Document ID: chunk:federal_register_of_legislation:F2024L01435:reg:6
Version: federal_register_of_legislation:F2024L01435
Segment Type: reg
Provision Reference: reg 6
Character Range: 80146–84677

6                                  The entity's information technology system;                                                                                                                                                                   must, depending on the type of out-of-band device:
                                                                                                                                                                                                                                                  1.      transfer the secret to the primary channel as follows:
                                                                                                                                                                                                                                                      (i) signal the device containing the individual's authenticator to indicate readiness to authenticate;
                                                                                                                                                                                                                                                      (ii) after transmitting such signal, transmit a random authentication secret to the out-of-band device; and
                                                                                                                                                                                                                                                      (iii) wait for the random authentication secret to be returned on the primary communication channel; or
                                                                                                                                                                                                                                                  1.     transfer the secret to the secondary channel as follows:
                                                                                                                                                                                                                                                      (i) display a random authentication secret to the individual via the primary channel; and
                                                                                                                                                                                                                                                      (ii) wait for the random authentication secret to be returned on the secondary channel from the individual's out-of-band device; or
                                                                                                                                                                                                                                                    1.      obtain verification of secrets from the individual as follows:
                                                                                                                                                                                                                                                      (i) displays a random authentication secret to the individual via the primary channel;
                                                                                                                                                                                                                                                      (ii) sends the same random authentication secret to the out-of-band device via the secondary channel for presentation to the individual; and
                                                                                                                                                                                                                                                      (iii) after transmitting the random authentication secret referred to in subparagraphs (c)(i) and (ii), wait for an approval (or disapproval) message via the secondary channel; and
                                                                                                                                                                                                                                                    1.     for each option in this item, the authentication must be considered invalid if each of the required activities are not completed within 10 minutes.