All Rights Reserved. FIDO Alliance. Copyright 2016.

#FIDOseminar

FIDO & STRONG AUTHENTICATION IN US FEDERAL GOVERNMENT

Paul Grassi, Senior Standards and Technology Advisor, NIST

Strong Authentication and US Digital Services

–Dr. Andy Ozment

“…encryption would not have helped…”

Privacy Enhancing & Voluntary

Secure & Resilient

Interoperable

Cost-Effective & Easy to Use

USG Use Cases

?M-05-24

relevant efforts @ NIST

strength of authentication (SOFA)https://pages.nist.gov/SOFA

Authenticator Assurance Level 3(formerly known as LOA4)

AAL 3 is intended to provide the highest practical remote network authentication assurance. Authentication at AAL 3 is

based on proof of possession of a key in a physical authenticator through a cryptographic protocol. AAL 3 is similar to AAL 2 except that only hardware cryptographic

authenticators (in conjunction with a memorized secret for single-factor cryptographic devices) and multi-factor OTP

devices are allowed. The authenticator SHALL be a hardware cryptographic module validated at Federal Information

Processing Standard (FIPS) 140 Level 2 or higher overall (Level 1 for single-factor authenticators) with at least FIPS

140 Level 3 physical security.

always supported

newly supported