GSEC · Question #282
Which Authenticates Assurance Level requires a hardware-based authenticates?
The correct answer is B. AAL3. NIST SP 800-63B Authentication Assurance Level 3 (AAL3) is the only AAL that mandates the use of a hardware-based authenticator, such as a FIDO2 security key.
Question
Which Authenticates Assurance Level requires a hardware-based authenticates?
Options
- AAAI1
- BAAL3
- CAAL2
How the community answered
(25 responses)- A12% (3)
- B80% (20)
- C8% (2)
Why each option
NIST SP 800-63B Authentication Assurance Level 3 (AAL3) is the only AAL that mandates the use of a hardware-based authenticator, such as a FIDO2 security key.
AAL1 is the lowest assurance level and only requires single-factor authentication, which can be a password or software-based OTP - no hardware is required.
AAL3 requires hardware-based cryptographic authenticators that provide verifier impersonation resistance, such as FIDO2/WebAuthn hardware security keys or PIV smart cards. The hardware authenticator must use approved cryptographic algorithms and the private key must be bound to the hardware device and cannot be exported. This physical hardware requirement distinguishes AAL3 from lower assurance levels.
AAL2 requires multi-factor authentication but permits software-based authenticators such as authenticator apps (TOTP) in addition to hardware options, meaning hardware is not mandatory at this level.
Concept tested: NIST AAL3 hardware authenticator requirement
Source: https://pages.nist.gov/800-63-3/sp800-63b.html
Topics
Community Discussion
No community discussion yet for this question.