IA-5 — Authenticator Management

Password-based authentication applies to passwords regardless of whether they are used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.

1. IA-05(01)(a)for password-based authentication, a list of commonly used, expected, or compromised passwords is maintained and updated [Organization-defined: frequency] and when organizational passwords are suspected to have been compromised directly or indirectly;
2. IA-05(01)(b)for password-based authentication when passwords are created or updated by users, the passwords are verified not to be found on the list of commonly used, expected, or compromised passwords in IA-05(01)(a);
3. IA-05(01)(c)for password-based authentication, passwords are only transmitted over cryptographically protected channels;
4. IA-05(01)(d)for password-based authentication, passwords are stored using an approved salted key derivation function, preferably using a keyed hash;
5. IA-05(01)(e)for password-based authentication, immediate selection of a new password is required upon account recovery;
6. IA-05(01)(f)for password-based authentication, user selection of long passwords and passphrases is allowed, including spaces and all printable characters;
7. IA-05(01)(g)for password-based authentication, automated tools are employed to assist the user in selecting strong password authenticators;
8. IA-05(01)(h)for password-based authentication, [Organization-defined: composition and complexity rules] are enforced.

Public key cryptography is a valid authentication mechanism for individuals, machines, and devices. For PKI solutions, status information for certification paths includes certificate revocation lists or certificate status protocol responses. For PIV cards, certificate validation involves the construction and verification of a certification path to the Common Policy Root trust anchor, which includes certificate policy processing. Implementing a local cache of revocation data to support path discovery and validation also supports system availability in situations where organizations are unable to access revocation information via the network.

1. IA-05(02)(a)
   1. IA-05(02)(a)(01)authorized access to the corresponding private key is enforced for public key-based authentication;
   2. IA-05(02)(a)(02)the authenticated identity is mapped to the account of the individual or group for public key-based authentication;
2. IA-05(02)(b)
   1. IA-05(02)(b)(01)when public key infrastructure (PKI) is used, certificates are validated by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information;
   2. IA-05(02)(b)(02)when public key infrastructure (PKI) is used, a local cache of revocation data is implemented to support path discovery and validation.

Changing authenticators prior to the delivery and installation of system components extends the requirement for organizations to change default authenticators upon system installation by requiring developers and/or installers to provide unique authenticators or change default authenticators for system components prior to delivery and/or installation. However, it typically does not apply to developers of commercial off-the-shelf information technology products. Requirements for unique authenticators can be included in acquisition documents prepared by organizations when procuring systems or system components.

developers and installers of system components are required to provide unique authenticators or change default authenticators prior to delivery and installation.

For systems that contain multiple security categories of information without reliable physical or logical separation between categories, authenticators used to grant access to the systems are protected commensurate with the highest security category of information on the systems. Security categories of information are determined as part of the security categorization process.

authenticators are protected commensurate with the security category of the information to which use of the authenticator permits access.

In addition to applications, other forms of static storage include access scripts and function keys. Organizations exercise caution when determining whether embedded or stored authenticators are in encrypted or unencrypted form. If authenticators are used in the manner stored, then those representations are considered unencrypted authenticators.

unencrypted static authenticators are not embedded in applications or other forms of static storage.

When individuals have accounts on multiple systems and use the same authenticators such as passwords, there is the risk that a compromise of one account may lead to the compromise of other accounts. Alternative approaches include having different authenticators (passwords) on all systems, employing a single sign-on or federation mechanism, or using some form of one-time passwords on all systems. Organizations can also use rules of behavior (see [PL-4](#pl-4) ) and access agreements (see [PS-6](#ps-6) ) to mitigate the risk of multiple system accounts.

[Organization-defined: security controls] are implemented to manage the risk of compromise due to individuals having accounts on multiple systems.

Federation provides organizations with the capability to authenticate individuals and devices when conducting cross-organization activities involving the processing, storage, or transmission of information. Using a specific list of approved external organizations for authentication helps to ensure that those organizations are vetted and trusted.

[Organization-defined: external organizations] are used to federate credentials.

Authentication requires some form of binding between an identity and the authenticator that is used to confirm the identity. In conventional approaches, binding is established by pre-provisioning both the identity and the authenticator to the system. For example, the binding between a username (i.e., identity) and a password (i.e., authenticator) is accomplished by provisioning the identity and authenticator as a pair in the system. New authentication techniques allow the binding between the identity and the authenticator to be implemented external to a system. For example, with smartcard credentials, the identity and authenticator are bound together on the smartcard. Using these credentials, systems can authenticate identities that have not been pre-provisioned, dynamically provisioning the identity after authentication. In these situations, organizations can anticipate the dynamic provisioning of identities. Pre-established trust relationships and mechanisms with appropriate authorities to validate identities and related credentials are essential.

identities and authenticators are dynamically bound using [Organization-defined: binding rules].

Unlike password-based authentication, which provides exact matches of user-input passwords to stored passwords, biometric authentication does not provide exact matches. Depending on the type of biometric and the type of collection mechanism, there is likely to be some divergence from the presented biometric and the stored biometric that serves as the basis for comparison. Matching performance is the rate at which a biometric algorithm correctly results in a match for a genuine user and rejects other users. Biometric performance requirements include the match rate, which reflects the accuracy of the biometric matching algorithm used by a system.

mechanisms that satisfy [Organization-defined: biometric quality requirements] are employed for biometric-based authentication.

Cached authenticators are used to authenticate to the local machine when the network is not available. If cached authentication information is out of date, the validity of the authentication information may be questionable.

the use of cached authenticators is prohibited after [Organization-defined: time period].

An organization-wide methodology for managing the content of PKI trust stores helps improve the accuracy and currency of PKI-based authentication credentials across the organization.

an organization-wide methodology for managing the content of PKI trust stores is employed across all platforms, including networks, operating systems, browsers, and applications for PKI-based authentication.

General Services Administration (GSA)-approved products and services are products and services that have been approved through the GSA conformance program, where applicable, and posted to the GSA Approved Products List. GSA provides guidance for teams to design and build functional and secure systems that comply with Federal Identity, Credential, and Access Management (FICAM) policies, technologies, and implementation patterns.

only General Services Administration-approved products and services are used for identity, credential, and access management.

Issuing authenticators in person or by a trusted external party enhances and reinforces the trustworthiness of the identity proofing process.

the issuance of [Organization-defined: types of and/or specific authenticators] is required to be conducted [Organization-defined: ia-05.16_odp.02] before [Organization-defined: registration authority] with authorization by [Organization-defined: personnel or roles].

Biometric characteristics do not constitute secrets. Such characteristics can be obtained by online web accesses, taking a picture of someone with a camera phone to obtain facial images with or without their knowledge, lifting from objects that someone has touched (e.g., a latent fingerprint), or capturing a high-resolution image (e.g., an iris pattern). Presentation attack detection technologies including liveness detection, can mitigate the risk of these types of attacks by making it difficult to produce artifacts intended to defeat the biometric sensor.

presentation attack detection mechanisms are employed for biometric-based authentication.

For systems where static passwords are employed, it is often a challenge to ensure that the passwords are suitably complex and that the same passwords are not employed on multiple systems. A password manager is a solution to this problem as it automatically generates and stores strong and different passwords for various accounts. A potential risk of using password managers is that adversaries can target the collection of passwords generated by the password manager. Therefore, the collection of passwords requires protection including encrypting the passwords (see [IA-5(1)(d)](#ia-5.1_smt.d) ) and storing the collection offline in a token.

1. IA-05(18)(a)[Organization-defined: password managers] are employed to generate and manage passwords;
2. IA-05(18)(b)the passwords are protected using [Organization-defined: controls].