NIST PIV and digital identity SP 800-63B → SP 800-63B-4
Published 2025-07-31
Snapshot taken 2026-10-19 23:50 · sp-800-63b source
Snapshot taken 2026-10-19 23:50 · sp-800-63b source
+ 69 added: 1.1, 1.2, 2.1, 2.1.1, 2.1.2, 2.1.3, 2.2, 2.2.1, 2.2.2, 2.2.3…
− 7 removed: 10, 11, 5, 6, 7, 8, 9
~ 4 revised: 1, 2, 3, 4
Why this release, in the publisher's words
Planning Note (10/06/2026): The Implementation Resource Hub for SP 800-63-4 is now available!
https://csrc.nist.gov/pubs/sp/800/63/b/4/finalAll · 801 Introduction · 310 Usability Considerations · 111 References · 12 Authentication Assurance Levels · 193 Authenticator and Verifier Requirements · 504 Authenticator Event Management · 15 Authenticator and Verifier Requirements · 16 Authenticator Lifecycle Management · 17 Session Management · 18 Threats and Security Considerations · 19 Privacy Considerations · 1
Controls added, removed or revised 80
| Control | Title | Change |
|---|---|---|
| 1 | Introduction | Control text, Title |
| 1.1 | Notations | added |
| 1.2 | Document Structure | added |
| 10 | Usability Considerations | removed |
| 11 | References | removed |
| 2 | Authentication Assurance Levels | Control text, Title |
| 2.1 | Authentication Assurance Level 1 | added |
| 2.1.1 | Permitted Authenticator Types | added |
| 2.1.2 | Authenticator and Verifier Requirements | added |
| 2.1.3 | Reauthentication | added |
| 2.2 | Authentication Assurance Level 2 | added |
| 2.2.1 | Permitted Authenticator Types | added |
| 2.2.2 | Authenticator and Verifier Requirements | added |
| 2.2.3 | Reauthentication | added |
| 2.3 | Authentication Assurance Level 3 | added |
| 2.3.1 | Permitted Authenticator Types | added |
| 2.3.2 | Authenticator and Verifier Requirements | added |
| 2.3.3 | Reauthentication | added |
| 2.4 | General Requirements | added |
| 2.4.1 | Security Controls | added |
| 2.4.2 | Records Retention Policy | added |
| 2.4.3 | Privacy Requirements | added |
| 2.4.4 | Redress Requirements | added |
| 2.5 | Summary of Requirements | added |
| 3 | Authenticator and Verifier Requirements | Control text, Title |
| 3.1 | Requirements by Authenticator Type | added |
| 3.1.1 | Passwords | added |
| 3.1.1.1 | Password Authenticators | added |
| 3.1.1.2 | Password Verifiers | added |
| 3.1.2 | Look-Up Secrets | added |
| 3.1.2.1 | Look-Up Secret Authenticators | added |
| 3.1.2.2 | Look-Up Secret Verifiers | added |
| 3.1.3 | Out-of-Band Devices | added |
| 3.1.3.1 | Out-of-Band Authenticators | added |
| 3.1.3.2 | Out-of-Band Verifiers | added |
| 3.1.3.3 | Authentication Using the Public Switched Telephone Network | added |
| 3.1.3.4 | Multi-Factor Out-of-Band Authenticators | added |
| 3.1.4 | Single-Factor OTP | added |
| 3.1.4.1 | Single-Factor OTP Authenticators | added |
| 3.1.4.2 | Single-Factor OTP Verifiers | added |
| 3.1.5 | Multi-Factor OTPs | added |
| 3.1.5.1 | Multi-Factor OTP Authenticators | added |
| 3.1.5.2 | Multi-Factor OTP Verifiers | added |
| 3.1.6 | Single-Factor Cryptographic Authentication | added |
| 3.1.6.1 | Single-Factor Cryptographic Authenticators | added |
| 3.1.6.2 | Single-Factor Cryptographic Verifiers | added |
| 3.1.7 | Multi-Factor Cryptographic Authentication | added |
| 3.1.7.1 | Multi-Factor Cryptographic Authenticators | added |
| 3.1.7.2 | Multi-Factor Cryptographic Verifiers | added |
| 3.1.7.3 | Usage With Subscriber-Controlled Wallets | added |
| 3.1.7.4 | Syncable Authenticators | added |
| 3.2 | General Authenticator Requirements | added |
| 3.2.1 | Physical Authenticators | added |
| 3.2.10 | Activation Secrets | added |
| 3.2.11 | Connected Authenticators | added |
| 3.2.11.1 | Wired Connections | added |
| 3.2.11.2 | Wireless Connections | added |
| 3.2.11.3 | Hybrid Connections | added |
| 3.2.12 | Random Values | added |
| 3.2.13 | Exportability | added |
| 3.2.2 | Rate Limiting (Throttling) | added |
| 3.2.3 | Use of Biometrics | added |
| 3.2.3.1 | Biometric Accuracy | added |
| 3.2.3.2 | Presentation Attack Detection | added |
| 3.2.3.3 | Injection Attack Detection | added |
| 3.2.3.4 | Use of Biometric Samples | added |
| 3.2.4 | Attestation | added |
| 3.2.5 | Phishing Resistance | added |
| 3.2.5.1 | Channel Binding | added |
| 3.2.5.2 | Verifier Name Binding | added |
| 3.2.6 | Verifier-CSP or IdP Communications | added |
| 3.2.7 | Replay Resistance | added |
| 3.2.8 | Authentication Intent | added |
| 3.2.9 | Restricted Authenticators | added |
| 4 | Authenticator Event Management | Control text, Title |
| 5 | Authenticator and Verifier Requirements | removed |
| 6 | Authenticator Lifecycle Management | removed |
| 7 | Session Management | removed |
| 8 | Threats and Security Considerations | removed |
| 9 | Privacy Considerations | removed |
Read every requirement in this version · All versions of NIST PIV and digital identity