Which questions does the authenticator criterion of VSA ask, and what does "one-time authentication after online identification" mean?

It asks whether the authenticator can only be used under the control or in the possession of its owner, whether it resists duplication and forgery by third parties, and whether the owner can reliably protect it from use by others; a one-time authentication after online identification is rated by the strength of that identification (the registration level) because there is no lasting authenticator.

The three questions behind the criterion:

1. Control or possession: can only the rightful subject use it? A password can be told to anyone; a smartcard needs the physical card plus its PIN.
2. Duplication and forgery: can a third party copy it? A password can be phished and replayed; a key in a secure chip cannot be extracted.
3. Protectability: is it designed so the owner can keep others from using it? A PIN-protected card can be locked away; a code printed on a list left on a desk cannot.

Two ways of authenticating are distinguished:

• Regular authentication: the subject uses an authenticator issued earlier, again and again (rated SFA, MFA, HW-MFA).
• One-time authentication after online identification: the subject is identified online (for example by a video identification) and then gets access once, without any lasting authenticator. Here the only thing that vouches for the person is that identification, so the authentication level follows the identification level IDN1 to IDN4, which is the registration criterion (VSR).

Go deeper:

• Multi-factor authentication: authentication factors (Wikipedia) — knowledge, possession and inherence, and why each resists different attacks.