Roadmap: NIST Special Publication 800-63-4 Digital Identity Guidelines

Special Publication 800-63, Draft Revision 4

The Draft Fourth Revision of NIST SP 800-63, Digital Identity Guidelines is available for review, and we need your feedback! NIST will accept all input submitted until 11:59pm on April 14, 2023, through the following site: https://csrc.nist.gov/publications/detail/sp/800-63/4/draft.

NIST held a virtual event, Digital Identity Guidelines – Kicking off Revision 4!, on January 12, 2023. Presentation slides are available here.

Background

The rapid proliferation of online services over the past few years has heightened the need for reliable, equitable, secure, and privacy-protective digital identity solutions.

Revision 4 of NIST Special Publication 800-63, Digital Identity Guidelines, intends to respond to the changing digital landscape that has emerged since the last major revision of this suite was published in 2017 — including the real-world implications of online risks. The guidelines present the process and technical requirements for meeting digital identity management assurance levels for identity proofing, authentication, and federation, including requirements for security and privacy as well as considerations for fostering equity and the usability of digital identity solutions and technology.

Taking into account feedback provided in response to our June 2020 Pre-Draft Call for Comments, as well as research conducted into real-world implementations of the guidelines, market innovation, and the current threat environment, this draft seeks to:

1. Advance Equity: This draft seeks to expand upon the risk management content of previous revisions and specifically mandates that agencies account for impacts to individuals and communities in addition to impacts to the organization. It also elevates risks to mission delivery – including challenges to providing services to all people who are eligible for and entitled to them – within the risk management process and when implementing digital identity systems. Additionally, the guidance now mandates continuous evaluation of potential impacts across demographics, provides biometric performance requirements, and additional parameters for the responsible use of biometric-based technologies, such as those that utilize face recognition.
2. Emphasize Optionality and Choice for Consumers: In the interest of promoting and investigating additional scalable, equitable, and convenient identify verification options, including those that do and do not leverage face recognition technologies, this draft expands the list of acceptable identity proofing alternatives to provide new mechanisms to securely deliver services to individuals with differing means, motivations, and backgrounds. The revision also emphasizes the need for digital identity services to support multiple authenticator options to address diverse consumer needs and secure account recovery.
3. Deter Fraud and Advanced Threats: This draft enhances fraud prevention measures from the third revision by updating risk and threat models to account for new attacks, providing new options for phishing resistant authentication, and introducing requirements to prevent automated attacks against enrollment processes. It also opens the door to new technology such as mobile driver’s licenses and verifiable credentials.
4. Address Implementation Lessons Learned: This draft addresses areas where implementation experience has indicated that additional clarity or detail was required to effectively operationalize the guidelines. This includes re-working the federation assurance levels, providing greater detail on Trusted Referees, clarifying guidelines on identity attribute validation sources, and improving address confirmation requirements.

Roadmap

SP 800-63-3 Implementation Resources

NIST Special Publication 800-63-3, Digital Identity Guidelines, is an umbrella publication that introduces the digital identity model described in the SP 800-63-3 document suite. It frames identity guidelines in three major areas:

• Enrollment and identity proofing (SP 800-63A),
• Authentication and lifecycle management (SP 800-63B),
• Federation and assertions (SP 800-63C).

 In addition to introducing detailed guidelines in these areas, SP 800-63-3 addresses the factors involved in choosing the appropriate Identity Assurance Level (IAL), Authentication Assurance Level (AAL), and Federation Assurance Level (FAL) for a given application.

These implementation resources are provided pursuant to OMB Policy Memorandum M-19-17. While these resources reference normative guidelines in the SP 800-63-3 document suite and other documents, these resources are intended as informative implementation guidance and are not normative. These implementation resources provide guidance for SP 800-63-3 in three parts: Part A addresses SP 800-63A, Part B addresses SP 800-63B, and Part C addresses SP 800-63C.

Comments on these resources are welcomed and can be submitted via email to dig-comments [at] nist.gov (dig-comments[at]nist[dot]gov).

SP 800-63-3 Conformance Criteria

Pursuant to Office of Management and Budget Policy Memorandum M-19-17, the Conformance Criteria present non-normative, informational guidance on all requirements and controls contained in NIST Special Publications (SP) 800-63A Enrollment and Identity Proofing and SP 800-63B Authentication and Lifecycle Management for assurance levels IAL2 and IAL3 and AAL2 and AAL3. The complete set of Conformance Criteria are intended to provide non-normative supplemental guidance to federal agencies and other organizations to facilitate implementation and assessment.

Comments or questions on the Conformance Criteria may be sent to dig-comments [at] nist.gov (dig-comments[at]nist[dot]gov).