What are the renewal and replacement levels CN1 to CN4 for authenticators?
CN1: renewal on presentation of the still-valid authenticator, new one delivered simply; CN2: same renewal, secure delivery; CN3: CN2 plus identification at IDN2, personal delivery; CN4: CN3 plus IE.d evidence validated at IV.d, hand-over in person (delivery level 4).
The questions: Under what conditions may a still-valid authenticator be renewed, or a revoked one replaced? How can it be guaranteed that the subject still exists and that their data (e.g. the address) are still correct?
| Level | Renewal / replacement | Delivery of the new authenticator |
|---|---|---|
| CN1 | Still-valid authenticator is shown when applying (simple replacement) | Simple (delivery level 1) |
| CN2 | As CN1 | Secure (level 2) |
| CN3 | CN2 plus identification at IDN2 | Personal (level 3) |
| CN4 | CN3 plus evidence of level IE.d presented and data validated at IV.d | Hand-over in person (level 4) |
The reason for a separate criterion: renewal is a backdoor. If an attacker can get a replacement card just by phoning in "I lost mine, please send a new one to my new address", all the effort spent on the original identification is bypassed. At the higher levels, the person must therefore be identified again to the same standard and receive the new authenticator just as securely as the first.