2.5 Summary of Requirements

Before · SP 800-63B

After · SP 800-63B-4

Summary of Requirements

Before · SP 800-63B

After · SP 800-63B-4

Table 1 provides a non-normative summary of the requirements for each of the AALs.

Table 1. Summary of requirements by AAL

Requirement AAL1 AAL2 AAL3 Permitted Authenticator Types
* Any AAL2 or AAL3 authenticator type
* Password
* Look-up secret
* Out-of-band
* SF OTP
* SF cryptographic
* MF cryptographic
* MF out-of-band
* MF OTP
* Password or biometric comparison plus: –SF cryptographic –Look-up secret –Out-of-band –SF OTP
* MF cryptographic
* SF cryptographic plus: –Password –Biometric comparison

FIPS 140 Validation (Government Verifiers and Authenticators) Verifiers –Level 1 Verifiers –Level 1 Authenticators –Level 1 overall Verifiers –Level 1 Authenticators –Level 1 overall Reauthentication (recommended) 30 days overall 24 hours overall 1 hour inactivity Single factor required 12 hours overall 15 minutes inactivity

Phishing Resistance Not required Recommended; Must be available Required

Replay Resistance Not required Required Required Authentication Intent Not required Recommended Required

Key Exportability Permitted Permitted Prohibited