A risk assessment of the application (the relying party, RP) determines how good the identity it relies on has to be; the model then separates the quality of the authentication from the quality of the attributes.

A relying party is the service that consumes an identity: a tax portal, an online bank, a library login. Before choosing any technology, it asks what happens if this identity is wrong? A forged login to a library account is an annoyance; a forged login to a tax return or a health record is a serious harm. The answer to that question, the risk assessment (Risiko-Analyse), sets the required quality.

The quality model then looks at two separate things:

1. Quality of authentication (Qualität der Authentifizierung): how sure can the RP be that the person logging in really is the person the identity belongs to? This covers registration, the authenticator, the operator and, in a federation, the transport of the login confirmation.
2. Quality of attributes (Qualität der Attribute): how trustworthy are the data delivered about that person, such as name, date of birth, address or age?

They are distinct because a perfectly authenticated user can still carry a wrong, outdated or self-invented address, and a correct attribute is worthless if anyone can log in as that user.

Go deeper:

• Risk assessment (Wikipedia) — the general method of weighing likelihood and impact that feeds the choice of a level.

The level of assurance states how confident a relying party can be that a subject really owns the identity it claims; it is also called trust level (Vertrauensniveau) or security level (Sicherheitsniveau), but not "level of authentication".

To make quality easy to compare, it is sorted into a small number of steps, usually three or four trust levels (Vertrauensstufen). A service then simply demands "level 3 or higher" instead of listing every technical detail.

The crucial point is what the level is about: not how strong the login mechanism alone is, but how certain the RP can be that the subject behind the login is the real holder of the identity. That certainty depends on much more than the authenticator: how well the person was identified at registration, how the authenticator was handed over, how trustworthy the operator is, and how the result is passed on.

That is exactly why "level of authentication" is not a synonym, even though it abbreviates to LoA as well. It would suggest that only the login step counts. A hardware token handed to an unverified person still gives low assurance about who that person is.

Go deeper:

• EU eID: eIDAS Levels of Assurance — the European Commission's plain-language definition: how certain a service can be that it is really you.