BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.2 Federation Assurance Level 1 (FAL1)

NIST PIV and digital identity SP 800-63C-4 against SP 800-63C
All changes in this version
added 2 Federation Assurance Level (FAL) part of 2

Title changed

Before · SP 800-63C

After · SP 800-63C-4

Federation Assurance Level 1 (FAL1)

Control changed

Before · SP 800-63C

After · SP 800-63C-4

FAL1 provides a basic level of protection for federation transactions and allows for a wide range of use cases and deployment decisions.

At FAL1, the federation protocol SHOULD apply assertion injection protection, as discussed in Sec. 3.11.1 . The federation transaction SHOULD be initiated by the RP.

At FAL1, the IdP SHALL sign the assertion using approved cryptography. The RP SHALL validate the signature using the verification key associated with the expected IdP. The signature protects the integrity of the assertion contents and allows for the IdP to be verified as the source of the assertion.

At FAL1, the assertion SHALL be audience-restricted to a specific RP or set of RPs, and the RP SHALL validate that it is one of the targeted RPs for the given assertion. Each RP in the audience SHALL enforce replay protection mechanisms in the assertion to ensure that the same assertion is not accepted by a given RP multiple times. An assertion with multiple audiences could be accepted by multiple RPs but only once by each RP.

At FAL1, federated identifiers SHOULD NOT contain plaintext personal information, such as usernames, email addresses, employee numbers, etc.

At FAL1, the trust agreement MAY be established by the subscriber during the federation transaction, as discussed in Sec. 4.3.2 . Alternatively, the trust agreement MAY be established prior to the federation transaction (i.e., a “pre-established” trust agreement), as discussed in Sec. 4.3.1 .