Fireside Chat: A discussion about draft NIST 800-63-4 and all things digital identity
summary
Draft NIST 800-63-4 collects over 2,000 recent comments on top of ~4,000 earlier ones and keeps a controversial 8-character minimum for passwords while adding concrete guidance for syncable passkeys and attestation. The draft splits identity proofing, authentication, and federation guidance, separates general purpose IdPs from wallets/verifiable credentials, and publishes an attribute validation list. It treats passkeys with user verification as multi-factor for many flows and flags migration to post-quantum signatures and key establishment.
AI-written summary · about
chapters (12)
- 0:00Introduction and welcome
- 1:06NIST 800-63-4 public comments
- 4:41Passkeys and multi-factor authentication
- 7:08Phishing-resistant adoption challenges
- 10:59Verifiable credentials and wallets
- 13:28Phishing-resistant authentication focus
- 16:16Redefining MFA and security flows
- 17:18Identity provider flexibility
- 18:22Q&A session begins
- 21:17Attribute validation and identity proofing
- 23:21Managing complexity in 800-63
- 25:29Closing remarks
related talks
22mUpdate on NIST's digital identity guidelines
22mKeynote, Identity & Authentication in ePromiseland
40mDigital Identities - 21 PKI Pitfalls and How Best to Avoid Them
30mInsecurity protocols: an overview of modern authentication
40mAre You Really You? Higher Assurance Identity Proofing to the Rescue!
27mWeb 3 Reshape Authentication
30mPanel Discussion: Decentralized Identity Deep Dive - Advances in Trust, Security and Scalability
47mPasswords are so 1990