What does the confidentiality criterion of VSF protect against, and how?

It prevents unauthorised third parties from reading the information in the authentication confirmation; it is met by encrypting the confirmation (otherwise: no encryption).

The question: Is the authentication confirmation protected so that unauthorised third parties cannot see the information it contains? The values: no encryption or encryption.

An assertion often carries more than "authenticated: yes". It may contain the user's name, e-mail, date of birth, a social security number or role information. If it travels through the browser in plain form, it can end up in browser history, logs, proxies or the hands of a malicious script. Encrypting it for the RP means only the intended recipient can read the contents, even if it passes through untrusted hands.

Note the difference from authenticity: a signature lets anyone read the assertion but nobody change it; encryption lets nobody else read it. VSF1 has the first only; VSF2 adds the second (or avoids the exposure by using a back channel).

Go deeper:

• NIST SP 800-63C-4: Front-channel presentation — why assertions passing through the user agent risk leaking personal information.