ANSI X9.117–2020 Mutual Authentication for Secure Remote Access
Total Page:16
File Type:pdf, Size:1020Kb
This is a preview of "ANSI X9.117-2020". Click here to purchase the full version from the ANSI store. American National Standard for Financial Services ANSI X9.117–2020 Mutual Authentication for Secure Remote Access Developed by Accredited Standards Committee X9, Incorporated Financial Industry Standards Date Approved: January 23, 2020 American National Standards Institute American National Standards, Technical Reports and Guides developed through the Accredited Standards Committee X9, Inc., are copyrighted. Copying these documents for personal or commercial use outside X9 membership agreements is prohibited without express written permission of the Accredited Standards Committee X9, Inc. For additional information please contact ASC X9, Inc., 275 West Street, Suite 107, Annapolis, MD 21401. This is a preview of "ANSI X9.117-2020". Click here to purchase the full version from the ANSI store. ANSI X9.117–2020 This page left intentionally blank ii © 2020 ASC X9, Inc. – All rights reserved This is a preview of "ANSI X9.117-2020". Click here to purchase the full version from the ANSI store. ANSI X9.117–2020 Contents Page Mutual Authentication for Secure Remote Access ........................................................................................... 1 1 Scope ...................................................................................................................................................... 1 2 Purpose .................................................................................................................................................. 1 3 Normative References ........................................................................................................................... 2 4 Terms and definitions ........................................................................................................................... 4 5 Authentication Framework ................................................................................................................... 6 5.1 Introduction ............................................................................................................................................ 6 5.2 Risk Framework ..................................................................................................................................... 6 5.3 Authentication Credential Lifecycle .................................................................................................... 7 5.4 Authentication Methods ........................................................................................................................ 8 5.4.1 Introduction ............................................................................................................................................ 8 5.4.2 Knowledge Factors ............................................................................................................................... 9 5.4.3 Possession Factors ............................................................................................................................. 10 5.4.4 Biometric Factors ................................................................................................................................ 11 5.5 Multi-factor Authentication (MFA) ...................................................................................................... 12 5.6 Mutual Authentication ......................................................................................................................... 13 5.7 System Authentication ........................................................................................................................ 14 6 Requirements ....................................................................................................................................... 15 6.1 General Requirements ........................................................................................................................ 15 6.2 Authentication Requirements ............................................................................................................ 16 6.2.1 General Authentication Requirements .............................................................................................. 16 6.2.2 High Risk Level 3 Requirements ........................................................................................................ 17 6.2.3 Moderate Risk Level 2 Requirements ................................................................................................ 17 6.2.4 Low Risk Level 1 Requirements ......................................................................................................... 17 6.2.5 Minimal Risk Level 0 Requirements .................................................................................................. 17 6.3 Technology Considerations ............................................................................................................... 17 6.3.1 Soft Tokens .......................................................................................................................................... 17 6.3.2 Cryptographic Protocol ...................................................................................................................... 18 6.3.3 Two Factor Authentication ................................................................................................................. 18 6.4 Knowledge Factors ............................................................................................................................. 19 Annex A (Informative) Authentication Control Objectives ........................................................................ 20 Annex B (Informative) Password Considerations .................................................................................... 35 Annex C (Informative) Know Your Customer (KYC) Considerations ..................................................... 40 Bibliography ...................................................................................................................................................... 44 Tables Table 1 Authentication Frameworks ................................................................................................................. 2 Table 2 Risk Levels Framework ........................................................................................................................ 6 Table 3 Authentication Factors for Humans versus Applications .............................................................. 13 Table 4 Authentication Requirements ............................................................................................................ 16 Table 5 Probability of Letters in English Words ............................................................................................ 36 © 2020 ASC X9, Inc. – All rights reserved iii This is a preview of "ANSI X9.117-2020". Click here to purchase the full version from the ANSI store. ANSI X9.117–2020 Figures Figure 1 Authentication Credential Lifecycle.................................................................................................. 7 Figure 2 Entity Authentication ........................................................................................................................ 16 Figure 3 Recommended Password Hashing ................................................................................................. 38 iv © 2020 ASC X9, Inc. – All rights reserved This is a preview of "ANSI X9.117-2020". Click here to purchase the full version from the ANSI store. ANSI X9.117–2020 Foreword Approval of an American National Standard requires verification by ANSI that the requirements for due process, consensus, and other criteria for approval have been met by the standards developer. Consensus is established when, in the judgment of the ANSI Board of Standards Review, substantial agreement has been reached by directly and materially affected interests. Substantial agreement means much more than a simple majority, but not necessarily unanimity. Consensus requires that all views and objections be considered, and that a concerted effort be made toward their resolution. The use of American National Standards is completely voluntary; their existence does not in any respect preclude anyone, whether he has approved the standards or not from manufacturing, marketing, purchasing, or using products, processes, or procedures not conforming to the standards. The American National Standards Institute does not develop standards and will in no circumstances give an interpretation of any American National Standard. Moreover, no person shall have the right or authority to issue an interpretation of an American National Standard in the name of the American National Standards Institute. Requests for interpretation should be addressed to the secretariat or sponsor whose name appears on the title page of this standard. CAUTION NOTICE: This American National Standard may be revised or withdrawn at any time. The procedures of the American National Standards Institute require that action be taken to reaffirm, revise, or withdraw this standard no later than five years from the date of approval. Published by Accredited Standards Committee X9, Incorporated Financial Industry Standards 275 West Street, Suite 107 Annapolis, MD 21401 USA X9 Online http://www.x9.org Copyright © 2020 ASC X9, Inc. All rights reserved. No part of this publication may be reproduced in any form, in an electronic