To be considered verifier compromise resistant, public keys stored by the verifier SHALL be associated with the use of approved cryptographic algorithms and SHALL provide at least the minimum security strength specified in the latest revision of SP 800-131A (112 bits as of the date of this publication). Something you have may be lost, damaged, stolen from the owner, or cloned by an attacker. Any memorized secret used by the authenticator for activation SHALL be a randomly-chosen numeric secret at least 6 decimal digits in length or other memorized secret meeting the requirements of Section 5.1.1.2 and SHALL be rate limited as specified in Section 5.2.2. Verification of the output from a multi-factor cryptographic software authenticator proves use of the activation factor. Accepting only authentication requests that come from a white list of IP addresses from which the subscriber has been successfully authenticated before. Accessibility differs from usability and is out of scope for this document. Consider the legibility of user-facing and user-entered text, including font style, size, color, and contrast with surrounding background. Presentation of a fingerprint would normally establish intent, while observation of the claimants face using a camera normally would not by itself. Physical security mechanisms may be employed to protect a stolen authenticator from duplication. These might, for example, include use of IP address, geolocation, timing of request patterns, or browser metadata. Use hardware authenticators that require physical action by the subscriber. In addition to activation information, multi-factor OTP authenticators contain two persistent values. Verifiers SHOULD consider risk indicators such as device swap, SIM change, number porting, or other abnormal behavior before using the PSTN to deliver an out-of-band authentication secret. Users often employ one or more authenticator, each for a different RP. Because the subscriber may be exposed to additional risk when an organization accepts a RESTRICTED authenticator and that the subscriber may have a limited understanding of and ability to control that risk, the CSP SHALL: Offer subscribers at least one alternate authenticator that is not RESTRICTED and can be used to authenticate at the required AAL.
NIST 800-63b Password Guidelines and Best Practices (2023) - Kyloot A single-factor cryptographic device is, A multi-factor software cryptographic authenticator is a cryptographic key stored on disk or some other "soft" media that requires activation through a second factor of authentication. Special Publication 800-63B is 79 pages long, so to save you some time, we have provided a summary of the NIST password recommendations. Look-up secrets SHALL have at least 20 bits of entropy. 5. To maintain the integrity of the authentication factors, it is essential that it not be possible to leverage an authentication involving one factor to obtain an authenticator of a different factor. At least one cryptographic authenticator used at AAL3 SHALL be verifier impersonation resistant as described in Section 5.2.5 and SHALL be replay resistant as described in Section 5.2.8. Authentication intent MAY be established in a number of ways. Binding of multi-factor authenticators SHALL require multi-factor authentication or equivalent (e.g., association with the session in which identity proofing has been just completed) be used in order to bind the authenticator. Additionally, an attacker may determine the secret through offline attacks on a password database maintained by the verifier. Note: At AAL2, a memorized secret or biometric, and not a physical authenticator, is required because the session secret is something you have, and an additional authentication factor is required to continue the session. Authenticated sessions SHALL NOT fall back to an insecure transport, such as from https to http, following authentication. A biometric activation factor SHALL meet the requirements of Section 5.2.3, including limits on the number of consecutive authentication failures. Binding of multiple authenticators is preferred in order to recover from the loss or theft of the subscribers primary authenticator. Ideally, users can select the modality they are most comfortable with for their second authentication factor. Many services reject passwords with spaces and various special characters. Users need adequate time to enter the authenticator output (including looking back and forth between the single-factor OTP device and the entry screen). Biometric revocation, referred to as biometric template protection in. These guidelines also recommend that session secrets be made inaccessible to mobile code in order to provide extra protection against exfiltration of session secrets. Password Creation in the Presence of Blacklists, 2017. Available at: http://research.microsoft.com/apps/pubs/default.aspx?id=154077. Successful authentication requires that the claimant prove possession and control of the authenticator through a secure authentication protocol. These include dictionary words and passwords from previous breaches, such as the Password1! example above. CSPs SHALL revoke the binding of authenticators promptly when an online identity ceases to exist (e.g., subscribers death, discovery of a fraudulent subscriber), when requested by the subscriber, or when the CSP determines that the subscriber no longer meets its eligibility requirements. Verifiers at AAL3 SHALL be verifier compromise resistant as described in Section 5.2.7 with respect to at least one authentication factor. Biometric samples collected in the authentication process MAY be used to train comparison algorithms or with user consent for other research purposes. However, authenticators SHOULD indicate the receipt of an authentication secret on a locked device. Leveraging federation for authentication can alleviate many of the usability issues, though such an approach has its own tradeoffs, as discussed in SP 800-63C. Physical security mechanisms can provide tamper evidence, detection, and response. Testing of the biometric system to be deployed SHOULD demonstrate at least 90% resistance to presentation attacks for each relevant attack type (i.e., species), where resistance is defined as the number of thwarted presentation attacks divided by the number of trial presentation attacks. The updated guidelines emphasize the importance of password length. These privacy considerations supplement the guidance in Section 4. Further requirements on the termination of PIV authenticators are found in FIPS 201. Selecting from multiple cryptographic keys on smaller mobile devices (such as smartphones) may be particularly problematic if the names of the cryptographic keys are shortened due to reduced screen size. With this assumption in mind, the threats to the authenticator(s) used for digital authentication are listed in Table 8-1, along with some examples. Verifier compromise resistance can be achieved in different ways, for example: Use a cryptographic authenticator that requires the verifier store a public key corresponding to a private key held by the authenticator. While presentation attack detection (PAD) technologies (e.g., liveness detection) can mitigate the risk of these types of attacks, additional trust in the sensor or biometric processing is required to ensure that PAD is operating in accordance with the needs of the CSP and the subscriber. Communication between the claimant and verifier (the primary channel in the case of an out-of-band authenticator) SHALL be via an authenticated protected channel to provide confidentiality of the authenticator output and resistance to MitM attacks. Therefore, whenever possible based on AAL requirements CSPs should support alternative authenticator types and allow users to choose based on their needs. (See. Effective design and implementation of authentication makes it easy to do the right thing, hard to do the wrong thing, and easy to recover when the wrong thing happens. Commonly, passwords are salted with a random value and hashed, preferably using a computationally expensive algorithm. The requirements for a multi-factor cryptographic software verifier are identical to those for a single-factor cryptographic device verifier, described in Section 5.1.7.2. Performing a usability evaluation on the selected authenticator is a critical component of implementation. User experience during entry of the memorized secret. These attacks are outside the scope of this Appendix. Verifiers MAY also warn a subscriber in an existing session of the attempted duplicate use of an OTP. The key used SHALL be stored in suitably secure storage available to the authenticator application (e.g., keychain storage, TPM, TEE, secure element). [Composition] Komanduri, Saranga, Richard Shay, Patrick Gage Kelley, Michelle L Mazurek, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Serge Egelman. SP 800-63C - federation and . The use of subscriber consent is a form of sharing the risk, and therefore appropriate for use only when a subscriber could reasonably be expected to have the capacity to assess and accept the shared risk. Their purpose is to make each password guessing trial by an attacker who has obtained a password hash file expensive and therefore the cost of a guessing attack high or prohibitive. 10 Biometric samples and any biometric data derived from the biometric sample such as a probe produced through signal processing SHALL be zeroized immediately after any training or research data has been derived. It SHALL then wait for the secret to be returned on the secondary channel from the claimants out-of-band authenticator. The CSP MAY choose to verify an address of record (i.e., email, telephone, postal) and suspend authenticator(s) reported to have been compromised. At IAL2 and above, identifying information is associated with the digital identity and the subscriber has undergone an identity proofing process as described in SP 800-63A. Since user choice of passwords will also be governed by a minimum length requirement, this dictionary need only include entries meeting that requirement. Use authenticators that provide verifier impersonation resistance. Reestablishment of authentication factors at IAL3 SHALL be done in person, or through a supervised remote process as described in SP 800-63A Section 5.3.3.2, and SHALL verify the biometric collected during the original proofing process. A digital identity is always unique in the context of a digital service, but does not necessarily need to be traceable back to a specific real-life subject. The challenge nonce SHALL be at least 64 bits in length, and SHALL either be unique over the authenticators lifetime or statistically unique (i.e., generated using an approved random bit generator [SP 800-90Ar1]). CSPs SHALL provide subscriber instructions on how to appropriately protect the authenticator against theft or loss. Differences in environmental lighting conditions can affect facial recognition accuracy. Give cryptographic keys appropriately descriptive names that are meaningful to users since users have to recognize and recall which cryptographic key to use for which authentication task. Follow good user interface and information design for small displays. Subscribers choosing memorized secrets containing Unicode characters SHOULD be advised that some characters may be represented differently by some endpoints, which can affect their ability to authenticate successfully. Memorized secrets are obtained by watching keyboard entry. Revocation of an authenticator sometimes referred to as termination, especially in the context of PIV authenticators refers to removal of the binding between an authenticator and a credential the CSP maintains. The session MAY be terminated for any number of reasons, including but not limited to an inactivity timeout, an explicit logout event, or other means. Ensure the time allowed for text entry is adequate (i.e., the entry screen does not time out prematurely). The weak point in many authentication mechanisms is the process followed when a subscriber loses control of one or more authenticators and needs to replace them. For example, if the subscriber has successfully completed proofing at IAL2, then AAL2 or AAL3 authenticators are appropriate to bind to the IAL2 identity. Changing the pre-registered telephone number is considered to be the binding of a new authenticator and SHALL only occur as described in Section 6.1.2. The multi-factor OTP device is, A single-factor software cryptographic authenticator is a cryptographic key stored on disk or some other "soft" media. Software PKI authenticator (private key) copied. aaaaaa, 1234abcd). NIST recommends removing this requirement, which should increase usability and make password security more user-friendly. This publication and its companion volumes, [SP800-63], [SP800-63A], and [SP800-63C], provide technical guidelines to organizations for the implementation of digital identity services. Depending on the modality, presentation of a biometric may or may not establish authentication intent. Authenticator and Verifier Requirements, Appendix A Strength of Memorized Secrets. Avoid use of authenticators that present a risk of social engineering of third parties such as customer service agents. Despite countless advancements in cybersecurity, the username and username, although outdated, will still used in the most common form of authentication nowadays. Now, before the happy dance starts and password policies are updated to never require a change or enforce complexity, be aware that 800-63B contains . These considerations should not be read as a requirement to develop a Privacy Act SORN or PIA for authentication alone. [OWASP-session] Open Web Application Security Project, Session Management Cheat Sheet, available at: https://www.owasp.org/index.php/Session_Management_Cheat_Sheet. Authentication is accomplished by proving possession of the device via the authentication protocol. Do not impose other composition rules (e.g. Testing of presentation attack resistance SHALL be in accordance with Clause 12 of [ISO/IEC 30107-3]. Spaces themselves, however, add little to the complexity of passwords and may introduce usability issues (e.g., the undetected use of two spaces rather than one), so it may be beneficial to remove repeated spaces in typed passwords prior to verification. Verification of the authenticator output from a multi-factor cryptographic device proves use of the activation factor. The SAOP can assist the agency in determining what additional requirements apply. Malicious code on the endpoint causes authentication to other than the intended verifier. It SHALL then transmit a random secret to the out-of-band authenticator. In many cases, the options remaining available to authenticate the subscriber are limited, and economic concerns (e.g., cost of maintaining call centers) motivate the use of inexpensive, and often less secure, backup authentication methods. This MAY be the same notice as is required as part of the proofing process. Depending on the type of out-of-band authenticator, one of the following SHALL take place: Transfer of secret to primary channel: The verifier MAY signal the device containing the subscribers authenticator to indicate readiness to authenticate. To enhance legibility, consider the use of: High contrast. [EO 13681] Executive Order 13681, Improving the Security of Consumer Financial Transactions, October 17, 2014, available at: https://www.federalregister.gov/d/2014-25439. Consult your SAOP if there are questions about whether the proposed processing falls outside the scope of the permitted processing or the appropriate privacy risk mitigation measures. Device affordances (i.e., properties of a device that allow a user to perform an action), feedback, and clear instructions are critical to a users success with the biometric device. Support copy and paste functionality in fields for entering memorized secrets, including passphrases. Limited availability of a direct computer interface like a USB port could pose usability difficulties. SHALL be erased or invalidated by the session subject when the subscriber logs out. Malicious code proxies authentication or exports authenticator keys from the endpoint. Authentication is the function that enables this goal. Digital Identity Guidelines: Authentication and Lifecycle Management Date Published: June 2017 (includes updates as of 03-02-2020) Supersedes: SP 800-63B (12/01/2017) Author (s) Alternate authentication options also help address availability issues that may occur with a particular authenticator. The CSP SHALL provide a mechanism to revoke or suspend the authenticator immediately upon notification from subscriber that loss or theft of the authenticator is suspected. However, the availability of such solutions is limited, and standards for testing these methods are under development. Here's a summary of the NIST Password Guidelines for 2022: 1. For example, with respect to centralized maintenance of biometrics, it is likely that the Privacy Act requirements will be triggered and require coverage by either a new or existing Privacy Act system of records due to the collection and maintenance of PII and any other attributes necessary for authentication. It SHALL then send that response to the verifier. Use an authenticator with a high entropy authenticator secret. An attacker is able to cause an authenticator under their control to be bound to a subscribers account.
PDF NIST Update: Multi-Factor Authentication and SP 800-63 Digital Identity The nature of a session depends on the application, including: Session secrets SHALL be non-persistent. Compromised authenticators include those that have been lost, stolen, or subject to unauthorized duplication. This technical guideline applies to digital authentication of subjects to systems over a network. They can be obtained online or by taking a picture of someone with a camera phone (e.g., facial images) with or without their knowledge, lifted from objects someone touches (e.g., latent fingerprints), or captured with high resolution images (e.g., iris patterns). Periodic reauthentication of sessions SHALL be performed to confirm the continued presence of the subscriber at an authenticated session (i.e., that the subscriber has not walked away without logging out). Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks, Asiacrypt 2016, October, 2016. Impose a delay of at least 30 seconds before the next attempt, increasing exponentially with each successive attempt (e.g., 1 minute before the following failed attempt, 2 minutes before the second following attempt), or. Use of some types of authenticators requires that the verifier store a copy of the authenticator secret. Users need to be informed regarding whether the multi-factor cryptographic device is required to stay connected or not. As threats evolve, authenticators capability to resist attacks typically degrades. Biometric template protection schemes provide a method for revoking biometric credentials that is comparable to other authentication factors (e.g., PKI certificates and passwords). Consider form-factor constraints if users must unlock the multi-factor OTP device via an integral entry pad or enter the authenticator output on mobile devices. Even with such measures, the current ability of attackers to compute many billions of hashes per second with no rate limiting requires passwords intended to resist such attacks to be orders of magnitude more complex than those that are expected to resist only online attacks.
NIST 800-63B Digital Identity Guidelines : u/UsefulCyberSecurity - Reddit For rate limiting (i.e., throttling), inform users how long they have to wait until the next attempt to reduce confusion and frustration. Time-based OTPs [RFC 6238] SHALL have a defined lifetime that is determined by the expected clock drift in either direction of the authenticator over its lifetime, plus allowance for network delay and user entry of the OTP. FEDRAMP) or industry standard. Serif fonts for printed materials. If distributed online, look-up secrets SHALL be distributed over a secure channel in accordance with the post-enrollment binding requirements in Section 6.1.2. Alternatively, the authenticator could be a suitably secure processor integrated with the user endpoint itself (e.g., a hardware TPM). to advance the development and productive use of information technology. Available at: http://www.internetsociety.org/sites/default/files/06_3_1.pdf. The authenticator output is obtained by using an approved block cipher or hash function to combine the key and nonce in a secure manner. The nonce SHALL be of sufficient length to ensure that it is unique for each operation of the device over its lifetime. Verifiers SHALL implement a rate-limiting mechanism that effectively limits the number of failed authentication attempts that can be made on the subscribers account as described in Section 5.2.2.