What are the re-authentication levels ReAuth1 to ReAuth4 in eCH-0170?
ReAuth1: after an adequate period (e.g. 30 days); ReAuth2: at the latest after 18 h, one factor is enough; ReAuth3: at the latest after 12 h, all factors; ReAuth4: at the latest after 30 min, all factors in exactly the same way as initially.
| Level | Maximum time until the IdP must authenticate again | What the re-authentication must include |
|---|---|---|
| ReAuth1 | An adequate period, e.g. 30 days | Not further specified |
| ReAuth2 | 18 hours, regardless of activity | One authentication factor is sufficient |
| ReAuth3 | 12 hours | All authentication factors must be taken into account |
| ReAuth4 | 30 minutes | All factors, applied in exactly the same way as at the initial authentication |
The difference between ReAuth3 and ReAuth4 is subtle but important. At ReAuth3 the system may, for example, cache the PIN and only check that the hardware token is still present. At ReAuth4 nothing may be cached: the token must be detected and the PIN typed again, just as at the first login.
For comparison, NIST SP 800-63B-4 recommends an overall timeout of at most 30 days at AAL1, 24 hours (plus 1 hour inactivity) at AAL2, and requires an overall timeout of at most 12 hours at AAL3 (with an inactivity timeout of at most 15 minutes recommended).
Go deeper:
NIST SP 800-63B-4: AAL3 reauthentication — the 12-hour overall and 15-minute inactivity limits.- OWASP Session Management Cheat Sheet: session expiration — idle and absolute timeouts in practice.