Document ID: chunk:federal_register_of_legislation:F2024L01435:reg:1
Version: federal_register_of_legislation:F2024L01435
Segment Type: reg
Provision Reference: reg 1
Character Range: 88568–90545

1                                    Phishing resistance (when authenticating to AL3):                          1.      an authenticator is not phishing resistant if it involves the manual entry of an authentication output, such as out-of-band and OTP authenticators;
                                                                                                                1.     the phishing resistant authentication protocol must:
                                                                                                                    (i) establish an authenticated protected channel with the entity's information technology system; and
                                                                                                                    (ii) strongly and irreversibly bind a channel identifier that was negotiated in establishing the authenticated protected channel to the authentication output;
                                                                                                                        Note: The binding may occur by signing the 2 values together using a private key (the cryptographic key in an asymmetric cryptographic key pair that must be kept secret) controlled by the individual for which the public key is known to the entity.
                                                                                                                1.      the ISP's information technology system must validate the signature or other information used to prove phishing resistance;
                                                                                                                2.     an AACA must be used to establish phishing resistance; and
                                                                                                                3.      cryptographic keys for the purpose of establishing phishing resistance must provide at least 112 bits of effective security strength.