2 Authentication Assurance Levels (was: Introduction)
All changes in this version
Title changed
Before · SP 800-63B
Introduction
After · SP 800-63B-4
IntroductionAuthentication Assurance Levels
Control changed
Before · SP 800-63B
This section is informative.
Digital identity is the unique representation of a subject engaged in an online transaction. A digital identity is always unique in the context of a digital service, but does not necessarily need to be traceable back to a specific real-life subject. In other words, accessing a digital service may not mean that the underlying subject’s real-life representation is known. Identity proofing establishes that a subject is actually who they claim to be. Digital authentication is the process of determining the validity of one or more authenticators used to claim a digital identity. Authentication establishes that a subject attempting to access a digital service is in control of the technologies used to authenticate. For services in which return visits are applicable, successfully authenticating provides reasonable risk-based assurances that the subject accessing the service today is the same as the one who accessed the service previously. Digital identity presents a technical challenge because it often involves the proofing of individuals over an open network and always involves the authentication of individuals over an open network. This presents multiple opportunities for impersonation and other attacks which can lead to fraudulent claims of a subject’s digital identity.
The ongoing authentication of subscribers is central to the process of associating a subscriber with their online activity. Subscriber authentication is performed by verifying that the claimant controls one or more authenticators (called tokens in earlier versions of SP 800-63) associated with a given subscriber. A successful authentication results in the assertion of an identifier, either pseudonymous or non-pseudonymous, and optionally other identity information, to the relying party (RP).
This document provides recommendations on types of authentication processes, including choices of authenticators, that may be used at various Authenticator Assurance Levels (AALs). It also provides recommendations on the lifecycle of authenticators, including revocation in the event of loss or theft.
This technical guideline applies to digital authentication of subjects to systems over a network. It does not address the authentication of a person for physical access (e.g., to a building), though some credentials used for digital access may also be used for physical access authentication. This technical guideline also requires that federal systems and service providers participating in authentication protocols be authenticated to subscribers.
The strength of an authentication transaction is characterized by an ordinal measurement known as the AAL. Stronger authentication (a higher AAL) requires malicious actors to have better capabilities and expend greater resources in order to successfully subvert the authentication process. Authentication at higher AALs can effectively reduce the risk of attacks. A high-level summary of the technical requirements for each of the AALs is provided below; see Sections 4 and 5 of this document for specific normative requirements.
Authenticator Assurance Level 1 : AAL1 provides some assurance that the claimant controls an authenticator bound to the subscriber’s account. AAL1 requires either single-factor or multi- factor authentication using a wide range of available authentication technologies. Successful authentication requires that the claimant prove possession and control of the authenticator through a secure authentication protocol.
Authenticator Assurance Level 2 : AAL2 provides high confidence that the claimant controls authenticator(s) bound to the subscriber’s account. Proof of possession and control of two different authentication factors is required through secure authentication protocol(s). Approved cryptographic techniques are required at AAL2 and above.
Authenticator Assurance Level 3 : AAL3 provides very high confidence that the claimant controls authenticator(s) bound to the subscriber’s account. Authentication at AAL3 is based on proof of possession of a key through a cryptographic protocol. AAL3 authentication requires a hardware-based authenticator and an authenticator that provides verifier impersonation resistance; the same device may fulfill both these requirements. In order to authenticate at AAL3, claimants are required to prove possession and control of two distinct authentication factors through secure authentication protocol(s). Approved cryptographic techniques are required.
The following table states which sections of the document are normative and which are informative:
Table 2-1 Normative and Informative Sections of SP 800-63B
Section Name Normative/Informative
After · SP 800-63B-4
This section is informativenormative.Digital identityTo issatisfy the unique representationrequirements of a subject engaged in an online transaction. A digital identity is alwaysgiven uniqueAAL inand thebe contextrecognized ofas a digital servicesubscriber, but does not necessarily need toa beclaimant traceableSHALL backauthenticate to a specific real-life subject.an InRP other(or wordsIdP, accessing a digital serviceas maydescribed notin mean[SP800-63C] that) thewith underlyinga subject’sprocess real-lifewhose representationstrength is known. Identity proofing establishes thatequal ato subjector isgreater actuallythan whothe theyrequirements claimat tothat belevel. DigitalThe authentication is the process of determining the validity of one or more authenticators used to claim a digitalresults identity.in Authenticationan establishesidentifier that a subject attempting to access a digital service is in controluniquely ofidentifies the technologies used to authenticate.subscriber Foreach servicestime inthey whichauthenticate returnto visitsthat areRP. applicable,The successfullyidentifier authenticatingMAY providesbe reasonablepseudonymous. risk-basedOther assurancesattributes that the subject accessing the service today isidentify the samesubscriber as the one who accessed the service previously. Digital identity presents a technical challenge because itunique oftensubject involvesMAY thealso proofingbe ofprovided. individualsDetailed overnormative anrequirements openfor networkauthenticators and alwaysverifiers involvesat theeach authenticationAAL ofare individualsprovided overin anSec. open3 network. ThisSee presents[SP800-63] multipleSec. opportunities3 for impersonation and other attacks whichdetails canon leadhow to fraudulent claims ofchoose athe subject’smost digitalappropriate identityAAL.The ongoing authentication of subscribersPersonal isinformation centralcollected toduring theand processafter ofidentity associatingproofing a(see subscriber[SP800-63A] with) theirMAY onlinebe activity.made Subscriberavailable authenticationto isthe performedsubscriber by verifying that the claimantdigital controlsidentity oneservice orthrough morethe authenticatorssubscriber (calledaccount. tokensThe inrelease earlieror versionsonline ofavailability SPof 800-63)any associatedpersonal withinformation aby givenfederal subscriber.agencies Arequires successfulmulti-factor authentication results in theaccordance assertionwith of[EO13681] an. identifierTherefore, eitherfederal pseudonymousagencies orSHALL non-pseudonymous,select anda optionallyminimum otherof identityAAL2 information,when topersonal theinformation relyingis partymade (RP)available online.This document providesAt recommendationsall onAALs, typesindicators of authenticationpotential processesfraud, including choices of authenticators, that may be used at variousapplicable Authenticatorindicators Assurancedescribed Levelsin (AALs)Sec. It also provides recommendations on the5.3 lifecycle, ofMAY authenticators,be includingused revocationto inlower the eventrisk of loss or theftmisauthentication.
Thistechnical guideline applies toFor digitalexample, authentication of subjects to systems overfrom aan network.unexpected Itgeolocation doesor notIP address the authentication of a person for physical accessblock (e.g., to a building),cloud thoughservice) somemight credentialsprompt usedthe foruse digitalof accessadditional mayrisk-based alsocontrols. beCSPs usedor forverifiers physicalSHALL accessassess authentication.their Thisuse technicalof guidelineindicators alsoof requirespotential thatfraud federalfor systemsefficacy and service providers participating in authenticationto protocolsidentify beand authenticatedmitigate topotential subscribers.negative
Thestrengthimpacts ofon antheir authenticationuser transactionpopulations. isCSPs characterizedor byverifiers anSHALL ordinalinclude measurementfraud knownindicators asin the AAL. Stronger authentication (a higher AAL) requires malicious actors toprivacy haverisk betterassessment. capabilitiesThe anduse expendof greaterpotential resourcesfraud inindicators orderprior to successfullyor subvertduring the authentication process. Authentication at higherdoes AALsnot canimpact effectivelyor reducechange the riskAAL of attacks. A high-level summary ofa thetransaction technicalor requirementssubstitute for each of the AALs is provided below; see Sections 4 andan 5authentication offactor.
Throughout this document for specific, normative[FIPS140] requirements.
AuthenticatorAssuranceare Levelsatisfied 1by :security AAL1technologies, providesproducts, someand assuranceservices that the claimantutilize controlsimplementations anof authenticatorcryptography boundvalidated toby the subscriber’s account.Cryptography AAL1Module requiresValidation eitherProgram single-factor[CMVP] or. multi-FIPS factor140 authenticationrequirements usingat a wide range of available authentication technologies. Successful authenticationgiven requiresAAL thatare theoften claimantdifferent provefor possessionauthenticators and controlverifiers, ofwith themore authenticatorstringent throughrequirements agenerally secureapplying authenticationto protocolverifiers.
AuthenticatorAssurance Level 2 : AAL2This providesis highin confidencerecognition thatof the claimant controls authenticator(s)practical boundlimitations toon the subscriber’s account. Proof of possession and controlcertification of two different authentication factors is required through secure authentication protocol(s). Approved cryptographic techniques are required at AAL2 and above.authenticators
Authenticator Assurance Level 3 : AAL3 provides very high confidence that the claimant controlsauthenticator(s)as boundwell toas the subscriber’s account. Authenticationbroader atscope AAL3that is based on proof of possession of aoften keyassociated throughwith a cryptographic protocol. AAL3security authenticationbreach requiresat a hardware-based authenticator and an authenticator that provides verifier impersonation resistance; the same device may fulfill both these requirements. In order to authenticate at AAL3, claimants are required to prove possession and control of two distinct authentication factors through secure authentication protocol(s). Approved cryptographic techniques are required.
The following table states which sections of the document are normative and which are informative:
Table 2-1 Normative and Informative Sections of SP 800-63B
Section Name Normative/Informative