NIST SP 800-63B-4: Authentication and Authenticator Management
The authentication volume of the U.S. National Institute of Standards and Technology’s Digital Identity Guidelines, revision 4. It sets requirements for how federal agencies and the services they work with authenticate people: authentication assurance levels (AAL1–AAL3), the authenticator types allowed at each, notifying account holders about account events, account recovery, and an informative chapter on customer experience. Appendix B covers syncable authenticators (synced passkeys).
License: Public domain — U.S. federal government work (17 U.S.C. § 105).
Key points
- At AAL2, the level for ordinary multi-factor sign-in, a service must offer at least one phishing-resistant authentication option and should encourage phishing-resistant authentication wherever practical.
- Syncable authenticators copy their keys through a sync fabric, such as a cloud provider, to a person’s other devices. They’re permitted at AAL2, subject to requirements such as encrypting the stored keys and protecting access to them with multi-factor authentication. They aren’t permitted at AAL3, which requires keys that can’t be exported from their hardware.
- Services may use WebAuthn’s Backup State flag to see whether a passkey has been synced, but public-facing applications shouldn’t make accepting a passkey depend on it, because of the user-experience cost.
- An authenticator that syncs keys should give people a view of which services they have a synced key for, whether it’s been synced, and where, without ever exposing the key itself.
- Services should encourage people to keep at least two separate ways to authenticate, to reduce the need for account recovery, and must allow more than one authenticator per account.
- When an authenticator is added to an account, the account holder must be notified through a mechanism independent of the transaction that added it. Account recovery and authenticator removal also call for notification.
- The customer-experience chapter frames authentication as something that stands between a person and their actual task. It should make the right thing easy, the wrong thing hard, and recovery easy, because poor usability drives workarounds that weaken security.