Authentication qualities

Authentication quality describes the result of the overall set of characteristics of a login process. It consists of the following dimensions:

Quality of the login factors used
Reliability of the identity verification, i.e. the degree of knowledge of the actual identity of the subject to whom the login factors were initially issued
Strength of the binding between dimension 1 and dimension 2

The resulting authentication quality is always determined by the weakest link. Dimension 3 (binding strength) is not considered further here, as an adequate binding strength is assumed in accordance with the Federal Administration’s ICT requirements.

Different requirements and models exist for classifying authentication quality. The Federal Administration’s ICT requirement I050 defines four Levels of Assurance (LoA). eCH-0170 V2.0.1 uses its own model with four levels of trust and the sub-models Authentication (VSA), Registration (VSR), Management (VSS) and Federation (VSF). In Annex B, Si001 uses a separate four-level classification for authentication and identity verification means. Si001 must therefore not be reduced to the technical quality of the login factor: at the «high» level, technical requirements apply to the authentication information; if the means is personal, the person must additionally be registered or the means of verification must be issued on the basis of an official identity document.

Based on I050, the following statements can be made regarding the LoAs:

LoA 1

Login factor: One login factor, which may be weak, typically a password.
Identity verification: None
FED-LOGIN: does not support LoA 1; the corresponding value on the eIAM QoA scale would be QoA 20.
AGOV: does not support LoA 1; there is no equivalent on the AGOV AGOVaq scale.

LoA 2

Login factor: Two login factors, which may be weak, e.g. password + SMS-mTAN.
Identity verification: None, possibly linked to an existing user record.
FED-LOGIN: no longer supports LoA 2; the corresponding value on the eIAM QoA scale would be QoA 30.
AGOV: corresponds to AGOVaq 100 and, where there is a delivery-verified link to the postal database, AGOVaq 200. AGOV also uses technically strong login factors at these levels, whose technical properties meet the technical requirements of Si001 Annex B for the «high» level. However, with AGOVaq 100/200, no person binding based on an official identity document within the meaning of Si001 Annex B has yet been established. The technical strength of the login factor alone therefore constitutes neither the complete Si001 «high» level for a personal means nor I050 LoA 3.

LoA 3

Login factor: Technically strong. The login factors permitted by AGOV meet the technical requirements that Si001 Annex B imposes on authentication information at the «high» level.
Person binding / identity verification: With AGOV, from AGOVaq 300 onwards, the person binding additionally required by Si001 Annex B for a personal authentication and identity verification means is established. The person is verified using an official identity document and the verification result is assigned to the authenticated AGOV account. AGOV / I050: all AGOVaq levels from 300 onwards correspond, according to the eIAM mapping, to I050 LoA 3 and therefore to eIAM QoA 50.
FED-LOGIN: supports LoA 3; this corresponds to eIAM QoA 50. FED-LOGIN LoA 3 can already be achieved using the FED-Login Access App or a FIDO key in combination with online identification (see bit.ly/smartcardless). IMPORTANT: FED-LOGIN Kerberos does not achieve LoA 3, aka QoA 50 (dimension 1 and dimension 2 are insufficient), and is mapped to QoA 40.
AGOV: All AGOVaq levels from 300 onwards correspond to LoA 3 according to I050, i.e. eIAM QoA 50.

LoA 4

Si001 «high+»: The «high+» level according to Si001 Annex B is not a property of the login factor alone. The authentication and identity verification means must meet all requirements of the «high» level; in addition, the hardware module and the underlying registration process must be recognised for use within the Federal Administration.
Identity verification: Substantial and specifically certified.
FED-LOGIN: supports LoA 4, but without using a Holder of Key; this corresponds to eIAM QoA 60. Principle: applications connected to eIAM should never enforce QoA 60, but at most QoA 50 (UX).
AGOV: does not support LoA 4.