--- source_url: "https://pages.nist.gov/800-63-4/sp800-63b/aal/?utm_source=openai" title: Authentication Assurance Levels mirrored_at: 2026-08-04T01:03:30.812Z host: pages.nist.gov cited_in_42a: true mirror_canonical: "https://index.42a.ai/pages.nist.gov/800-63-4/sp800-63b/aal/index__q__utm_source_openai" --- > **Original source:** https://pages.nist.gov/800-63-4/sp800-63b/aal/?utm_source=openai _This section is normative._ To satisfy the requirements of a given AAL and be recognized as a subscriber, a claimant **SHALL** authenticate to an RP (or IdP, as described in [\[SP800-63C\]](https://pages.nist.gov/800-63-4/sp800-63c/introduction/#introduction)) with a process whose strength is equal to or greater than the requirements at that level. The authentication process results in an identifier that uniquely identifies the subscriber each time they authenticate to that RP. The identifier **MAY** be pseudonymous. Other attributes that identify the subscriber as a unique subject **MAY** also be provided. Detailed normative requirements for authenticators and verifiers at each AAL are provided in [Sec. 3](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#AAL_SEC5). See [\[SP800-63\] Sec. 3](https://pages.nist.gov/800-63-4/sp800-63/dirm/#sec5) for details on how to choose the most appropriate AAL. Personal information collected during and after identity proofing (see [\[SP800-63A\]](https://pages.nist.gov/800-63-4/sp800-63a/introduction/#introduction)) **MAY** be made available to the subscriber by the digital identity service through the subscriber account. The release or online availability of any personal information by federal agencies requires multi-factor authentication in accordance with [\[EO13681\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-EO13681). Therefore, federal agencies **SHALL** select a minimum of AAL2 when personal information is made available online. At all AALs, indicators of potential fraud, including applicable indicators described in [Sec. 5.3](https://pages.nist.gov/800-63-4/sp800-63b/session/#monitoring), **MAY** be used to lower the risk of misauthentication. For example, authentication from an unexpected geolocation or IP address block (e.g., a cloud service) might prompt the use of additional risk-based controls. CSPs or verifiers **SHALL** assess their use of indicators of potential fraud for efficacy and to identify and mitigate potential negative impacts on their user populations. CSPs or verifiers **SHALL** include fraud indicators in the authentication privacy risk assessment. The use of potential fraud indicators prior to or during the authentication process does not impact or change the AAL of a transaction or substitute for an authentication factor. Throughout this document, [\[FIPS140\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-FIPS140) requirements are satisfied by security technologies, products, and services that utilize implementations of cryptography validated by the Cryptography Module Validation Program [\[CMVP\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-CMVP). FIPS 140 requirements at a given AAL are often different for authenticators and verifiers, with more stringent requirements generally applying to verifiers. This is in recognition of the practical limitations on the certification of authenticators as well as the broader scope that is often associated with a security breach at a verifier. ## Authentication Assurance Level 1 AAL1 provides basic confidence that the claimant controls an authenticator that is bound to the subscriber account. AAL1 requires either single-factor or multi-factor authentication using a wide range of available authentication technologies. Verifiers **SHOULD** make multi-factor authentication options available at AAL1 and encourage their use. Successful authentication requires that the claimant prove possession and control of the authenticator through a secure authentication protocol. ### Permitted Authenticator Types AAL1 authentication **SHALL** use any of the following authentication types, which are further defined in [Sec. 3](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#AAL_SEC5): - Password ([Sec. 3.1.1](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#password)): A memorizable secret typically chosen by the subscriber - Look-up secret ([Sec. 3.1.2](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#lookupsecrets)): A secret determined by the claimant by looking up a prompted value in a list held by the subscriber - Out-of-band device ([Sec. 3.1.3](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#out-of-band)): A secret sent or received through a separate communication channel with the subscriber - Single-factor one-time password (OTP) ([Sec. 3.1.4](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#singlefactorOTP)): A one-time secret obtained from a device or application held by the subscriber - Multi-factor OTP ([Sec. 3.1.5](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#multifactorOTP)): A one-time secret obtained from a device or application held by the subscriber that requires activation by a second authentication factor - Single-factor cryptographic authentication ([Sec. 3.1.6](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#sfc)): Proof of possession and control via an authentication protocol of a cryptographic key held by the subscriber - Multi-factor cryptographic authentication ([Sec. 3.1.7](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#mfc)): Proof of possession and control via an authentication protocol of a cryptographic key held by the subscriber that requires activation by a second authentication factor ### Authenticator and Verifier Requirements Authenticators used at AAL1 **SHALL** use _approved cryptography_. In other words, they must use approved algorithms, but the implementation need not be validated under [\[FIPS140\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-FIPS140). Communication between the claimant and verifier **SHALL** occur via one or more _authenticated protected channels_. Cryptography used by verifiers operated by or on behalf of federal agencies at AAL1 **SHALL** be validated to meet the requirements of [\[FIPS140\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-FIPS140) Level 1. ### Reauthentication These guidelines provide for two types of timeouts, which are further described in [Sec. 5.2](https://pages.nist.gov/800-63-4/sp800-63b/session/#sessionreauthn): 1. An overall timeout limits the duration of an authenticated session to a specified period following authentication or a previous reauthentication. 2. An inactivity timeout terminates a session that has not had activity from the subscriber for a specified period. Periodic reauthentication of subscriber sessions **SHALL** be performed, as described in [Sec. 5.2](https://pages.nist.gov/800-63-4/sp800-63b/session/#sessionreauthn). A definite reauthentication overall timeout **SHALL** be established, which **SHOULD** be no more than 30 days at AAL1. An inactivity timeout **MAY** be applied but is not required at AAL1. ## Authentication Assurance Level 2 AAL2 provides high confidence that the claimant controls one or more authenticators that are bound to the subscriber account. Proof of possession and control of two distinct authentication factors through the use of secure authentication protocols is required. Approved cryptographic techniques are required. ### Permitted Authenticator Types At AAL2, authentication **SHALL** use either a multi-factor authenticator or a combination of two separate authentication factors. A multi-factor authenticator requires two factors to execute a single authentication event, such as a cryptographically secure device with an integrated biometric sensor that is required to activate the device. Authenticator requirements are specified in [Sec. 3](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#AAL_SEC5). When a multi-factor authenticator is used, any of the following **MAY** be used: - Multi-factor out-of-band authenticator ([Sec. 3.1.3.4](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#mfooba)) - Multi-factor OTP ([Sec. 3.1.5](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#multifactorOTP)) - Multi-factor cryptographic authentication ([Sec. 3.1.7](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#mfc)) When a combination of two single-factor authenticators is used, the combination **SHALL** include one _physical authenticator_ (i.e., “something you have”) from the following list in conjunction with either a password ([Sec. 3.1.1](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#password)) or a biometric comparison: - Look-up secret ([Sec. 3.1.2](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#lookupsecrets)) - Out-of-band device ([Sec. 3.1.3](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#out-of-band)) - Single-factor OTP ([Sec. 3.1.4](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#singlefactorOTP)) - Single-factor cryptographic authentication ([Sec. 3.1.6](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#sfc)) > A biometric characteristic is not recognized as an authenticator by itself. [Section 3.2.3](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#biometric_use) requires a physical authenticator to be authenticated along with a biometric comparison. The physical authenticator then serves as “something you have,” while the biometric match serves as “something you are.” When a biometric comparison is used as an activation factor for a multi-factor authenticator, the authenticator itself serves as the physical authenticator. As noted in that section, local verification of biometric factors (i.e., the use of a multi-factor authenticator with a biometric comparison as an activation factor) is preferred over central biometric factor comparison. ### Authenticator and Verifier Requirements Authenticators used at AAL2 **SHALL** use approved cryptography. Cryptographic authenticators procured by federal agencies **SHALL** be validated to meet the requirements of [\[FIPS140\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-FIPS140) Level 1. At least one authenticator used at AAL2 **SHALL** be replay-resistant, as described in [Sec. 3.2.7](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#replay). Authentication at AAL2 **SHOULD** demonstrate authentication intent from at least one authenticator, as discussed in [Sec. 3.2.8](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#intent). Communication between the claimant and verifier **SHALL** occur via one or more authenticated protected channels. Cryptography used by verifiers operated by or on behalf of federal agencies at AAL2 **SHALL** be validated to meet the requirements of [\[FIPS140\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-FIPS140) Level 1 unless otherwise specified. Verifiers **SHALL** offer at least one phishing-resistant authentication option at AAL2, as described in [Sec. 3.2.5](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#verifimpers). Federal agencies **SHALL** require their staff, contractors, and partners to use phishing-resistant authentication to access federal information systems. In all cases, verifiers **SHOULD** encourage the use of phishing-resistant authentication at AAL2 whenever practical since phishing is a significant threat vector [\[IC3\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-IC3). ### Reauthentication Periodic reauthentication of subscriber sessions **SHALL** be performed, as described in [Sec. 5.2](https://pages.nist.gov/800-63-4/sp800-63b/session/#sessionreauthn). A definite reauthentication overall timeout **SHALL** be established, which **SHOULD** be no more than 24 hours at AAL2. The inactivity timeout **SHOULD** be no more than 1 hour. When the inactivity timeout has occurred but the overall timeout has not yet occurred, the verifier **MAY** allow the subscriber to reauthenticate using only a successful password or biometric comparison in conjunction with the _session secret_, as described in [Sec. 5.1](https://pages.nist.gov/800-63-4/sp800-63b/session/#bindings). ## Authentication Assurance Level 3 AAL3 provides very high confidence that the claimant controls authenticators that are bound to the subscriber account. Authentication at AAL3 is based on the proof of possession of a key through the use of a cryptographic protocol along with either an activation factor or a password. AAL3 authentication requires the use of a cryptographic authenticator with a non-exportable _private key_ that provides phishing resistance. Approved cryptographic techniques are required. ### Permitted Authenticator Types AAL3 authentication **SHALL** require one of the following authenticator combinations: - Multi-factor cryptographic authentication ([Sec. 3.1.7](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#mfc)) - Single-factor cryptographic authentication ([Sec. 3.1.6](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#sfc)) used in conjunction with either a password ([Sec. 3.1.1](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#password)) or a biometric comparison > A biometric characteristic is not recognized as an authenticator by itself. [Section 3.2.3](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#biometric_use) requires a physical authenticator to be authenticated along with the biometric comparison. The physical authenticator then serves as “something you have,” while the biometric match serves as “something you are.” When a biometric comparison is used as an activation factor for a multi-factor authenticator, the authenticator itself serves as the physical authenticator. As noted in that section, local verification of biometric factors (i.e., the use of a multi-factor authenticator with a biometric comparison as an activation factor) is preferred over central biometric factor comparison. ### Authenticator and Verifier Requirements Authenticators used at AAL3 **SHALL** use approved cryptography. Communication between the claimant and verifier **SHALL** occur via one or more authenticated protected channels. The cryptographic authenticator used at AAL3 **SHALL** have a non-exportable private key and **SHALL** provide phishing resistance, as described in [Sec. 3.2.5](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#verifimpers). The cryptographic authentication protocol **SHALL** be replay-resistant, as described in [Sec. 3.2.7](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#replay). All authentication and reauthentication processes at AAL3 **SHALL** demonstrate authentication intent from at least one authenticator, as described in [Sec. 3.2.8](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#intent). Cryptographic authenticators used at AAL3 **SHALL** use public-key cryptography to protect the authentication secrets from compromise of the verifier. Single-factor and multi-factor authenticators used at AAL3 **SHALL** be validated to meet the requirements of [\[FIPS140\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-FIPS140) Level 1 or higher overall. As described in [Sec. 3.2.12](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/#export), cryptographic authenticators used at AAL3 are required to provide a hardware-protected, isolated environment to prevent authentication keys from being leaked or extracted. Since _syncable authenticators_ (described in [Appendix B](https://pages.nist.gov/800-63-4/sp800-63b/syncable/#appB)) require the private key to be exportable, syncable authenticators **SHALL NOT** be used at AAL3. Cryptography used by verifiers at AAL3 **SHALL** be validated at [\[FIPS140\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-FIPS140) Level 1 or higher. Hardware-based authenticators and verifiers at AAL3 **SHOULD** resist relevant side-channel (e.g., timing and power-consumption analysis) attacks. ### Reauthentication Periodic reauthentication of subscriber sessions **SHALL** be performed, as described in [Sec. 5.2](https://pages.nist.gov/800-63-4/sp800-63b/session/#sessionreauthn). At AAL3, the overall timeout for reauthentication **SHALL** be no more than 12 hours. The inactivity timeout **SHOULD** be no more than 15 minutes. Unlike AAL2, AAL3 reauthentication requirements are the same as for initial authentication at AAL3. ## General Requirements The following requirements apply to authentication at all AALs. ### Security Controls The verifier **SHALL** employ appropriately tailored security controls from the moderate baseline security controls defined in [\[SP800-53\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-SP800-53) or an equivalent federal (e.g., [\[FEDRAMP\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-FEDRAMP)) or industry standard that the organization has chosen for the information systems, applications, and online services that these guidelines are used to protect. ### Records Retention Policy The verifier **SHALL** comply with its respective records retention policies in accordance with applicable laws, regulations, and policies, including any National Archives and Records Administration (NARA) records retention schedules that may apply. If the verifier opts to retain records in the absence of mandatory requirements, the verifier or the CSP or IdP of which it is a part **SHALL** conduct a _risk management_ process [\[NISTRMF\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-NIST-RMF), including assessments of privacy and security risks, to determine how long records should be retained and **SHALL** inform the subscriber of that retention policy. ### Privacy Requirements The verifier **SHALL** employ appropriately tailored privacy controls defined in [\[SP800-53\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-SP800-53) or an equivalent industry standard. If CSPs or IdPs process attributes for purposes other than identity services (i.e., identity proofing, authentication, or attribute _assertions_), related fraud mitigation, or compliance with laws or legal processes, they **SHALL** implement measures to maintain predictability and manageability commensurate with the privacy risks that arise from the additional processing. Examples of such measures include providing clear notice, obtaining subscriber consent, and enabling the selective use or disclosure of attributes. When CSPs or IdPs use consent measures, they **SHALL NOT** make consent for the additional processing a condition of the identity service. Regardless of whether the CSP or IdP is an agency or private-sector provider, the following requirements apply to federal agencies that offer or use the authentication service: 1. The agency **SHALL** consult with their _Senior Agency Official for Privacy_ (SAOP) and conduct an analysis to determine whether the collection of personal information to issue or maintain authenticators triggers the requirements of the _Privacy Act of 1974_ [\[PrivacyAct\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-PrivacyAct) (see [Sec. 7.4](https://pages.nist.gov/800-63-4/sp800-63b/privacy/#agency-privacy)). 2. The agency **SHALL** publish a _System of Records Notice_ (SORN) to cover such collections, as applicable. 3. The agency **SHALL** consult with its SAOP and conduct an analysis to determine whether the collection of personal information to issue or maintain authenticators triggers the requirements of the _E-Government Act of 2002_ [\[E-Gov\]](https://pages.nist.gov/800-63-4/sp800-63b/references/#ref-E-Gov). 4. The agency **SHALL** publish a _Privacy Impact Assessment_ (PIA) to cover such collection, as applicable. ### Redress Requirements The verifier and associated CSP or IdP **SHALL** provide mechanisms for the redress of subscriber complaints and problems that arise from subscriber authentication processes, as described in Sec. 5.6 of [\[SP800-63\]](https://pages.nist.gov/800-63-4/sp800-63b/_sp800-63/sec5_DIRM.md#redress). These mechanisms **SHALL** be easy for subscribers to find and use. The CSP or IdP **SHALL** assess the mechanisms for efficacy in resolving complaints or problems. ``` \clearpage ``` ## Summary of Requirements [Table 1](https://pages.nist.gov/800-63-4/sp800-63b/aal/#table-1) provides a non-normative summary of the requirements for each of the AALs. [Table 1. Summary of requirements by AAL](https://pages.nist.gov/800-63-4/sp800-63b/aal/#table-1) **Requirement** **AAL1** **AAL2** **AAL3** **Permitted Authenticator Types** \* _Any AAL2 or AAL3 authenticator type_ \* Password \* Look-up secret \* Out-of-band \* SF OTP \* SF cryptographic \* MF cryptographic \* MF out-of-band \* MF OTP \* Password or biometric comparison plus:   –SF cryptographic   –Look-up secret   –Out-of-band   –SF OTP \* MF cryptographic \* SF cryptographic plus:   –Password   –Biometric comparison **FIPS 140 Validation** (Government Verifiers and Authenticators) **Verifiers** –Level 1 **Verifiers** –Level 1 **Authenticators** –Level 1 overall **Verifiers** –Level 1 **Authenticators** –Level 1 overall **Reauthentication** (recommended) 30 days overall 24 hours overall 1 hour inactivity Single factor required 12 hours overall 15 minutes inactivity **Phishing Resistance** Not required Recommended; Must be available Required **Replay Resistance** Not required Required Required **Authentication Intent** Not required Recommended Required **Key Exportability** Permitted Permitted Prohibited