://github.com/hitoshikokumai","followers_url":"https://api.github.com/users/hitoshikokumai/followers","following_url":"https://api.github.com/users/hitoshikokumai/following{/other_user}","gists_url":"https://api.github.com/users/hitoshikokumai/gists{/gist_id}","starred_url":"https://api.github.com/users/hitoshikokumai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hitoshikokumai/subscriptions","organizations_url":"https://api.github.com/users/hitoshikokumai/orgs","repos_url":"https://api.github.com/users/hitoshikokumai/repos","events_url":"https://api.github.com/users/hitoshikokumai/events{/privacy}","received_events_url":"https://api.github.com/users/hitoshikokumai/received_events","type":"User","site_admin":false},"created_at":"2016-09-06T02:02:07Z","updated_at":"2016-09-06T02:02:07Z","body":"As stated in the latest suggestion #334, the story of account recovery is valid for the cases of biometrics and passwords used by AND/Conjunction. It is wrong, however, to try to apply it to the cases of  \"biometrics with a fallback password operated by OR/Disjunction\"."}}
{"actor":{"display_login":"hitoshikokumai"}}