NIST Publishes Second Draft of Digital Identity Guidelines, Invites Comment

The National Institute of Standards and Technology (NIST) has updated its draft Digital Identity Guidelines (SP 800-63 Revision 4 and related documents) to enhance secure access to services while accommodating a variety of identification methods.

The update follows extensive feedback from various stakeholders and aims to balance security with accessibility, ensuring that both modern digital credentials and traditional identification methods remain viable options for proving identity.

Significant updates include expanded guidance on emerging technologies like syncable authenticators (passkeys) and digital wallets, which offer enhanced security and convenience. The guidelines also provide detailed instructions on maintaining access for those using traditional identification methods, including in-person identity proofing and support for individuals lacking standard identification documents.

NIST says it incorporated expert input to refine the use of biometric verification, emphasizing the need for accuracy, privacy, and alternative options.

The NIST Digital Identity Guidelines (SP 800-63) have evolved significantly since their inception. The initial version, titled “Electronic Authentication Guideline,” was published in 2004. Over the next decade, it underwent several revisions, with SP 800-63-3 marking a major update in June of 2017.

That revision restructured the guidelines into a suite of four documents covering different aspects of digital identity management: an overview (SP 800-63-3), enrollment and identity proofing (SP 800-63A), authentication and lifecycle management (SP 800-63B), and federation and assertions (SP 800-63C). It also introduced new concepts like Identity Assurance Level (IAL), Authenticator Assurance Level (AAL), and Federation Assurance Level (FAL).

In recent years, NIST has been working on Revision 4 to address the changing digital landscape and emerging technologies. In June 2020, NIST issued a pre-draft call for comments. The first public draft of SP 800-63 Revision 4 was released in December 2022, now followed by the newly announced second public draft. 

NIST says it received almost 4,000 comments from 140 organizations and individuals on the earlier, 2022 version of the draft.

The draft guidelines are open for public comment until October 7, 2024, and NIST has scheduled a webinar on August 28, 2024, to discuss the updates.

Source: NIST

–

August 21, 2024 – by Cass Kennedy and Alex Perala