What is the state of standardisation for the quality of attributes, and which attempts were made?
It is a still unsolved problem: attempts such as the EU STORK project and the Swiss standard eCH-0171 did not lead to a broadly accepted model.
Rating authentication is comparatively mature: there are established level schemes (eCH-0170, eIDAS, ISO/IEC 29115, NIST SP 800-63). Rating attributes, the data delivered about a subject such as address, nationality, age or employer, has resisted standardisation. Attempts include:
- STORK, the EU project (ended 2015) that built cross-border eID interoperability and also looked at attribute quality.
- eCH-0171, a Swiss attempt to define a quality model for attributes.
Why is it so hard? Attribute quality is not one property. Each attribute has its own source, its own rate of change and its own verification process, and what counts as "good enough" depends on what the relying party uses it for. A single four-level scale fits authentication well but does not capture that variety. Research such as NIST's attribute-metadata work instead proposes describing each attribute with metadata (source, verification method, age of the data) and letting the RP decide.
Go deeper:
NIST IR 8112: Attribute Metadata โ a proposed schema for describing how trustworthy a federated attribute is.