Electronic Authentication Guideline

By William E. Burr, Donna Dodson, Elaine M. Newton, Ray A. Perlner, W. Polk, Sarbari Gupta, Emad A. Nabbus. 2014

341 citations recorded by the source corpus.

This recommendation provides technical guidelines for Federal agencies implementing electronic authentication and is not intended to constrain the development or use of standards outside of this purpose. The recommendation covers remote authentication of users (such as employees, contractors, or private individuals) interacting with government IT systems over open networks. It defines technical requirements for each of four levels of assurance in the areas of identity proofing, registration, tokens, management processes, authentication protocols and related assertions. This publication supersedes NIST SP 800-63-1.

Subfields: Information Systems

View Paper: https://www.semanticscholar.org/paper/03a0803e2cc00106903e43a2f017ccb8009b3dc4

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

Citations in the corpus

Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms (2012, methodology): “, [10], [11]), and empirically analyzing the resulting passwords with password-guessing tools (e.”
Guessing human-chosen secrets (2012, methodology): “The estimator SNIST is calculated using the NIST entropy estimation formula [58].”
How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation (2012, background): “However, strict policies can lead to user frustration [29], and users may fulfill requirements in ways that are simple and predictable [6].”
A Study of Probabilistic Password Models (2014, background): “One such approach is NIST’s recommended scheme [7] for estimating the entropy of one password, which is mainly based on their length.”
The Tangled Web of Password Reuse (2014, background): “, NIST guidelines [25]) which may further increase guessing difficulty.”
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords (2012, methodology): “3 This usage was cemented by the 2006 FIPS Electronic Authentication Guideline [20], which provided a " rough rule of thumb " for estimating entropy from password 2 It is often suggested that users avoid characters which require multiple keys to type, but this doesn't seem to have been formally esta”
Optimizing password composition policies (2013, methodology): “Policies were initially developed without empirical data to support them, since such data was not available to policy designers [Burr et al. 2006].”
A survey of cyber security management in industrial control systems (2015, background): “Examples include NIST SP 800-41 [174] on firewalls and firewall policies, NIST SP 800-61 [39] on incident handling and NIST SP 800-63-2 [23] on remote user authentication.”
Zipf’s Law in Passwords (2017, neutral): “random generation [4], rule-based [5], entropy-based [6] and”