BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3 Authenticator and Verifier Requirements (was: Definitions and Abbreviations)

NIST PIV and digital identity SP 800-63B-4 against SP 800-63B
All changes in this version
modified 3 Authenticator and Verifier Requirements

Title changed

Before · SP 800-63B

Definitions and Abbreviations

After · SP 800-63B-4

DefinitionsAuthenticator and AbbreviationsVerifier Requirements

Control changed

Before · SP 800-63B

See SP 800-63 , Appendix A for a complete set of definitions and abbreviations.

After · SP 800-63B-4

SeeThis SPsection 800-63is normative.

This section provides detailed requirements that are specific to each type of authenticator. With the exception of the reauthentication requirements specified in Sec. 2 and the requirement for phishing resistance at AAL3 described in Sec. 3.2.5 , Appendixthe Atechnical requirements for each authenticator type are the same, regardless of the AAL at which the authenticator is used.

In federated applications described in [SP800-63C] , the authentication functions of an IdP correspond closely with that of a completeCSP setor verifier. In the discussion below, the requirements associated with a CSP also apply to an IdP.

In many circumstances, subscribers need to share devices that are used in authentication processes, such as a family phone that receives OTPs. In public-facing applications, CSPs SHOULD NOT prevent a device from being registered as an authenticator by multiple subscribers. However, they MAY establish restrictions to prevent large-scale fraud or misuse (e.g., limiting the total number of definitionssubscriber accounts a single device can be registered with).

Authentication, authenticator binding (discussed in Sec. 4.1 ), and abbreviationssession management (discussed in Sec. 5 ) are based on proof of possession of one or more types of secrets, as shown in Table 2 . Table 2. Summary of secrets (non-normative)

Type of Secret Purpose Reference Section Password A subscriber-chosen secret used as an authentication factor 3.1.1

Look-up secret A secret issued by a verifier and used only once to prove possession of the secret 3.1.2

Out-of-band secret A short-lived secret generated by a verifier and independently sent to a subscriber’s device to verify its possession 3.1.3 Continued from previous page Type of Secret Purpose Reference Section One-time passcodes (OTP) A secret generated by an authenticator and used only once to prove possession of the authenticator 3.1.4 , 3.1.5

Activation secret A password that is used locally as an activation factor for a multi-factor authenticator 3.2.10

Long-term authenticator secret A secret embedded in a physical authenticator to allow it to function for authentication 4.1

Recovery code A secret issued to the subscriber to allow them to recover an account at which they are no longer able to authenticate 4.2

Session secret A secret issued by the verifier at authentication and used to establish the continuity of authenticated sessions 5.1