BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.5.3 SP 800-63-3

NIST PIV and digital identity SP 800-63-3
All changes in this version
first version loaded 2 Introduction part of 2.5

Title

SP 800-63-3

Control

NIST SP 800-63-3 is a substantial update and restructuring of SP 800-63-2. SP 800-63-3 introduces individual components of digital authentication assurance — AAL, IAL, and FAL — to support the growing need for independent treatment of authentication strength and confidence in an individual’s claimed identity (e.g., in strong pseudonymous authentication). A risk assessment methodology and its application to IAL, AAL, and FAL has been included in this guideline. It also moves the whole of digital identity guidance covered under SP 800-63 from a single document describing authentication to a suite of four documents (to separately address the individual components mentioned above) of which SP 800-63-3 is the top-level document.

Other areas updated in 800-63-3 include:

• Renamed to “Digital Identity Guidelines” to properly represent the scope includes identity proofing and federation, and to support expanding the scope to include device identity, or machine-to-machine authentication in future revisions.
• Terminology changes, including the use of authenticator in place of token to avoid conflicting use of the word token in assertion technologies.
• Updates to authentication and assertion requirements to reflect advances in both security technology and threats.
• Requirements on the storage of long-term secrets by verifiers.
• Restructured identity proofing model.
• Updated requirements regarding remote identity proofing.
• Clarification on the use of independent channels and devices as “something you have”.
• Removal of pre-registered knowledge tokens (authenticators), with the recognition that they are special cases of (often very weak) passwords.
• Requirements regarding account recovery in the event of loss or theft of an authenticator.
• Removal of email as a valid channel for out-of-band authenticators.
• Expanded discussion of re-authentication and session management.
• Expanded discussion of identity federation; restructuring of assertions in the context of federation.