3.15 Holder-of-Key Assertions

Before · SP 800-63C

After · SP 800-63C-4

Holder-of-Key Assertions

Before · SP 800-63C

After · SP 800-63C-4

A holder-of-key assertion ( Fig. 3 ) SHALL include a unique identifier for an authenticator that can be verified independently by the RP, such as the public key of a certificate controlled by the subscriber. The RP SHALL verify that the subscriber possesses the authenticator identified by the assertion. Holder-of-key assertions are most often used when the authenticator technology is tied to a public-key infrastructure (PKI) trusted by both the IdP and RP.

The authenticator identified in a holder-of-key assertion MAY be distinct from the primary authenticator that the subscriber uses to authenticate to the IdP. The authenticator identified in a holder-of-key assertion SHALL be phishing-resistant, as defined by Sec. 3.2.5 of [SP800-63B] . When the RP encounters an authenticator in a holder-of-key assertion for the first time, the RP SHALL ensure that the authenticator can be uniquely resolved to the RP subscriber account, as discussed in Sec. 3.8.2 .

A holder-of-key assertion SHALL NOT include an unencrypted private key or symmetric key to be used as an authenticator. Assertion
- FAL3
- Holder of Key
- Authenticator ID Primary Authenticator

Proof of Key Possession Subscriber IdP / Wallet

RP

Fig. 3. Holder-of-key assertions

Assertions from subscriber-controlled wallets that run on a subscriber’s device can be considered holder-of-key assertions.

Section 9.6 provides a more complete example of the use of a mutual TLS connection to provide the proof of possession of a certificate on a smart card that is listed by the assertion.

Since the authenticators used in holder-of-key assertions could be presented to multiple parties, and these authenticators often contain identity attributes, there are additional privacy considerations to address, as discussed in Sec. 7 .