Process Transition for the Decommissioning of Vasco Tokens in CH-LOGIN

Variants regarding the nationwide abolition of Vasco tokens.

1. The user must use cryptographically hardened login factors (credentials).
   
2. The user's real identity must be substantially verified based on an official photo ID and facial recognition.
   
3. There must be a reliable link between the substantial identity verification and the login factor; the login factor must be directly involved in the verification process.

Login methods in the federal administration capable of supporting LoA3 include:

1. FED-LOGIN for employees and affiliates
   
2. AGOV for non-employees (replacing CH-LOGIN)
   
3. Logins via the so-called A3 server

Vasco tokens — also known as One-Time Passwords (OTP) — will soon be phased out within the federal administration, along with the A3 server.

It explains how the identity verification procedures associated with Vasco tokens - also referred to as identity clarification - work, and how they can be transitioned to other identity verification methods that do not rely on Vasco tokens.

Vasco tokens are small, battery-operated devices about the size of a lighter that periodically display a new number on their screen. This number is a One-Time Password used as a login factor.

The identity verification process involving Vasco tokens is based on the physical handover of the token to a person whose official ID is checked and facial features compared. This process may also be delegated to Swiss Post.

Vasco tokens are owned by the application provider (in this case, the federal administration) and issued to the end user. Once Vasco tokens are discontinued, this handover and verification process is no longer possible, as end users must bring their own login factors (e.g., FIDO keys, smartphones with access apps — not to be confused with Google/Microsoft Authenticator apps — or smartphones with the Swiss e-ID).

Let us summarize the soon-to-be-deprecated Vasco-token-based identity verification process. This example assumes an in-person, on-site procedure, also known as the RIO process. RIO stands for Registration Identification Officer.

The end user visits a Registration Identification Officer, who checks their official ID and facial features, registers the data, hands over a Vasco token linked to a login account, and assigns application permissions. Variants of this process exist (e.g., delegation to Swiss Post) and produce the same result.

The new token-free identity verification processes are as follows:

Characteristic a): The user does not yet have an AGOV account. One is created on-site. Ideally, the RIO issues a FIDO token to avoid requiring the user to bring one or use their phone (though phones can be added later as additional tokens). The AGOV account is initially unverified. The RIO then checks the ID documents, scans and uploads them via the "AGOV counter" app. The account is now verified (i.e., AGOVaq300 / eIAM QoA50 / eCH0170 LoA3), and the RIO may assign application rights as before.

Characteristic b): The user already has an AGOV account. The RIO process is initiated (in-person ID check), and proceeds as in Variant a).

In this variant, AGOV identity data is trusted, and the target application must enforce that the identity is at least AGOVaq300. Verification methods can include video ID, Swiss Post's BmID, or the Swiss e-ID via AGOV. On first access, the user sees an online request form which is forwarded — along with verified identity data — to the authorized person (e.g., the Registration Identification Officer). No ID copy is transmitted; it was previously submitted to the Federal Chancellery during AGOVaq300 and is only released upon request by a Swiss public prosecutor. When using the e-ID via AGOV, identity data is referenced from Fedpol rather than the Federal Chancellery.

For institutions wishing to stay as close as possible to the traditional Vasco-based RIO process, variant 1 ("Classic RIO") and its virtual version variant 2 ("RIO Federal Proof") are the most appropriate.