NIST previews new federal authentication guidelines
Connecting state and local government leaders
The National Institute of Standards and Technology is calling on the public to help it map out new guidelines for federal agencies' digital authentication practices.
By posting four documents on GitHub, the National Institute of Standards and Technology is calling on the public to help it map out new guidelines for federal agencies' digital authentication practices.
Under NIST's scheme for digital authentication, individuals would establish their identity through what's called identity assurance and prove their credentials to access a given system through authenticator assurance -- possibly a chipped and encrypted identity card.
The documents also state that passwords could be entirely numeric. NIST's experts say a mix of character types in passwords (such as at least one digit, uppercase letter and symbol) "is not nearly as significant as initially thought, although the impact on usability and memorability is severe."
Instead, NIST recommends that user-chosen passwords be compared against a list of unacceptable passwords. That list should include passwords from previous breaches, dictionary words and specific words (such as the name of the service itself) that users are likely to choose.
Users also won't be able to have a password "hint" that is accessible to unauthenticated personnel. The verification process shouldn't user specific types of information in the authentication process. In other words, the typical "first pet" or "mother's maiden name" password prompt is out of bounds.
The guidelines said biometrics for authentication matching should be performed locally on a user's device or possibly by a central verifier, but biometrics must be used with another authentication factor that is revocable.
Besides the guidelines for digital authentication, NIST is seeking comments on:
- Enrollment and identity proofing -- the processes by which a credential, and authenticator(s) associated with that credential, can be bound to a specific individual.
- Authentication and lifecycle management -- the selection, use and management of authenticators (or tokens) to authenticate a remote subscriber to an identity system at specified assurance levels.
- Federation and assertions -- the use of federated identity and assertions to convey the results of authentication to a relying party.
The public preview aims to solicit input through successive open comment periods and editing iterations. GitHub comments are being accepted through the summer, and NIST said it would maintain its tradition of extended public comment after this process comes to a close.
This article originally appeared on FCW, a sister site to GCN.