17 VIEWS
Pinterest LinkedIn LINE

Abstract

This paper analyzes the “Binding” provisions in the new digital identity standard released on July 31, 2025, NIST SP 800-63-4. Although the standard does not explicitly define a “Binding Level of Assurance,” this paper focuses on the implicit levels found in SP 800-63A-4 and on a critical security issue in the process for adding subsequent authenticators specified in SP 800-63B-4.

The core issue is that, under the current provision, a lower-assurance session (for example, AAL1) can be used to bind a new, higher-assurance authenticator (for example, AAL2 or AAL3) to a subscriber account. An attacker who has compromised a lower-level authenticator may bind the attacker’s own higher-level authenticator to the victim’s account and take over the account.

To mitigate this risk, this paper proposes 3 amendments to the binding provision: perform binding at an authentication assurance level equal to or higher than the AAL of the new authenticator; register the new authenticator at the same AAL as the current session; or repeat identity proofing. These changes prevent a higher-assurance authenticator from being bound through a lower-assurance session, strengthen security, and allow relying parties to assess assurance levels more accurately.

1. Introduction

NIST SP800-63-4 is a new digital identity standard that came out on July 31, 2025. It covers vast territory. However, in this paper, we will concentrate on the aspect of “Binding”.

NIST SP800-63B-4 used the word “Binding” rather than “Issuance” because users can bring their own authenticators and register them to their account at the CSP rather than CSPs issuing it. So “binding” is a term that encompasses both registration by the user (subscriber) to the CSP and the issuance by the CSP.

There is no explicit mention of the binding level of assurance in NIST SP800-63-4. However, there are some hints of it. It is mainly in the initial registration phase of the authenticator, which is described in SP800-63A-4 in the list of provisions for each level, referring to NIST SP800-63B-4 for specific security requirements that are common to all levels.

2. Authenticator Binding

General provisions

In SP800-63B-4, section 4.1 is dedicated to this binding.

First, it defines “Authenticator binding” as follows:

Authenticator binding refers to establishing an association between a specific authenticator and a subscriber account to enable the authenticator to authenticate for that subscriber account, possibly in conjunction with other authenticators.

(Source: NIST SP 800-63B-4; translated by the author)

Then, the document introduces a group of provisions as follows.

Authenticators SHALL be bound to subscriber accounts by either:

  1. being issued by the CSP as part of enrollment or
  2. using a subscriber-provided authenticator that is acceptable to the CSP.
(Source: NIST SP 800–63B-4, Section 4.1, Paragraph 2; translated by the author)

When subsequent authenticator is to be bound to the subscriber account, the CSP

  1. SHALL ensure that the process requires authentication at either the maximum AAL currently available in the subscriber account or the maximum AAL at which the new authenticator will be used, whichever is lower; and
    • Example: When binding an authenticator suitable for use at AAL2, unless the subscriber account has authentication capability only at AAL1, authentication at AAL2 is required.
  2. When an authenticator is added, the CSP SHALL notify the subscriber, in accordance with Section 4.6, through a mechanism independent of the transaction that binds the new authenticator.
(Source: NIST SP 800-63B-4, Section 4.1, Paragraph 4.1.2.1, Paragraph 2; translated by the author)

Provisions 1-3 above are problematic. This issue is discussed in Section 5.2.

The following paragraph sets out requirements spanning the digital identity lifecycle. Because it combines multiple requirements and recommendations in a single paragraph, it has been reformatted and numbered below for clarity.

Throughout the lifetime of a digital identity, CSPs

  1. SHALL bind authenticators to subscriber accounts by either of the following methods:
    • The CSP issues the authenticator as part of enrollment; or
    • The CSP accepts an acceptable authenticator and registers it to the subscriber account.
  2. SHALL maintain a record of all authenticators that are bound to each subscriber account;
  3. SHALL determine the characteristics of the authenticator being bound (e.g., single-factor versus multi-factor, phishing-resistant or not) so that verifiers can assess compliance with the requirements at each AAL;
  4. (implicit) SHALL communicate to the RP the result of determination;
  5. MAY determine it based on strong evidence (e.g., authenticator attestation), direct information from having issued the authenticator, or typical characteristics of authenticator implementations (e.g., whether a user verification bit is set by WebAuthn );
  6. SHALL also maintain other state information that is required to meet the authenticator verification requirements;
  7. SHALL create the record that contain the date and time of significant authenticator lifecycle events (e.g., binding to the subscriber account, renewal, update, expiration);
  8. SHOULD include information about the source of the binding (e.g., IP address, device identifier) of any device associated with the event; and
  9. MAY require additional information about the new authenticator or its associated endpoint to determine whether it is suitable for the requested AAL.
(Source: NIST SP 800-63B-4, Section 4.1, Paragraph 4; adapted by the author)

3. Binding at Enrollment

Binding at enrollment is part of the enrollment process and is addressed in SP 800-63A. The provisions are as follows.

The CSP SHOULD encourage the subscriber to bind at least 2 separate means of authentication. See Section 5 for subscriber accounts and [SP800-63B] Section 4.1.2.1 for authenticator binding.

  1. SHALL provide the ability for the applicant to bind an authenticator using one of the following methods:
    1. Under [SP800-63B] Section 4.1.3 and its requirements for each authenticator type, remotely enroll an authenticator provided by the subscriber.
    2. Distribution of a physical authenticator to a validated address
    3. Distribution or on-site enrollment of an authenticator
  2. SHALL confirm the presence of the intended subscriber through one of the following methods if authenticators are bound outside of a single protected session with the user:
    1. Return of a continuation code
    2. Comparison against a biometric collected at the time of proofing
(Source: NIST SP800-63A-4, Section)4.1.12 Initial Authenticator Binding

Because the cross-references are difficult to follow, I have paraphrased the provisions below.

CSP SHALL

  1. permit the binding of multiple authenticators to a subscriber account;
  2. ensure that the process requires authentication at the lower of either
    • the maximum AAL currently available; or


    • maximum AAL at which the new authenticator will be used; NOTE 1: This means that if the subscriber account is only bound to AAL1 authenticator, the subsequent AAL2 authenticator is bound to the subscriber account within an AAL1 session. This poses a problem as AAL1 session may have been already taken over by the attacker and the attacker may be attempting to bind its AAL2 authenticator to the victim’s account.
  3. notify the subscriber via a mechanism independent of the transaction binding the new authenticator, as described in Sec. 4.6

    . (Account Notifications). NOTE 2: This partly addresses the problem pointed out in NOTE 1.

Further, if an authenticator is provided by another device other than the one on which the subscriber is currently authenticated, the binding process SHALL occur in the following sequence.

  1. The device on which the subscriber is currently authenticated requests a binding code to the CSP.
  2. CSP generates and returns a binding code to the device.
  3. The subscriber enters the binding code into the 2nd device that has the new authenticator.
(Source: NIST SP 800-63A-4, Section 4.1.12; adapted by the author)

4. Binding Provisions

SP800-63A-4 states the requirements for each IAL. The following are the requirements for IAL 2 and 3.

4.1 IAL2 Binding Provisions

IAL2 Binding requirements are listed in SP800-63A-4 section 4.2.12 Initial Authenticator Binding.

Once a unique subscriber account has been established for the applicant, who is now the subscriber, in the CSP’s identity system and a record has been created in the identity register, 1 or more authenticators may be associated with, or bound to, the subscriber account.

To minimize the need for account recovery, the CSP

  1. SHOULD encourage subscribers to bind at least 2
    separate means of authentication. Note: See Section 5 for details about subscriber accounts and SP 800-63B Section 4.1.2.1 for authenticator binding.
  1. SHALL provide the ability for the applicant to bind an authenticator using one of the following methods:
    1. Under SP 800-63B Section 4.1.3 and its requirements for each authenticator type, remotely enroll an authenticator provided by the subscriber.
    2. Distribution of a physical authenticator to a validated address
    3. Distribution or on-site enrollment of an authenticator
  2. SHALL confirm the presence of the intended subscriber through one of the following methods if authenticators are bound outside of a single protected session with the user:
    1. Return of a continuation code
    2. Comparison against a biometric collected at the time of proofing
(Source: NIST SP 800-63A-4, Section 4.2.12, Initial Authenticator Binding; translated by the author)

4.2 IAL3 Binding Provisions

IAL3 Binding requirements are listed in SP800-63A-4 section 4.3.10 Initial Authenticator Binding. The provisions are as follows:

The CSP is subject to the following requirements.

  1. The CSP SHALL distribute or enroll the subscriber’s initial authenticator during an attended, on-site interaction with a proofing agent.
  2. If the CSP distributes or enrolls the initial authenticator outside a single authenticated protected session with the subscriber, the CSP SHALL compare a biometric sample collected from the subscriber with the sample collected during identity proofing before registering the authenticator.
  3. The CSP MAY ask the subscriber to bring the identity evidence used during identity proofing to further strengthen the authenticator-binding process.
(Source: NIST SP 800-63A-4, Section 4.3.10, Initial Authenticator Binding; translated by the author)

5. Problems of the current documentation

There are several issues that can be pointed out in the SP800-63-4 binding processes.

5.1 Issues around initial binding of the authenticator

Notably, it is missing the remote registration provisions, which could look like:

  1. SHALL enroll the subscriber’s initial authenticator during the same protected session in which a proofing agent established the identity to be registered to the identity register.
(Source: Author)

This could be the oversight or the reflection of the American local condition, where remote identity proofing at IAL3 is difficult since there is no widespread digital identity document that can be meaningfully used in the remote identity proofing.

When other jurisdictions that can utilize digital identity document (Digital ID) try to make use of SP800-63-4, it is probably wise to add the point 4 above.

5.2 Issues around adding subsequent authenticators

As stated earlier, provision 3 is problematic. It states that

the CSP SHALL ensure that the process requires authentication at either the maximum AAL currently available in the subscriber account or the maximum AAL at which the new authenticator will be used, whichever is lower

(Source: NIST SP800-63B-4, Section 4.1.2.1. Binding an Additional Authenticator, Paragraph 2; translated by the author)

This means that, within a session created by an AAL1 authenticator, an AAL2 or AAL3 authenticator can be bound to the subscriber account.

This poses a problem: an attacker may have already compromised the victim’s ALL1 authenticator (such as a password) and binds their “AAL2/3” authenticator and uses it subsequently.

Provision 3 should probably amended to:

The CSP SHALL

  1. ensure that the process requires authentication at either the same or greater AAL that the subscriber is trying to add; or
  2. mark the registered authenticator as the same AAL of the current session even if the authenticator is capable of fulfilling a higher AAL; or
  3. redo the identity proofing at the matching IAL to raise the session quality to be equal or higher of the AAL of the authenticator being registered.
(Source: Author)

6. Conclusion

This paper summarizes the “Binding” provisions available in NIST SP800-63-4 series. It points out that there are implicit notions of “Binding Level” expressed in SP800-63A-4 and that the method referred by it (SP800-63B-4) is problematic because it is vulnerable to the attacker adding their higher level authenticator to the victim’s account.

To mitigate it, this paper proposes some amendments/additional provisions to it. With the mitigation, CSPs can provide safer ways to bind the authenticator to the account, or avoid providing false sense of security to the RP.

Related posts