What are Authenticator Assurance Levels in digital identity?

Authenticator Assurance Levels (AALs) are security classifications defined by the National Institute of Standards and Technology (NIST) in their SP 800-63B guidelines. These levels help organizations determine the strength of an authentication process based on the risk associated with access to digital services. AALs range from AAL1 (low security) to AAL3 (high security), ensuring that authentication mechanisms meet appropriate security requirements.

With the latest NIST SP 800-63B supplement, synced passkeys are officially recognized as AAL2-compliant, while device-bound passkeys meet AAL3 requirements.

• Synced passkeys (AAL2): Provide phishing resistance and secure storage while allowing key synchronization across devices. They are an improvement over passwords and SMS-based MFA but do not meet AAL3 due to cloud-based key synchronization.
• Device-bound passkeys (AAL3): Require cryptographic proof of identity and are tied to a specific device, making them highly resistant to credential compromise.

For enterprises implementing passkeys, understanding AAL classifications is critical to selecting the right authentication security level based on business and compliance needs.