How are the trust levels of federation (VSF) defined?
VSF1: bearer assertion, digitally signed, no confidentiality protection, any channel; VSF2: bearer, signed, and either encrypted with front-channel transport or unencrypted with back-channel transport; VSF3: holder-of-key (verifiable by the RP), signed and encrypted, any channel.
In a federation, an identity provider (IdP) authenticates the user and hands a confirmation of authentication (Authentifizierungsbestätigung, an assertion or token) to the relying party. The VSF levels rate how well that confirmation is protected. This sub-model applies only to federated systems.
| VSF | Proof of possession | Authenticity | Confidentiality protection | Transmission form |
|---|---|---|---|---|
| 1 | Bearer (Überbringer) | Digital signature | None | Independent |
| 2 | Bearer | Digital signature | Encryption | Front channel |
| 2 | Bearer | Digital signature | None | Back channel |
| 3 | Verifiable by the RP (holder-of-key) | Digital signature | Encryption | Independent |
Two lessons are built into this table. First, a digital signature is the floor: even the lowest level requires that origin and integrity can be checked. Second, at level 2, a back channel is accepted as an alternative to encryption: if the assertion travels directly from IdP to RP over a protected server-to-server connection, it never passes through the browser where it could be read, so separate encryption of the assertion is not required.
Go deeper:
NIST SP 800-63C-4: Federation Assurance Level 3 — the US top level, which also requires holder-of-key or bound authenticators.