Quiz Entry - updated: 2026.10.22
How are the trust levels of authentication (VSA) defined in eCH-0170?
By three criteria: the authenticator (SFA, MFA, HW-MFA, HW-MFA), its certification (required only at level 4) and the re-authentication interval (ReAuth1 to ReAuth4); a one-time authentication after online identification is rated by the identification level IDN1 to IDN4 instead.
* Each step up adds strength to the authenticator and shortens how long a login may stay valid. *
| VSA | Regular authentication | One-time authentication after online identification | Certification | Re-authentication |
|---|---|---|---|---|
| 1 | SFA (single factor) | IDN1 | none | ReAuth1 (adequate period, e.g. 30 days) |
| 2 | MFA (multi-factor) | IDN2 | none | ReAuth2 (max. 18 h) |
| 3 | HW-MFA (hardware-based MFA) | IDN3 | none | ReAuth3 (max. 12 h) |
| 4 | HW-MFA | IDN4 | certified (FIPS 140-2 Level 3 or CC EAL 4+) | ReAuth4 (max. 30 min) |
Notice that levels 3 and 4 use the same kind of authenticator; what separates them is the independent certification of the device and the much stricter re-authentication. By the weakest-link rule, all three criteria must reach a level for the authentication to be rated there.
Go deeper:
NIST SP 800-63B-4: Authentication Assurance Level 3 — the US counterpart of the top level: non-exportable keys and phishing resistance.