Page History

Why does the Profile reference ITU-T X.1254?

The REFEDS Multifactor Authentication Profile references ITU-T X.1254 as it references four different factors for authentication in a well described way.  Other frameworks define 3 factors, which is more limiting for implementors.  These four areas are:

• something an entity has (e.g., device signature, passport, hardware device containing a credential, private key);
• something an entity knows (e.g., password, PIN);
• something an entity is (e.g., biometric characteristic);
• something an entity typically does (e.g., behaviour pattern).

Please note that this reference is purely to the good definitions used by ITU-T X.1254 for authentication factors - there is no other relationship between the MFA Profile and this, or any other, assurance framework at this time.

How does the MFA Profile relate to (level) of assurance profiles?

Many assurance profiles will include approaches to MFA within them.  REFEDS Assurance Framework does not reference the REFEDS MFA Profile but is intended to work in parallel with this profile.