This document provides an overview of the Entity Authentication Assurance Framework (EEAF), which specifies four levels of assurance (LoAs) for entity authentication over open networks. The EEAF is based on NIST SP 800-63 and includes a five step process for implementation. It covers the phases, actors, threats and controls related to credential management, enrollment and authentication. Trust framework operators and credential service providers are responsible for establishing criteria and assessing compliance for the specified LoAs.

1. ITU-T X.1254 | ISO/IEC 29115
An Overview of the
Entity Authentication
Assurance Framework

2. Current Status
• Goal is 2012 publication of
X.1254|ISO/IEC 29115 by both SDO’s
• Currently
– Undergoing balloting at ISO for Draft
International Standard (DIS)
– Expected to be “Determined” at ITU-T in
February
• ITU-T Editor: Dick Brackney, Microsoft
• ISO Editor: Erika McCallister, NIST

3. Background
• Challenge: Protect system security and
individual privacy during e-authenication over
open networks.
• Approach: Provide an appropriate level of
assurance for those transactions that require e-
authentication.
• Based on NIST SP 800-63, e-Authentication
Guidelines, June 2006
• Implementation: Five Step Process

4. Five Step Process
• Conduct Risk Assessment
• Map identified risks to appropriate
assurance level
• Select appropriate controls
• Validate that the implemented controls
has met the required assurance level.
• Periodically re-assess to determine
technology refresh requirements

5. Contents
1. Scope
2. Normative References
3. Definitions
4. Abbreviations
5. Conventions
6. Levels of Assurance
7. Actors
8. Entity Authentication Assurance Framework
Phases
9. Management and Organizational Considerations
10. Threats and Controls
11. Service Assurance Criteria

6. Clause 1 - Scope
• This Recommendation | International Standard provides
a framework for managing entity authentication
assurance in a given context. In particular, it:
– specifies four levels of entity authentication assurance;
– specifies criteria and guidelines for achieving each of the four
levels of entity authentication assurance;
– provides guidance for mapping other authentication assurance
schemes to the four LoAs;
– provides guidance for exchanging the results of authentication
that are based on the four LoAs; and
– provides guidance concerning controls that should be used to
mitigate authentication threats.

7. Clause 6 - LoAs
• Describes 4 Levels of Assurance (LoAs)
Level Description
1 – Low Little or no confidence in the asserted identity
2 – Medium Some confidence in the asserted identity
3 – High High confidence in the asserted identity
4 – Very high Very high confidence in the asserted identity

8. Clause 7 - Actors
• Entity
• Credential Service Provider (CSP)
• Registration Authority (RA)
• Relying Party (RP)
• Verifier
• Trusted Third Party (TTP)

9. Clause 8 - EEAF
Technical
Management
&
Organizational
Credential
management
phase
Enrolment
phase
Entity
authentication
phase
• Authentication
• Record-keeping
• Credential creation
• Credential pre-processing
• Credential initialization
• Credential binding
• Credential issuance
• Credential activation
• Application and initiation
• Identity proofing
• Identity verification
• Service establishment
• Legal and contractual
compliance
• Financial provisions
• Information security
management and audit
• External service
components
• Operational infrastructure
• Measuring operational
capabilities
• Record-keeping
recording
• Registration
• Credential storage
• Credential suspension,
revocation, and/or
destruction
• Credential renewal
and/or replacement
• Record-keeping
Normative Informative
Clause 10 Threats
and Controls are
organized around
these processes

10. Clause 9 – Management and
Organizational Considerations
• Service Establishment
• Legal and Contractual Compliance
• Financial Provisions
• Information Security Management and
Audit
• External Service Components
• Operational Infrastructure
• Measuring Operational Capabilities

11. Clause 10 – Threats and Controls
• Organized by phase and process of the
EAAF
• For humans and non-person entities
(NPEs)

12. Clause 11 – Service Assurance
Criteria
• Trust framework operators that seek to comply
with this Framework shall establish specific
criteria fulfilling the requirements of each LoA
that they intend to support and shall assess the
CSPs that claim compliance with the Framework
against those criteria. Likewise, CSPs shall
determine the LoA at which their services
comply with this Framework by evaluating their
overall business processes and technical
mechanisms against specific criteria.

13. Questions?
• Contact Information
– ITU-T Editor: Dick Brackney
• dibrack@microsoft.com
– ISO Editor: Erika McCallister
• erika.mccallister@nist.gov