What does the authenticity criterion of VSF check for an authentication confirmation, and how is it met?

Whether origin and integrity of the confirmation are provable, the issuer is uniquely identifiable and cannot deny having issued it; the only accepted measure is a digital signature by the issuer, required at every VSF level.

The questions:

• Can the origin and integrity of the authentication confirmation be proven?
• Is the confirmation authentic?
• Is the issuer uniquely identifiable?
• Can the issuer deny having issued it (non-repudiation)?

There are two values: no measures, or measures to secure authenticity: a digital signature. Every VSF level requires the signature, so an unsigned assertion is not federation-grade at all.

The reason is simple: without a signature, anyone who can send data to the RP could fabricate an assertion that says "this is Alice, authenticated at level 4". The IdP signs with its private key, the RP checks with the IdP's public key obtained in advance, and any tampering on the way breaks the signature. Because only the IdP holds the private key, the signature also proves who issued it.

Go deeper:

• NIST SP 800-63C-4: Federation Assurance Level 1 — the signature over the assertion as the baseline requirement.