Overview#NIST.SP.800-63B is titled “Authentication & Lifecycle Management” and focuses on password guidance
NIST.SP.800-63B is a publication from National Institute of Standards and Technology
NIST.SP.800-63B changes the requirements for memorized secrets (ie passwords) in several ways.
- SHOULD use __long__, memorable passwords
- SHOULD Use of Password Dictionary of compromised passwords to disallow poor choices
- SHOULD NOT use Passwords Composition Rules
- SHOULD NOT hints and prompts (name of first pet, etc.) as used in Password Recovery
- SHOULD NOT arbitrary (e.g., periodic) Password Periodic Change
Session Bindings #Secrets used for session binding:
- SHALL be generated by the session host during an interaction, typically immediately following user authentication.
- SHALL be generated by an approved random bit generator and contain at least 64 bits of entropy.
- SHALL be erased or invalidated by the session subject when the user logs out.
- SHOULD be erased on the user endpoint when the user logs out or when the secret is deemed to have expired.
- SHOULD NOT be placed in insecure locations such as HTML5 Local Storage due to the potential exposure of local storage to XSS attacks.
- SHALL be sent to and received from the device using an Authenticated Protected Channel.
- SHALL time out and not be accepted after the times specified in Sections 4.1.4, 4.2.4, and 4.3.4 (depending on AAL).
- SHALL NOT be available to insecure communications between the host and user endpoint; authenticated sessions SHALL NOT fall back to an insecure transport, such as from HTTPS to HTTP, following authentication.
NIST.SP.800-63B 4.2.1. Permitted Authenticator Types (Authenticator Assurance Level 2) states: Note: When biometric authentication implements the requirements in Section 5.2.3 the device has to be authenticated. Therefore, it is unnecessary to implement another factor with biometrics as the device is “something you have”, which serves as a valid second factor of the authenticator.
- Biometric False Match Rates (FMR) and False Non-Match Rates (FNMR) do not provide confidence in the authentication of the subscriber by themselves. In addition, FMR and FNMR do not account for spoofing attacks.
- Biometric matching is probabilistic, whereas the other authentication factors are deterministic.
- Biometric template protection schemes provide a method for revoking Biometric credentials that are comparable to other authentication factors (e.g., PKI certificates and passwords). However, the availability of such solutions is limited, and standards for testing these methods are under development.
- Biometric characteristics do not constitute secrets. They can be obtained online or by taking a picture of someone with a camera phone (e.g., facial images) with or without their knowledge, lifted from through objects someone touches (e.g., latent fingerprints), or captured with high resolution images (e.g., iris patterns). While Presentation Attack Detection (PAD) technologies such as liveness detection can mitigate the risk of these types of attacks, additional trust in the sensor is required to ensure that PAD is operating properly in accordance with the needs of the CSP and the subscriber.
An authenticated protected channel between sensor (or endpoint containing a sensor that resists sensor replacement) and verifier SHALL be established and the sensor or endpoint authenticated prior to capturing the biometric sample from the claimant.
Empirical testing of the biometric system to be deployed SHALL demonstrate an EER of 1 in 1000 or better with respect to matching performance. The biometric system SHALL operate with an FMR of 1 in 1000 or better.
The biometric system SHOULD implement PAD. Testing of the biometric system to be deployed SHOULD demonstrate at least 90% resistance to Presentation Attacks for each relevant attack type (aka species), where resistance is defined as the number of thwarted presentation attacks divided by the number of trial presentation attacks.
The biometric system SHALL allow no more than 5 consecutive failed authentication attempts or 10 consecutive failed attempts if PAD meeting the above requirements is implemented. Once that limit has been reached, the biometric authenticator SHALL either:
- Impose a delay of at least 30 seconds before the next attempt, increasing exponentially with each successive attempt, e.g., 1 minute before the following failed attempt, 2 minutes before the second following attempt, etc.
- Disable the biometric user verification and offer another factor (a different biometric modality or a PIN/Passcode if it is not already a required factor) if such an alternative method is already implemented.
Biometric matching SHOULD be performed locally on claimant’s device or MAY be performed at a central verifier.
If matching is performed centrally:
- Use of the biometric SHALL be limited to one or more specific devices that are identified using approved cryptography.
- Biometric revocation, referred to as biometric template protection in ISO/IEC 24745, SHALL be implemented.
- All transmission of biometrics shall be over the authenticated protected channel.
More Information#There might be more information for this subject on one of the following:
- Authenticator Assurance Levels
- Best Practices Password
- Biometric Data Challenges
- Identity Assurance Level
- Level Of Assurance
- Password Anti-Pattern
- Password Periodic Changes