How is the trust level of a sub-model, and of the whole model, determined in eCH-0170?
By the weakest link: the lowest-rated criterion sets the level of a sub-model, and the lowest sub-model sets the overall trust level.
* Minimum, not average: one weak criterion caps its sub-model, one weak sub-model caps the whole. *
Each level of a sub-model consists of several criteria. Each criterion is rated on its own, and then:
- Within a sub-model: the level equals the lowest criterion. A certified hardware token (level 4) with a 30-day re-authentication interval (level 1) is an authentication at level 1. Criteria may be supplemented with additional ones.
- Across sub-models: the overall trust level equals the lowest sub-model.
Worked example: authentication VSA3, registration VSR2, governance VSS4, federation VSF at the level-3 requirement. The overall trust level is 2, because registration only reached 2.
Why minimum and not average? An attacker always takes the easiest route. If registration accepts self-declared data, nobody needs to break the hardware token: they simply register under someone else's name. Averaging would hide exactly the weakness that will be exploited.
Tip: Think of a chain: its strength is its weakest link, never the mean of its links.