Document ID: chunk:federal_register_of_legislation:F2024L01435:reg:8
Version: federal_register_of_legislation:F2024L01435
Segment Type: reg
Provision Reference: reg 8
Character Range: 46517–48863

8          AL level to be combined with an identity proofing level  IP1                                                                                                                    Identity proofing levels up to and including IP3.                                                                                                                                               All identity proofing levels

Division 2—Binding authenticators to a digital ID

3.2  Binding an authenticator when generating a digital ID
 (1) For remote transactions where generating the digital ID and binding of the authenticator to that digital ID cannot be completed in a single electronic transaction that is a single protected session:
 (a) individuals must identify themselves in the binding transaction by presenting a temporary secret which was either established during a prior transaction or sent to the individual's mobile phone number or email address (temporary secret); and
 (b) long-term authentication secrets must be issued to an individual only within a protected session.
Note: Generating the digital ID and binding of the authenticator may not be completed in a single electronic transaction that is a single protected session where the identity proofing is conducted online and the individual is required to collect a physical item such as a lookup secret.
 (2) For in-person transactions where the generation of the digital ID and binding of an authenticator to that digital ID cannot be completed in a single physical encounter within a single protected session:
 (a) individuals must identify themselves in-person by either presenting a temporary secret, or by biometric authentication;
 (b) temporary secrets must not be reused; and
 (c) if the ISP issues long-term authentication secrets during an in‑person transaction, those secrets must be loaded locally on to a physical device that is issued in-person to the individual or delivered in a manner that confirms the individual's email address or mobile phone number.

Division 3—Standards for kinds of authenticators

3.3  Memorised secrets
  For memorised secrets, the standards in the following table apply.

Standards for memorised secrets
Item                             Requirements—If:                                                                            the standard is: