Loss, Theft, Damage, and Compromise with regards to authenticators
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 3.6k
- Forks
- 832
- Avg merge
- 7h 55m
- Merged PRs (30d)
- 4
Description
Under NIST sp800-63b, 4.3 you find the following paragraph:
"CSPs MAY support the temporary suspension of authenticators that are suspected of possible compromise. If suspension is supported, it SHOULD be reversed after the subscriber successfully authenticates to the CSP using a valid (i.e., not suspended) authenticator and requests reactivation of the suspended authenticator. The CSP MAY set a time limit after which a suspended authenticator can no longer be reactivated."
Currently we have:
| 6.4.4 | Verify that if a multi-factor authentication factor is lost, evidence of identity proofing is performed at the same level as during enrollment. | 2 |
|---|
What I believe is missing is the suspension and reversal of the suspension that currently isn't mentioned in ASVS.
Please also note the passage in 4.2.2.3: "If an account that can authenticate at AAL3 has been identity-proofed at IAL1 or IAL2, the requirements are the same as those for recovery at AAL2" and so on.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading ASVS requirement 6.4.4 and the linked NIST SP 800-63B sections 4.3 and 4.2.2.3, then review the 25-comment discussion for a settled interpretation. Done means the ASVS requirements consistently cover the identified authenticator suspension and recovery conditions.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100