What do the two variants of delivery level 4, 4a with an activation process and 4b hand-over in person, require?
4a: the authenticator may reach only the right subject; digital delivery needs a secure channel and a receipt confirmation; activation is time-limited (max. 10 minutes for a digital activation code, 7 days for domestic post, 21 days for foreign post); the address is taken from valid evidence and checked. 4b: the authenticator is handed directly to the physically present subject by a CSP-authorised office, which verifies identity by comparing physical features with suitable evidence (strong validation IV.c), and receipt is acknowledged.
Both build on level 3 (personal delivery).
Level 4a, with activation process:
- The authenticator must (not just should) reach only the right subject.
- Digital delivery: a secure channel, and the subject or an authorised representative must confirm receipt.
- The activation process is valid only for a limited time: 10 minutes if the activation code is delivered digitally, 7 days for post within the country, 21 days for post abroad.
- The address is taken from valid evidence and verified.
The time limits shrink the window in which an intercepted letter or code is useful to an attacker; once it expires, the card or code is dead. NIST uses the same idea for recovery codes (10 minutes by text message, 21 days by post within the contiguous US).
Level 4b, hand-over in person (eigenhändige Übergabe):
- The authenticator is handed directly to the physically present subject by an office authorised by the credential service provider (CSP).
- Identity is checked by comparing physical features with suitable evidence (strong validation, IV.c).
- The receipt is acknowledged (signed for).
4a protects the delivery route; 4b removes the route entirely.