What is ISO/IEC 29115, and how does it relate to the European eIDAS regulation?

ISO/IEC 29115, the Entity Authentication Assurance Framework, defines four levels of entity authentication assurance (LoA 1 to 4) and was one of the foundations on which the eIDAS assurance levels were built.

ISO/IEC 29115 is the international, technology-neutral framework for rating how much confidence an authentication deserves. Like the Swiss model it looks at the whole lifecycle, not only the login: enrolment (identity proofing), management of the credential, the authentication itself, and the organisation running it.

Its four levels run from LoA1 (little or no confidence in the claimed identity) to LoA4 (very high confidence). When the EU drafted the eIDAS regulation, it drew on this framework (and on the earlier EU STORK project), but condensed the scale to three levels: low, substantial and high. Because the Swiss eCH-0170 model also uses four levels, it lines up one-to-one with ISO 29115 (VS1 to LoA1 up to VS4 to LoA4), while the eIDAS mapping needs some judgement.

Tip: Four levels: ISO 29115 and eCH-0170. Three levels: eIDAS (low, substantial, high) and NIST (1 to 3 per dimension).