BaselineWatch
11 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST PIV and digital identity SP 800-63B

11 requirements · published 2020-03-02
Changes in this version
All1 Purpose10 Usability Considerations11 References2 Introduction3 Definitions and Abbreviations4 Authenticator Assurance Levels5 Authenticator and Verifier Requirements6 Authenticator Lifecycle Management7 Session Management8 Threats and Security Considerations9 Privacy Considerations
RefTitleText
1 Purpose This section is informative. This document and its companion documents, Special Publication (SP) 800-63 , SP 800-63A , and SP 800-63C , provide technical guidelines to agencies for the implementation of digital authentication.
2 Introduction This section is informative. Digital identity is the unique representation of a subject engaged in an online transaction. A digital identity is always unique in the context of a digital service, but does not necessarily need to be traceabl
3 Definitions and Abbreviations See SP 800-63 , Appendix A for a complete set of definitions and abbreviations.
4 Authenticator Assurance Levels This section contains both normative and informative material. To satisfy the requirements of a given AAL, a claimant SHALL be authenticated with at least a given level of strength to be recognized as a subscriber. The result of an authent
5 Authenticator and Verifier Requirements This section is normative. This section provides the detailed requirements specific to each type of authenticator. With the exception of reauthentication requirements specified in Section 4 and the requirement for verifier impersonation re
6 Authenticator Lifecycle Management This section is normative. A number of events can occur over the lifecycle of a subscriber’s authenticator that affect that authenticator’s use. These events include binding, loss, theft, unauthorized duplication, expiration, and revocatio
7 Session Management This section is normative. Once an authentication event has taken place, it is often desirable to allow the subscriber to continue using the application across multiple subsequent interactions without requiring them to repeat the authentic
8 Threats and Security Considerations This section is informative. Authenticator Threats An attacker who can gain control of an authenticator will often be able to masquerade as the authenticator’s owner. Threats to authenticators can be categorized based on attacks on the ty
9 Privacy Considerations These privacy considerations supplement the guidance in Section 4. This section is informative. Privacy Risk Assessment Sections 4.1.5 , 4.2.5 , and 4.3.5 require the CSP to conduct a privacy risk assessment for records retention. Such a
10 Usability Considerations This section is informative. ISO/IEC 9241-11 defines usability as the “extent to which a product can be used by specified users to achieve specified goals with effectiveness, efficiency and satisfaction in a specified context of use.” This
11 References This section is informative. General References [BALLOON] Boneh, Dan, Corrigan-Gibbs, Henry, and Stuart Schechter. “Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks,” Asiacrypt 2016 , Octobe

11 of 11.