3.3.2.2 Authentication Assurance Level

Before · SP 800-63-3

After · SP 800-63-4

Authentication Assurance Level

Before · SP 800-63-3

After · SP 800-63-4

• AAL1 : AAL1 provides basic confidence that the claimant controls an authenticator that is bound to the subscriber account. AAL1 requires either single-factor or multi-factor authentication using a wide range of available authentication technologies. Verifiers are expected to make multi-factor authentication options available at AAL1 and encourage their use. Successful authentication requires the claimant to prove possession and control of the authenticator through a secure authentication protocol.
• AAL2 : AAL2 provides high confidence that the claimant controls one or more authenticators that are bound to the subscriber account. Proof of the possession and control of two distinct authentication factors is required through the use of secure authentication protocols. Approved cryptographic techniques are required.
• AAL3 : AAL3 provides very high confidence that the claimant controls authenticators that are bound to the subscriber account. Authentication at AAL3 is based on the proof of possession of a key through the use of a cryptographic protocol and either an activation factor or a password. AAL3 authentication requires the use of a public-key cryptographic authenticator with a non-exportable private key that provides phishing resistance. Approved cryptographic techniques are required.

Table 2 describes the control objectives (i.e., attack protections) for each authentication assurance level.

Table 2. AAL Summary

AAL Control Objectives User Profile AAL1 Provide minimal protections against attacks. Deter password- focused attacks. No personal information is available to any users, but some profile or preference data maybe retained to support usability and the customization of applications. AAL2 Require multifactor authentication. Offer phishing- resistant options. Individual personal information can be viewed or modified by users. Limited proprietary information can be viewed by users. AAL3 Require phishing resistance and verifier compromise protections. Highly sensitive information can be viewed or modified. Multiple proprietary records can be viewed or modified by users. Privileged user access could result in a breach that would constitute a major incident under OMB guidance.