NIST special publication expands government authentication options

December 21, 2011

A newly revised publication from the National Institute of Standards and Technology (NIST) expands the options for government agencies that need to verify the identity of users of their Web-based services. Electronic Authentication Guideline (NIST Special Publication 800-63-1) is an extensive revision and update of the original document, released in 2006, and it recognizes that times, and technologies, have changed.

"Changes made to the document reflect changes in the state of the art," explains NIST computer security expert Tim Polk, Cryptographic Technology Group manager at NIST. "There are new techniques and tools available to government agencies, and this provides them more flexibility in choosing the best authentication methods for their individual needs, without sacrificing security."

When SP 800-63 was first released, its authors assumed that most agencies would handle the business of figuring out if users were who they claimed to be in-house. But since that time, an industry has grown around providing authentication services, and it is often in the best interest of agencies to take advantage of commercial systems or those of other government entities. And while passwords are still the leading mechanism for authenticating user identity, a growing number of systems rely on cryptographic keys or physical tokens.

The revision broadens the discussion of technologies available to agencies and gives a more detailed discussion of these technologies. The guideline applies whether agencies choose to handle authentication directly or leverage services provided by other parties, including commercial companies.

Government agencies have the option of using the services of companies that have had their authentication systems certified through the Federal Chief Information Officer Council's Trust Framework Provider Adoption Process (TFPAP). This program assesses credentialing processes against federal requirements, including those established in 800-63. To ensure consistency and avoid redundant analysis, NIST strongly encourages agencies to leverage the TFPAP process.

SP 800-63-1 is the official implementation guidance for the Office of Management and Budget (OMB) Memorandum 04-04, "E-Authentication Guidance for Federal Agencies.*" Polk stresses that the revised NIST guideline may inform but is not intended to restrict or constrain the development or use of standards for implementation of the National Strategy for Trusted Identities in Cyberspace (NSTIC). NIST SP 800-63-1 is specifically designated as a guideline for use by federal agencies for electronic authentication. NSTIC, in contrast, has a broader charge: the creation of an Identity Ecosystem, "an online environment where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities."
-end-
NIST SP 800-63-1, Electronic Authentication Guideline, is available at http://www.nist.gov/manuscript-publication-search.cfm?pub_id=910006. For more NIST computer security publications, see http://csrc.nist.gov/publications/PubsSPs.html.

* The Office of Management and Budget's guidance, "E-Authentication Guidance for Federal Agencies" [OMB 04-04] can be found at http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy04/m04-04.pdf

National Institute of Standards and Technology (NIST)

Related Technology Articles from Brightsurf:

December issue SLAS Technology features 'advances in technology to address COVID-19'
The December issue of SLAS Technology is a special collection featuring the cover article, ''Advances in Technology to Address COVID-19'' by editors Edward Kai-Hua Chow, Ph.D., (National University of Singapore), Pak Kin Wong, Ph.D., (The Pennsylvania State University, PA, USA) and Xianting Ding, Ph.D., (Shanghai Jiao Tong University, Shanghai, China).

October issue SLAS Technology now available
The October issue of SLAS Technology features the cover article, 'Role of Digital Microfl-uidics in Enabling Access to Laboratory Automation and Making Biology Programmable' by Varun B.

Robot technology for everyone or only for the average person?
Robot technology is being used more and more in health rehabilitation and in working life.

Novel biomarker technology for cancer diagnostics
A new way of identifying cancer biomarkers has been developed by researchers at Lund University in Sweden.

Technology innovation for neurology
TU Graz researcher Francesco Greco has developed ultra-light tattoo electrodes that are hardly noticeable on the skin and make long-term measurements of brain activity cheaper and easier.

April's SLAS Technology is now available
April's Edition of SLAS Technology Features Cover Article, 'CURATE.AI: Optimizing Personalized Medicine with Artificial Intelligence'.

Technology in higher education: learning with it instead of from it
Technology has shifted the way that professors teach students in higher education.

Post-lithium technology
Next-generation batteries will probably see the replacement of lithium ions by more abundant and environmentally benign alkali metal or multivalent ions.

Rethinking the role of technology in the classroom
Introducing tablets and laptops to the classroom has certain educational virtues, according to Annahita Ball, an assistant professor in the University at Buffalo School of Social Work, but her research suggests that tech has its limitations as well.

The science and technology of FAST
The Five hundred-meter Aperture Spherical radio Telescope (FAST), located in a radio quiet zone, with the targets (e.g., radio pulsars and neutron stars, galactic and extragalactic 21-cm HI emission).

Read More: Technology News and Technology Current Events
Brightsurf.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.