NIST PIV and digital identity SP 800-63C → SP 800-63C-4
Published 2025-07-31
Snapshot taken 2026-10-19 23:50 · sp-800-63c source
Snapshot taken 2026-10-19 23:50 · sp-800-63c source
+ 60 added: 1.1, 1.1.1, 1.2, 2.1, 2.2, 2.3, 2.4, 2.5, 3.1, 3.10…
− 30 removed: 10, 10.1, 10.2, 10.2.1, 10.2.2, 10.2.3, 11, 11.1, 11.2, 11.3…
~ 4 revised: 1, 2, 3, 4
Why this release, in the publisher's words
Planning Note (10/06/2026): The Implementation Resource Hub for SP 800-63-4 is now available!
https://csrc.nist.gov/pubs/sp/800/63/c/4/finalAll · 941 Introduction · 410 Usability Considerations · 611 Examples · 412 References · 52 Federation Assurance Level (FAL) · 63 Common Federation Requirements · 534 Validity time window: A period of time outside of which the assertion SHALL NOT · 15 Expiration: A timestamp indicating when the assertion expires and SHALL no · 16 Identifier: A value uniquely identifying this assertion, used to prevent attackers · 17 Signature: Digital signature or message authentication code (MAC), including key · 48 Security · 39 Privacy Considerations · 6
Controls added, removed or revised 94
| Control | Title | Change |
|---|---|---|
| 1 | Introduction | Control text, Title |
| 1.1 | Notations | added |
| 1.1.1 | Cryptographic Terminology | added |
| 1.2 | Document Structure | added |
| 10 | Usability Considerations | removed |
| 10.1 | General Usability Considerations | removed |
| 10.2 | Specific Usability Considerations | removed |
| 10.2.1 | User Perspectives on Online Identity | removed |
| 10.2.2 | User Perspectives of Trust and Benefits | removed |
| 10.2.3 | User Models and Beliefs | removed |
| 11 | Examples | removed |
| 11.1 | Specific Assertion Markup Language (SAML) | removed |
| 11.2 | Kerberos Tickets | removed |
| 11.3 | OpenID Connect | removed |
| 12 | References | removed |
| 12.1 | General References | removed |
| 12.2 | Standards | removed |
| 12.3 | NIST Special Publication | removed |
| 12.4 | Federal Information Processing Standards | removed |
| 2 | Federation Assurance Level (FAL) | Control text, Title |
| 2.1 | Common FAL Requirements | added |
| 2.2 | Federation Assurance Level 1 (FAL1) | added |
| 2.3 | Federation Assurance Level 2 (FAL2) | added |
| 2.4 | Federation Assurance Level 3 (FAL3) | added |
| 2.5 | Requesting and Processing xALs | added |
| 3 | Common Federation Requirements | Control text, Title |
| 3.1 | Federation Models | added |
| 3.10 | Privacy Requirements | added |
| 3.10.1 | Transmitting Subscriber Information | added |
| 3.10.2 | Sharing Information Between CSPs | added |
| 3.11 | Security Controls | added |
| 3.11.1 | Protection From Assertion Injection Attacks | added |
| 3.11.2 | Protecting Subscriber Information | added |
| 3.11.3 | Storing Subscriber Information | added |
| 3.12 | Identity Attributes | added |
| 3.12.1 | Attribute Bundles | added |
| 3.12.2 | Derived Attribute Values | added |
| 3.12.3 | Identity APIs | added |
| 3.12.3.1 | External Identity APIs | added |
| 3.13 | Assertion Protection | added |
| 3.13.1 | Assertion Identifier | added |
| 3.13.2 | Signed Assertion | added |
| 3.13.3 | Encrypted Assertion | added |
| 3.13.4 | Audience Restriction | added |
| 3.14 | Bearer Assertions | added |
| 3.15 | Holder-of-Key Assertions | added |
| 3.16 | Bound Authenticators | added |
| 3.16.1 | RP-Provided Bound Authenticator Issuance | added |
| 3.16.2 | Subscriber-Provided Bound Authenticator Binding Ceremony | added |
| 3.17 | RP Processing of Holder-of-Key Assertions and Bound Authenticators | added |
| 3.2 | Roles | added |
| 3.2.1 | Credential Service Provider (CSP) | added |
| 3.2.2 | Identity Provider (IdP) | added |
| 3.2.3 | Relying Party (RP) | added |
| 3.3 | Functions | added |
| 3.3.1 | Trust Agreement Management | added |
| 3.3.2 | Authorized Party | added |
| 3.3.3 | Proxied Federation | added |
| 3.3.4 | Fulfilling Roles and Functions of a Federation Model | added |
| 3.4 | Federated Identifiers | added |
| 3.4.1 | Pairwise Pseudonymous Identifiers (PPI) | added |
| 3.4.1.1 | General Requirements | added |
| 3.4.1.2 | Pairwise Pseudonymous Identifier Generation | added |
| 3.4.1.3 | Shared Pairwise Pseudonymous Identifiers | added |
| 3.5 | Trust Agreements | added |
| 3.5.1 | Bilateral Trust Agreements | added |
| 3.5.2 | Multilateral Trust Agreements | added |
| 3.5.3 | Redress Requirements | added |
| 3.6 | Identifiers and Cryptographic Key Management for CSPs, IdPs, and RPs | added |
| 3.6.1 | Cryptographic Key Rotation | added |
| 3.6.2 | Cryptographic Key Storage | added |
| 3.6.3 | Software Attestations | added |
| 3.7 | Authentication and Attribute Disclosure | added |
| 3.8 | RP Subscriber Accounts | added |
| 3.8.1 | Account Linking | added |
| 3.8.2 | Account Resolution | added |
| 3.8.3 | Alternative Authentication Processes | added |
| 3.9 | Authenticated Sessions at the RP | added |
| 4 | Validity time window: A period of time outside of which the assertion SHALL NOT | Control text, Title |
| 5 | Expiration: A timestamp indicating when the assertion expires and SHALL no | removed |
| 6 | Identifier: A value uniquely identifying this assertion, used to prevent attackers | removed |
| 7 | Signature: Digital signature or message authentication code (MAC), including key | removed |
| 7.1 | Back-Channel Presentation | removed |
| 7.2 | Front-Channel Presentation | removed |
| 7.3 | Protecting Information | removed |
| 8 | Security | removed |
| 8.1 | Federation Threats | removed |
| 8.2 | Federation Threat Mitigation Strategies | removed |
| 9 | Privacy Considerations | removed |
| 9.1 | Minimizing Tracking and Profiling | removed |
| 9.2 | Notice and Consent | removed |
| 9.3 | Data Minimization | removed |
| 9.4 | Agency-Specific Privacy Compliance | removed |
| 9.5 | Blinding in Proxied Federation | removed |
Read every requirement in this version · All versions of NIST PIV and digital identity