What is the difference between a bearer assertion and a holder-of-key (HoK) assertion?
Whoever presents a bearer assertion is accepted; a holder-of-key assertion is bound to a cryptographic key, and the RP accepts it only from the party that proves possession of that key, so a stolen assertion is useless.
* A bearer token works like cash; a holder-of-key token works like a cheque made out to a named, key-holding party. *
The criterion asks: Does the confirmation identify the subject well enough? Does it securely represent the referenced subject (the subscriber)? Is there protection against impersonation? Is the party presenting it really the subject that authenticated before?
- Bearer (B): like a cinema ticket. The RP checks that the assertion is genuine (signature) and valid, but not who brings it. Anyone who steals it in transit, from a log file or through a malicious script can replay it and impersonate the user.
- Holder-of-key (HoK): the assertion contains a reference to a key (for example a client certificate) belonging to the legitimate user. The RP checks that the presenter proves possession of the matching private key, typically through a TLS handshake. An attacker who copies the assertion still lacks the private key, so the RP rejects it.
This proof of possession is why only HoK reaches the top federation level (VSF3).
Go deeper:
NIST SP 800-63C-4: Bearer assertions — why possession of a bearer assertion is enough to impersonate.- RFC 8705: OAuth 2.0 Mutual-TLS and certificate-bound access tokens — the same holder-of-key idea applied to OAuth tokens.
- RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP) — sender-constrained tokens bound to an application-level key.