8.2 Federation Threat Mitigation Strategies
All changes in this version
Title changed
Before · SP 800-63C
Federation Threat Mitigation Strategies
After · SP 800-63C-4
Federation Threat Mitigation Strategies
Control changed
Before · SP 800-63C
Mechanisms that assist in mitigating the above threats are identified in Table 8-2.
Table 8-2 Mitigating Federation Threats
Federation Threat/Attack Description Example
Assertion Manufacture or Modification Cryptographically sign the assertion at IdP and verify at RP 4.1 , 6
Send assertion over an authenticated protected channel authenticating the IdP 7.1 , 7.2
Include a non-guessable random identifier in the assertion 6.2.1
Assertion Disclosure Send assertion over an authenticated protected channel authenticating the RP 7.1 , 7.2
Encrypt assertion for a specific RP (may be accomplished by use of a 6.2.3 Federation Threat/Attack Description Example
mutually authenticated protected channel)
Assertion Repudiation by the IdP Cryptographically sign the assertion at the IdP with a key that supports non- repudiation; verify signature at RP 6.2.2
Assertion Repudiation by the Subscriber Issue holder-of-key assertions; proof of possession of presented key verifies subscriber’s participation 6.1.2
Assertion Redirect Include identity of the RP (“audience”) for which the assertion is issued in its signed content; RP verifies that they are intended recipient 6 , 7.1 , 7.2
Assertion Reuse Include an issuance timestamp with short validity period in the signed content of the assertion; RP verifies validity 6 , 7.1 , 7.2
After · SP 800-63C-4
Mechanisms that assist in mitigating the above threats are identified in Table 8-2.
Table 8-2 Mitigating Federation Threats
Federation Threat/Attack Description Example
Assertion Manufacture or Modification Cryptographically sign the assertion at IdP and verify at RP 4.1 , 6
Send assertion over an authenticated protected channel authenticating the IdP 7.1 , 7.2
Include a non-guessable random identifier in the assertion 6.2.1
Assertion Disclosure Send assertion over an authenticated protected channel authenticating the RP 7.1 , 7.2
Encrypt assertion for a specific RP (may be accomplished by use of a 6.2.3 Federation Threat/Attack Description Example
mutually authenticated protected channel)
Assertion Repudiation by the IdP Cryptographically sign the assertion at the IdP with a key that supports non- repudiation; verify signature at RP 6.2.2
Assertion Repudiation by the Subscriber Issue holder-of-key assertions; proof of possession of presented key verifies subscriber’s participation 6.1.2
Assertion Redirect Include identity of the RP (“audience”) for which the assertion is issued in its signed content; RP verifies that they are intended recipient 6 , 7.1 , 7.2
Assertion Reuse Include an issuance timestamp with short validity period in the signed content of the assertion; RP verifies validity 6 , 7.1 , 7.2