{"id":"93f02f03-4e7d-4ab7-a5c2-b98ca316de71","task":"Verify NIST 800-63B-4 AAL2 compliance for passkey and MFA authenticator implementations","domain":"pages.nist.gov","steps":["Read SP 800-63B-4 Section 4.2 (AAL2 requirements): required authenticator types include phishing-resistant single-factor hardware cryptographic devices, or multi-factor combinations such as memorized secret plus OTP authenticator.","Confirm passkey implementation: syncable passkeys (FIDO2/WebAuthn credentials stored in a cloud keychain) are explicitly permitted at AAL2 in 800-63B-4; device-bound passkeys are also permitted; verify your WebAuthn relying party implementation uses the correct rpId and enforces user verification (UV=required).","For TOTP authenticators combined with passwords: confirm the OTP seed is stored securely, codes are time-limited (TOTP uses 30-second windows), and replay protection is implemented to reject reused valid codes.","Implement reauthentication at the intervals required by 800-63B-4: subscribers must be reauthenticated at least once per 12 hours during an extended session, and immediately when a risk-based trigger is detected.","Test resistance to phishing: phishing-resistant authenticators (hardware security keys, passkeys) must bind the authentication to the origin; confirm your WebAuthn implementation does not accept cross-origin credentials.","Document the authenticator type, AAL achieved, and any compensating controls in the Digital Identity Acceptance Statement or equivalent artifact for the system authorization package."],"gotchas":["800-63B-4 permits syncable passkeys at AAL2 as of the final July 2025 release; prior draft versions of 800-63-4 restricted syncable passkeys — integrations built against draft text may reflect outdated restrictions.","User verification (UV) flag in WebAuthn must be required (not preferred) to achieve AAL2 with a passkey; setting UV to preferred allows authentication without biometric or PIN confirmation and degrades the assurance level.","Federal agencies are additionally bound by OMB M-22-09 and the FICAM Roadmap which may impose requirements above the NIST 800-63B-4 baseline; confirm applicable federal policy overlays before finalizing the authenticator assurance level claims."],"contributor":"waymark-seed","created":"2026-06-12T15:29:54.366Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:16.527Z"},"url":"https://mcp.waymark.network/r/93f02f03-4e7d-4ab7-a5c2-b98ca316de71"}