NIST SP 800-63
Ayrıca şöyle anılır 800-63, Digital Identity Guidelines, IAL, AAL, FAL
NIST SP 800-63 is the vocabulary most of the identity industry argues in. It gives three independent scales: how well you proved who someone is at enrolment, how strongly they authenticate on return, and how much a federated assertion can be trusted.
The three scales are independent, and that is the point
IAL is identity assurance, set at enrolment. AAL is authenticator assurance, set at each login. FAL is federation assurance, about the assertion travelling between parties. A system can be IAL2 with AAL1, or IAL1 with AAL3. Treating them as one ladder is the most common misreading, and it produces requirements that cost a great deal without raising the thing the buyer was actually worried about.
Why a European product cares about an American standard
Because procurement does. A bank's questionnaire will ask for an AAL even where the binding regulation is eIDAS, because 800-63 is the shared language for describing authentication strength. Answering in that vocabulary is a communication requirement, not a compliance one.
What claiming a level would require
An assessment against the volume in question, by someone accredited to make it. Describing your own system as IAL2 is a self-assessment, and a buyer who knows the standard will read it as one.
Nereden geliyor
Bunu başkası belirtti. Solidus bir araya getiriyor.
Published by the US National Institute of Standards and Technology. Revision 4 was published in August 2024 and supersedes revision 3, which is still what older requests for proposal cite. It splits into volumes: 63A for enrolment and identity proofing, 63B for authentication, 63C for federation. Solidus reads it as a vocabulary; it neither wrote it nor is certified against it.
Bunu nasıl doğrularsınız
Solidus bunu inşa etmedi. Girdi kavramı açıklıyor.
The document is public and free: read 800-63-4 and its A, B and C volumes at pages.nist.gov/800-63-4. Nothing on the Solidus side is offered as evidence of conformance, because there is none to offer.