Authenticator Binding
A core concept in the NIST digital identity framework referring to establishing a verifiable association between an authenticator, such as a hardware key, device, or authentication application, and a user account, and recording its registration state. In account recovery scenarios, a bound authenticator serves as a trust anchor, and presenting it demonstrates control over that authenticator.
Timeline (last 90 days)
Account recovery methods recognized by SP 800-63B-4 include four categories: recovery codes or backup codes, registered authenticators or devices, out-of-band communication channels, and human-assisted identity verification.
Authenticator binding refers to establishing a verifiable association between an authenticator and a user account and recording its registration status, typically involving public-key cryptography or device-side keys.
NIST requires that the recovery process verify a registered authenticator, rather than a newly introduced, unverified factor.
The suggested migration roadmap: inventory processes that depend on security questions, remove security questions from new user registration and guide users to set up recovery codes or bind authenticators, and prompt existing users to add recovery methods and set a transition period.
For products already using multi-factor authentication, migration resistance is lower, because registered authenticators and out-of-band channels often already exist and only need to be connected to the recovery flow; for products that have not yet established an authenticator system, recovery codes are the lowest-barrier entry point.
All Facts (5)
Account recovery methods recognized by SP 800-63B-4 include four categories: recovery codes or backup codes, registered authenticators or devices, out-of-band communication channels, and human-assisted identity verification.
50%UnverifiedAuthenticator binding refers to establishing a verifiable association between an authenticator and a user account and recording its registration status, typically involving public-key cryptography or device-side keys.
50%UnverifiedNIST requires that the recovery process verify a registered authenticator, rather than a newly introduced, unverified factor.
50%UnverifiedThe suggested migration roadmap: inventory processes that depend on security questions, remove security questions from new user registration and guide users to set up recovery codes or bind authenticators, and prompt existing users to add recovery methods and set a transition period.
50%UnverifiedFor products already using multi-factor authentication, migration resistance is lower, because registered authenticators and out-of-band channels often already exist and only need to be connected to the recovery flow; for products that have not yet established an authenticator system, recovery codes are the lowest-barrier entry point.
50%