Support for NIST SP 800-63B AAL

[bitbucket-import-issues]

Originally submitted by Bjorn Hjelm (Bjorn Hjelm) on 2020-06-23

In NIST SP 800-63B, three levels of Authentication Assurance Levels (AALs) for authenticating a subscriber was introduced. Deployments in the United States are using the NIST guidelines for deployments so should this be supported by the MODRNA Authentication Profile and added to section 4?

---

Bitbucket status: new

Bitbucket origin: issue 182

[bitbucket-import-issues]

Originally submitted by ve7jtb (John Bradley) on 2020-07-21

We should discuss this. The problem is that Moderna may or may not be capable of meeting AAL3.

[bitbucket-import-issues]

Originally submitted by ve7jtb (John Bradley) on 2021-06-22

Without token binding three is currently no way in the specification to meet FAL 3. There is a possibility we could extend the spec some other way to do proof of possession.

[bitbucket-import-issues]

Originally submitted by Bjorn Hjelm (Bjorn Hjelm) on 2021-06-22

Based on today’s working group discussion, a possible way of addressing this through vectors of trust similar to what was done in the iGov OpenID Connect profile (section 3.5).