4 The CSP SHALL require that all digital validation and verification of evidence (was: The CSP SHOULD perform KBV by verifying knowledge of recent transactional history)
All changes in this version
Title changed
Before · SP 800-63A
The CSP SHOULD perform KBV by verifying knowledge of recent transactional history
After · SP 800-63A-4
The CSP SHOULDSHALL performrequire KBVthat byall verifyingdigital knowledgevalidation ofand recentverification transactionalof historyevidence
Control changed
Before · SP 800-63A
in which the CSP is a participant. The CSP SHALL ensure that transaction information has at least 20 bits of entropy. For example, to reach minimum entropy requirements, the CSP could ask the applicant for verification of the amount(s) and transaction numbers(s) of a micro-deposit(s) to a valid bank account, so long as the total number of digits is seven or greater. 5. The CSP MAY perform KBV by asking the applicant questions to demonstrate they are the owner of the claimed information. However, the following requirements apply: a. KBV SHOULD be based on multiple authoritative sources. b. The CSP SHALL require a minimum of four KBV questions with each requiring a correct answer to successfully complete the KBV step. c. The CSP SHOULD require free-form response KBV questions. The CSP MAY allow multiple choice questions, however, if multiple choice questions are provided, the CSP SHALL require a minimum of four answer options per question. d. The CSP SHOULD allow two attempts for an applicant to complete the KBV. A CSP SHALL NOT allow more than three attempts to complete the KBV. e. The CSP SHALL time out KBV sessions after two minutes of inactivity per question. In cases of session timeout, the CSP SHALL restart the entire KBV process and consider this a failed attempt. f. The CSP SHALL NOT present a majority of diversionary KBV questions (i.e., those where "none of the above" is the correct answer). g. The CSP SHOULD NOT ask the same KBV questions in subsequent attempts. h. The CSP SHALL NOT ask a KBV question that provides information that could assist in answering any future KBV question in a single session or a subsequent session after a failed attempt. i. The CSP SHALL NOT use KBV questions for which the answers do not change (e.g., "What was your first car?"). j. The CSP SHALL ensure that any KBV question does not reveal PII that the applicant has not already provided, nor personal information that, when combined with other information in a KBV session, could result in unique identification.
After · SP 800-63A-4
in which the CSP is a participant(e. The CSP SHALL ensure that transaction information has at least 20 bits of entropyg. For example, to reach minimum entropy requirements, the CSPvia couldchip askor thewireless applicanttechnologies) forbe verificationperformed ofby theintegrated amount(s)scanners and transaction numbers(s) of asensors micro-deposit(s) to a valid bank accounte.g., so long as the total number of digits is sevenembedded orfingerprint greaterreader).
5. The CSP MAY perform KBV by asking theAll applicantdevices questionsused to demonstrate they are thesupport ownerinteraction ofbetween the claimedproofing information.agent However,and the following requirements apply: a. KBVapplicant SHOULDSHALL be based onsafeguarded multiplefrom authoritativetampering sources.through b.observation Theby CSP SHALL require a minimum of four KBV questions with each requiring a correct answer to successfullyrepresentatives completeor themonitoring KBVdevices step(e. cg. The CSP, SHOULDcameras) requireand free-formthrough responsephysical KBVand questions.digital Thetamper CSPprevention MAYfeatures.
6. allowAll multipledevices choiceused questions,to however,support ifinteraction multiplebetween choicethe questionsproofing areagent provided,and the CSPapplicant SHALL require a minimum of four answer options per question. d.be Theprotected CSPby SHOULDappropriate allowbaseline twosecurity attemptsfeatures forthat anare applicantcomparable to complete theat KBV.least AFISMA CSPmoderate SHALLcontrols, NOTincluding allowmalware moreprotection, thanadministrator-specific threeaccess attemptscontrols, toand completesoftware theupdate KBVprocesses. e
7. The CSP SHALL time out KBV sessions after twoAll minutesdevices ofused inactivityto persupport question.interaction Inbetween casesthe ofproofing sessionagent timeout,and the CSPapplicant SHALL restartbe theinspected entireperiodically KBVby processtrained andtechnicians considerto thisdeter atampering, failedmodification, attempt.or fdamage. The CSP SHALL NOT present a majority of diversionary KBV questions (i
4.e3., those where9. "noneNotification of the above"Proofing isUpon the correct answer).successful g.completion Theof CSPidentity SHOULDproofing NOTat askIAL3, the same KBV questions in subsequent attempts. h. The CSP SHALL NOT asksend a KBV question that provides information that could assist in answering any futurenotification KBVof questionproofing into a single sessionvalidated oraddress afor subsequentthe sessionapplicant, afteras aspecified failedin attemptSec. i3.10 The. CSPCSPs SHALLSHOULD NOTsend usethe KBVnotification questionsof forproofing whichto the answers doapplicant’s notpostal changeaddress. (e4.g3., "What was10. yourInitial firstAuthenticator car?").Binding j1. The CSP SHALL ensure that any KBV question does not revealdistribute PIIor thatenroll the applicant has not alreadysubscriber’s provided,initial norauthenticator personalduring informationan that,on-site whenattended combinedinteraction with other information in a KBV session, could result in uniqueproofing identificationagent.