The document discusses strong authentication and the US Federal Digital Services. It describes Authenticator Assurance Levels (AAL), with AAL3 providing the highest level of remote network authentication by requiring proof of possession of a hardware cryptographic key. AAL3 authenticators must be validated at FIPS 140 Level 2 or higher, with single-factor ones at Level 1. The document raises implementing AAL3 and a new interoperability target as issues and provides contact information for further discussion.

1. Strong Authentication and US Federal
Digital Services
Paul Grassi, Senior Standards and Technology Advisor, NIST

2. current state

3. based on

4. It gets worse

5. everyone else

6. where does FIDO fit in?

7. Privacy Enhancing & Voluntary
Secure & Resilient
Interoperable
Cost-Effective & Easy to Use

10. Authenticator Assurance
Levels
AAL1
AAL2
AAL3

11. Authenticator Assurance Level 3
(formerly known as LOA4)
AAL 3 is intended to provide the highest practical remote network
authentication assurance. Authentication at AAL 3 is based on proof of
possession of a key in a physical authenticator through a
cryptographic protocol. AAL 3 is similar to AAL 2 except that
only hardware cryptographic authenticators (in conjunction
with a memorized secret for single-factor cryptographic devices) and
multi-factor OTP devices are allowed. The authenticator SHALL be a
hardware cryptographic module validated at Federal
Information Processing Standard (FIPS) 140 Level
2 or higher overall (Level 1 for single-factor
authenticators) with at least FIPS 140 Level 3
physical security.

12. always supported

13. newly supported

14. USG Use Cases
?
M-05-24

15. So we need a
new
interoperability
target?

16. what else?

17. strength of authentication (SOFA)
https://pages.nist.gov/SOFA

19. dig-comments@nist.gov
pag3@nist.gov
https://www.nist.gov/itl/tig
@TrustedIDsNIST
https://service.govdelivery.com/accounts/USNIST/subscriber/new?topic_id=USNIST_213
http://trustedidentities.blogs.govdelivery.com
https://github.com/usnistgov/800-63-3