BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2 Federation Assurance Level (FAL) (was: The agency SHALL publish or identify coverage by a System of Records Notice)

NIST PIV and digital identity SP 800-63C-4 against SP 800-63C
All changes in this version
modified 2 Federation Assurance Level (FAL)

Title changed

Before · SP 800-63C

The agency SHALL publish or identify coverage by a System of Records Notice

After · SP 800-63C-4

The agency SHALL publish or identify coverage by a SystemFederation ofAssurance RecordsLevel Notice(FAL)

Control changed

Before · SP 800-63C

(SORN) as applicable.

After · SP 800-63C-4

This section is normative.

This section defines federation assurance levels (SORNFALs) and the requirements for securing federation transactions at each FAL. In order to fulfill the requirements for a given FAL, the federation transaction SHALL meet or exceed all requirements listed for that FAL.

Each FAL is characterized by a set of requirements that increase the security as applicablethe FAL increases. These requirements are listed here and expanded in other sections of this document:

Audience Restriction The assertion presented in the federation protocol targets a specific RP, and the RP can confirm that it is the intended audience of the assertion.

Replay Protection The assertion presented in the federation protocol is protected from being presented more than once.

Assertion Injection Protection The RP is strongly protected from an attacker completing a federated transaction and initiating an authenticated session with a forged, captured, or modified assertion (see Sec. 3.11.1 ).

Trust Agreement Establishment The rights and expectations of the parties in the federation transaction are established to support trust between those parties for the purposes of creating an authenticated session for the subscriber at the RP (see Sec. 3.5 ).

Identifier and Key Establishment The IdP and RP have exchanged identifiers and cryptographic key material to allow for the verification of assertions and other artifacts during future federation transactions (see Sec. 3.6 ).

Presentation The assertion can be presented to the RP either on its own (as a bearer assertion) or in concert with an authenticator presented by the subscriber.

Table 1 provides a non-normative summary of requirements for each FAL. Each successive level subsumes and fulfills all of the requirements of lower levels (e.g., a federation process at FAL3 can be accepted at FAL2 or FAL1 since FAL3 satisfies all of the requirements of these lower levels). Combinations not found in Table 1 are possible, and agencies can choose to implement stronger protections in one or more areas of requirements at a given FAL.

Table 1. Federation assurance levels

Requirement FAL1 FAL2 FAL3 Audience Restriction Multiple RPs allowed per assertion; single RP per assertion recommended Single RP per assertion Single RP per assertion

Replay Protection Required per RP Required Required Assertion Injection Protection Recommended for all transactions Required; transaction begins at the RP Required; transaction begins at the RP Trust Agreement Establishment Subscriber-driven or pre-established Pre-established Pre-established

Identifier and Key Establishment Dynamic or Manual Dynamic or Manual Manual

Presentation Bearer Assertion Bearer Assertion Holder-of-key Assertion or bound authenticator

While many different federation implementation options are possible, the FAL is intended to provide clear guidance that represents increasingly secure deployment options. See [SP800-63] for details on how to choose the most appropriate FAL.