identity-canon/research/authentication-federation/nist-800-63-4.md

NIST SP 800-63-4

Source Type

Government guideline. NIST Special Publication 800-63-4, Digital Identity Guidelines (2025).

Domain

Identity assurance, authentication assurance, federation assurance, and identity lifecycle.

Why This Source Matters

NIST identity guidance separates identity proofing, authentication assurance, federation assurance, and lifecycle management.

NIST 800-63 provides the most explicit assurance-level vocabulary for separating how strongly an identity is bound to a person, how strongly authentication occurred, and how federation preserves or degrades assurance.

Key Concepts

• IAL (Identity Assurance Level): confidence that a subscriber is who they claim to be (IAL1–IAL3).
• AAL (Authenticator Assurance Level): confidence in authentication mechanism strength (AAL1–AAL3).
• FAL (Federation Assurance Level): confidence in federation protocol and assertion protection (FAL1–FAL3).
• Subscriber: party enrolled with a CSP (credential service provider).
• Credential Service Provider (CSP): issues credentials and performs identity proofing.
• Relying Party (RP): depends on CSP assertions.
• Identity Provider (IdP) / Asserting Party (AP): federates authentication to RPs.
• Verifier: entity confirming claimant possession of authenticator.
• Binding: association between subscriber, identity, and authenticator.
• Identity proofing: collection and validation of evidence about a person.
• Authenticator: something the subscriber possesses/controls for auth.
• Federation assertion: signed statement from IdP to RP about authentication and attributes.

Relevant Terminology

Term	Source meaning
Subscriber	Enrolled party at CSP; not necessarily named "user."
CSP	Provider performing proofing and credential issuance.
RP	Consumer of identity/authentication assertions.
IAL	Identity proofing strength level.
AAL	Authentication event strength level.
FAL	Federation protocol/assertion protection level.
Claimant	Party attempting authentication.
Verifier	Confirms authenticator use.
Binding	Link between subscriber identity and authenticator.
Supervised remote proofing	IAL2+ proofing with human or tech supervision.

Modeling Assumptions

• Identity assurance, authentication, and federation are separable dimensions with independent levels.
• Subscriber is the enrolled entity, not the legal person directly; binding connects them.
• Proofing evidence matters and should be retained per policy.
• Federation may preserve or reduce assurance depending on FAL and assertion contents.
• Lifecycle includes enrollment, binding, maintenance, and termination.
• Pseudonymous enrollment is allowed at IAL1 without real-name binding.
• Agency/customer relationship is outside the technical model but affects policy.

Identity-Canon Implications

• NIST Subscriber maps to Account or enrolled Identity Record bound to Natural Person at higher IAL.
• IAL maps to Assurance Level on Identity Record / Person binding.
• AAL maps to Assurance Level on authentication event / Credential use.
• FAL maps to Assurance Level on Trust Relationship or federation assertion.
• Binding maps to Synonymity Assertion or Identifier Binding between subscriber, person, and authenticator.
• Identity proofing evidence maps to Evidence Source.
• Reinforces P7 (synonymity as assertion) and P8 (preserve evidence).
• Supports S12 (weak match insufficient for IAL2+), S13 (strong link with verification), S06 (family/guardian proofing).

Terminology Conflicts

• Subscriber vs. User: NIST subscriber is enrolled party; apps say user.
• Identity vs. Subscriber: NIST separates identity proofing from subscriber record.
• Credential vs. Authenticator: NIST distinguishes credential (issued) from authenticator (possessed); products conflate.
• IAL vs. Account trust: assurance on person binding ≠ account permissions.
• Federation vs. Synonymity: federation assertion ≠ same-person claim across systems.

Candidate Canonical Mappings

NIST concept	Candidate canonical concept
Subscriber	Account / enrolled Identity Record
CSP / IdP	Issuer Scope + Trust Relationship
RP	Relying party Scope
IAL	Assurance Level (identity proofing)
AAL	Assurance Level (authentication)
FAL	Assurance Level (federation)
Authenticator	Credential
Binding	Identifier Binding / Synonymity Assertion
Proofing evidence	Evidence Source
Federation assertion	Claim + Credential (signed)
Claimant	Actor attempting authentication (projection)

Open Questions

• Should IAL/AAL/FAL be a unified Assurance Level vocabulary or three orthogonal dimensions in canon?
• How should pseudonymous IAL1 subscribers map when no Natural Person binding exists?
• Does guardian-assisted proofing for minors warrant a distinct Relationship type with assurance caps?
• Should CSP subscriber ID be a Scoped Identifier under CSP Scope?

References

• NIST SP 800-63-4 — https://pages.nist.gov/800-63-4/
• NIST SP 800-63A (Enrollment and Identity Proofing) — https://pages.nist.gov/800-63-4/sp800-63A.html
• NIST SP 800-63B (Authentication and Lifecycle) — https://pages.nist.gov/800-63-4/sp800-63B.html
• NIST SP 800-63C (Federation and Assertions) — https://pages.nist.gov/800-63-4/sp800-63C.html