Which kinds of criteria feed into the quality of authentication, and why is it not enough to look only at technical aspects?
Criteria from definition time (registration and identification), from runtime (the authentication itself), from the IAM topology (federation) and organisational and legal rules; technology alone says nothing about who was registered, who runs the system and who is liable.
| Phase or area | Example question |
|---|---|
| Definition time (Definitionszeit) | Was the person's identity checked against a real document when the account was created? |
| Runtime (Laufzeit) | Is the login done with one factor or with hardware-based multi-factor authentication? |
| IAM topology | If an identity provider passes the login result on to another service, is that confirmation signed, encrypted, bound to the holder? |
| Organisation and law | Is the operator audited? Who pays if something goes wrong? |
A purely technical view breaks down quickly. The strongest smartcard is useless if it was mailed to a self-declared address without anyone checking the applicant's ID: an attacker who registers under a false name gets a perfect authenticator for a fake identity. Equally, a technically sound system run by an operator with no supervision, no defined processes and no liability gives a relying party nothing to fall back on when an incident happens. Assurance is a chain of technical, organisational and legal links, and every link counts.
Go deeper:
NIST SP 800-63-4: Assurance level descriptions — how identity proofing, authentication and federation are rated separately.