|
+3 Authenticator and Verifier Requirements ---+3.1 Requirements by Authenticator Type ------+3.1.1 Passwords ---------+3.1.1.1 Password Authenticators ---------+3.1.1.2 Password Verifiers ------+3.1.2 Look-Up Secrets ---------+3.1.2.1 Look-Up Secret Authenticators ---------+3.1.2.2 Look-Up Secret Verifiers ------+3.1.3 Out-of-Band Devices ---------+3.1.3.1 Out-of-Band Authenticators ---------+3.1.3.2 Out-of-Band Verifiers ---------+3.1.3.3 Authentication Using the Public Switched Telephone Network ---------+3.1.3.4 Multi-Factor Out-of-Band Authenticators ------+3.1.4 Single-Factor OTP ---------+3.1.4.1 Single-Factor OTP Authenticators ---------+3.1.4.2 Single-Factor OTP Verifiers ------+3.1.5 Multi-Factor OTPs ---------+3.1.5.1 Multi-Factor OTP Authenticators ---------+3.1.5.2 Multi-Factor OTP Verifiers ------+3.1.6 Single-Factor Cryptographic Authentication ---------+3.1.6.1 Single-Factor Cryptographic Authenticators ---------+3.1.6.2 Single-Factor Cryptographic Verifiers ------+3.1.7 Multi-Factor Cryptographic Authentication ---------+3.1.7.1 Multi-Factor Cryptographic Authenticators ---------+3.1.7.2 Multi-Factor Cryptographic Verifiers ---------+3.1.7.3 Usage With Subscriber-Controlled Wallets ---------+3.1.7.4 Syncable Authenticators ---+3.2 General Authenticator Requirements ------+3.2.1 Physical Authenticators ------+3.2.2 Rate Limiting (Throttling) ------+3.2.3 Use of Biometrics ---------+3.2.3.1 Biometric Accuracy ---------+3.2.3.2 Presentation Attack Detection ---------+3.2.3.3 Injection Attack Detection ---------+3.2.3.4 Use of Biometric Samples ------+3.2.4 Attestation ------+3.2.5 Phishing Resistance ---------+3.2.5.1 Channel Binding ---------+3.2.5.2 Verifier Name Binding ------+3.2.6 Verifier-CSP or IdP Communications ------+3.2.7 Replay Resistance ------+3.2.8 Authentication Intent ------+3.2.9 Restricted Authenticators ------+3.2.10 Activation Secrets ------+3.2.11 Connected Authenticators ---------+3.2.11.1 Wired Connections ---------+3.2.11.2 Wireless Connections ---------+3.2.11.3 Hybrid Connections ------+3.2.12 Random Values ------+3.2.13 Exportability |
3 Authenticator and Verifier RequirementsThis section is normative. This section provides detailed requirements that are specific to each type of authenticator. With the exception of the reauthentication requirements specified in Sec. 2 and the requirement for phishing resistance at AAL3 described in Sec. 3.2.5, the technical requirements for each authenticator type are the same, regardless of the AAL at which the authenticator is used. In federated applications described in [SP800-63C], the authentication functions of an IdP correspond closely with that of a CSP or verifier. In the discussion below, the requirements associated with a CSP also apply to an IdP. In many circumstances, subscribers need to share devices that are used in authentication processes, such as a family phone that receives OTPs. In public-facing applications, CSPs SHOULD NOT prevent a device from being registered as an authenticator by multiple subscribers. However, they MAY establish restrictions to prevent large-scale fraud or misuse (e.g., limiting the total number of subscriber accounts a single device can be registered with). Authentication, authenticator binding (discussed in Sec. 4.1), and session management (discussed in Sec. 5) are based on proof of possession of one or more types of secrets, as shown in Table 2. Table 2. Summary of secrets (non-normative)
1. Prezentare generală
1.1 Referințe1.2 Cerințe identificate1.3 Reglementări asociate2. Cerințe identificate
3. Reglementări asociate
|