Digital identity guidelines: authentication and lifecycle management
Open accessAbstract
This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283.NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems.This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Mathematical Theory of Communication
Binder, M. D., Hirokawa, N., & Windhorst, U. (2008) · Springer eBooks · doi:10.1007/978-3-540-29678-2_3338 · Cited by 2,297 · see citing works
The Transport Layer Security (TLS) Protocol Version 1.2
Dierks, T., & Rescorla, E. K. (2008) · doi:10.17487/rfc5246 · Cited by 1,577 · see citing works
X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP
Santesson, S., Myers, M., Ankney, R., Malpani, A., Galperin, S., & Adams, C. M. (2013) · doi:10.17487/rfc6960 · Cited by 804 · see citing works
Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Cooper, D., Santesson, S., Farrell, S., et al. (2008) · Request for Comments · doi:10.17487/rfc5280 · Cited by 793 · see citing works
SHA-3 standard: permutation-based hash and extendable-output functions
National Institute of Standards and Technology (US) (2015) · doi:10.6028/nist.fips.202 · Cited by 783 · see citing works
Testing metrics for password creation policies by attacking large sets of revealed passwords
Weir, M., Aggarwal, S., Collins, M., & Stern, H. (2010) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1866307.1866327 · Cited by 425 · see citing works
Kelley, P. G., Komanduri, S., Mazurek, M. L., Shay, R., Vidas, T. M., Bauer, L., Christin, N., Cranor, L. F., & Lopez, J. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.38 · Cited by 413 · see citing works
TOTP: Time-Based One-Time Password Algorithm
M’Raïhi, D., Machani, S., Pei, M., et al. (2011) · doi:10.17487/rfc6238 · Cited by 343 · see citing works
Recommendation for block cipher modes of operation :
Dworkin, M. J. (2005) · doi:10.6028/nist.sp.800-38b-2005 · Cited by 316 · see citing works
Recommendation for random number generation using deterministic random bit generators
Barker, E. B., & Kelsey, J. M. (2012) · doi:10.6028/nist.sp.800-90a · Cited by 309 · see citing works
Recommendation for Random Number Generation Using Deterministic Random Bit Generators
Barker, E. B., & Kelsey, J. M. (2015) · doi:10.6028/nist.sp.800-90ar1 · Cited by 304 · see citing works
A Research Agenda Acknowledging the Persistence of Passwords
Herley, C., & van Oorschot, P. C. (2011) · IEEE Security & Privacy · doi:10.1109/msp.2011.150 · Cited by 281 · see citing works
Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths
Barker, E. B., & Roginsky, A. L. (2015) · doi:10.6028/nist.sp.800-131ar1 · Cited by 191 · see citing works
From Very Weak to Very Strong: Analyzing Password-Strength Meters
de Carnavalet, X. D. C., & Mannan, M. (2014) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2014.23268 · Cited by 162 · see citing works
Transport layer security (TLS)
Heinrich, C. (2006) · Springer eBooks · doi:10.1007/0-387-23483-7_435 · Cited by 162 · see citing works
Recommendation for block cipher modes of operation :
Dworkin, M. J. (2015) · doi:10.6028/nist.sp.800-38b · Cited by 114 · see citing works
An introduction to privacy engineering and risk management in federal systems
Brooks, S., Garcia, M. E., Lefkovitz, N. B., Lightman, S., & Nadeau, E. M. (2017) · doi:10.6028/nist.ir.8062 · Cited by 101 · see citing works
Self-citationKelley, P. G., Komanduri, S., Mazurek, M. L., et al. (2011) · doi:10.21236/ada570747 · Cited by 84 · see citing works
Sheffer, Y., Holz, R., & Saint-Andre, P. (2015) · doi:10.17487/rfc7525 · Cited by 81 · see citing works
Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks
Boneh, D., Corrigan-Gibbs, H., & Schechter, S. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-53887-6_8 · Cited by 64 · see citing works
ASCII format for network interchange
Cerf, V. G. (1969) · doi:10.17487/rfc0020 · Cited by 53 · see citing works
Digital identity guidelines: enrollment and identity proofing
Grassi, P. A., Fenton, J. L., Lefkovitz, N. B., et al. (2017) · doi:10.6028/nist.sp.800-63a · Cited by 51 · see citing works
Self-citationPolk, W. T., McKay, K. A., & Chokhani, S. (2014) · doi:10.6028/nist.sp.800-52r1 · Cited by 49 · see citing works
Password Creation in the Presence of Blacklists
Habib, H., Colnago, J., Melicher, W., et al. (2017) · doi:10.14722/usec.2017.23043 · Cited by 28 · see citing works
Digital identity guidelines: federation and assertions
Grassi, P. A., Richer, J. P., Squire, S. K., et al. (2017) · doi:10.6028/nist.sp.800-63c · Cited by 23 · see citing works
Self-citationExecutive Order 13681: Improving the Security of Consumer Financial Transactions
Obama, B. (2014) · United States. Office of the Federal Register · Cited by 1 · see citing works
Flagged first, then by citations
Research works printed but not linked: 1
- [14]14. Komanduri, Saranga, Richard Shay, Patrick Gage Kelley, Michelle L Mazurek, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Serge Egelman. "Of Passwords and People: Measuring the Effect of Password-Composition Policies." In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, 2595-2604. ACM, 2011. Available at: https://www.ece.cmu.edu/~lbauer/papers/2011/chi2011-passwords.pdf.
Cited by
Sorted by citations
Zero Trust Architecture (ZTA): A Comprehensive Survey
Syed, N. F., Shah, S. W., Shaghaghi, A., Anwar, A., Baig, Z., & Doss, R. (2022) · IEEE Access · doi:10.1109/access.2022.3174679 · Cited by 406 · see citing works
Securing IIoT using Defence-in-Depth: Towards an End-to-End secure Industry 4.0
Mosteiro-Sanchez, A., Barcelo, M., Astorga, J., & Urbieta, A. (2020) · Journal of Manufacturing Systems · doi:10.1016/j.jmsy.2020.10.011 · Cited by 64 · see citing works
An Extensive Formal Analysis of Multi-factor Authentication Protocols
Jacomme, C., & Kremer, S. (2021) · ACM Transactions on Privacy and Security · doi:10.1145/3440712 · Cited by 51 · see citing works
Context-Aware Multimodal FIDO Authenticator for Sustainable IT Services
Kim, S.-H., Choi, D., Kim, S.-H., Cho, S., & Lim, K.-S. (2018) · Sustainability · doi:10.3390/su10051656 · Cited by 8 · see citing works
- Authors
- Grassi, P. A., Fenton, J. L., Newton, E. M., Perlner, R. A., Regenscheid, A. R., Burr, W. E., Richer, J. P., Lefkovitz, N. B., Danker, J. M., Choong, Y.-Y., Greene, K. K., & Theofanos, M. F.
- Affiliations
- National Institute of Standards and Technology (US)
- Corresponding author
- Burr, William E
- ORCID
- Published
- 2017-06-22
- OpenAlex
- W2680793898
- Semantic Scholar
- 68ad35ab045eb7140f34ef374c0e640146c5028f
- Cited by
- 261
- References
- 27
- Citations by year
- 2026: 27 · 2025: 28 · 2024: 28 · 2023: 32 · 2022: 34 · 2021: 32 · 2020: 27 · 2019: 27 · 2018: 17 · 2017: 7 · 2015: 1 · 2013: 1
- Type
- report
- Language
- en
- Open access
- gold
- doi.org
- Funders
- Information Technology Laboratory
- Topics
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Keywords
- digital identity, authentication, identity lifecycle management, identity management, identity and access management, information security standards, FISMA, federal information systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
