BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4 Validity time window: A period of time outside of which the assertion SHALL NOT (was: The agency SHALL publish or identify coverage by a Privacy Impact Assessment)

NIST PIV and digital identity SP 800-63C-4 against SP 800-63C
All changes in this version
modified 4 Validity time window: A period of time outside of which the assertion SHALL NOT

Title changed

Before · SP 800-63C

The agency SHALL publish or identify coverage by a Privacy Impact Assessment

After · SP 800-63C-4

TheValidity agencytime SHALLwindow: publishA orperiod identifyof coveragetime byoutside aof Privacywhich Impactthe Assessmentassertion SHALL NOT

Control changed

Before · SP 800-63C

(PIA) as applicable.

After · SP 800-63C-4

be accepted as valid by the RP for the purposes of authenticating the subscriber and starting an authenticated session at the RP. This is usually communicated by means of an expiration timestamp for the assertion in addition to the issuance timestamp.

5. Assertion identifier: A value that uniquely identifies this assertion and is used to prevent attackers from replaying prior assertions.

6. Authentication time: A timestamp that indicates when the IdP last verified the presence of the subscriber at the IdP through a primary authentication event.

7. Signature: Digital signature or MAC, including verification key identifier, that covers the entire assertion.

If the RP subscriber account does not use an ephemeral provisioning process, the subscriber SHALL be identified in the assertion using a federated identifier (PIAsee Sec. 3.4 ) asor applicablethrough an account resolution process (see Sec. 3.8.2 ).

If the subscriber is identified using a federated identifier, the assertion SHALL include:

• Subject Identifier: An identifier for the party to which the assertion applies (i.e., the subscriber)

The following aspects of the federation transaction SHALL be provided through information contained in the assertion contents or the applicable trust agreement: