Technical Glossary
A measure of confidence that a claimed digital identity corresponds to the real-world identity of the entity presenting credentials, as defined by NIST SP 800-63 across three graduated levels. IAL1 requires minimal identity evidence, IAL2 mandates remote or in-person identity proofing with validated documentation, and IAL3 requires in-person proofing with physical presence verification. These levels guide organizations in selecting appropriate identity verification controls commensurate with the risk associated with each transaction. Regulatory frameworks globally reference NIST assurance levels when establishing digital identity requirements.
A tiered classification defined by NIST SP 800-63B that specifies the strength of authentication mechanisms required for different risk levels of digital transactions. AAL1 permits single-factor authentication, AAL2 requires multi-factor authentication with a cryptographic authenticator, and AAL3 mandates hardware-based authentication with verifier impersonation resistance. Each level prescribes specific requirements for authenticator types, reauthentication intervals, and session binding. Organizations select the appropriate AAL based on risk assessment outcomes and regulatory compliance obligations.
The process of establishing a verified association between a digital credential or authenticator and the real-world identity of its holder through identity proofing and enrollment procedures. Strong identity binding ensures that the person using a credential is the same individual whose identity was verified during the registration process. Binding strength depends on the proofing rigor, authenticator type, and the security of the enrollment channel. NIST guidelines require binding ceremonies that provide equivalent or greater assurance than the credential's intended assurance level.
The process of invalidating a previously issued digital credential before its natural expiration to prevent its continued use for authentication or assertion purposes. Revocation mechanisms include certificate revocation lists, Online Certificate Status Protocol responses, status list entries, and accumulator-based schemes for verifiable credentials. Timely revocation is critical for mitigating the impact of credential compromise, role changes, and policy violations. The design of efficient, privacy-preserving revocation systems remains an active area of research in both PKI and decentralized identity communities.
A technical specification that defines the functional requirements, security properties, and interoperability interfaces for software applications that store and present digital identity credentials on behalf of users. Wallet standards address credential storage formats, presentation exchange protocols, backup and recovery procedures, and user consent mechanisms. The EU Digital Identity Wallet Architecture and Reference Framework and the DIF Wallet Rendering specification represent major standardization efforts. These standards aim to ensure that identity wallets from different vendors can interoperate within common trust frameworks.
The European Union regulation establishing a legal framework for electronic identification, authentication, and trust services that enables cross-border recognition of national digital identity schemes. eIDAS defines three assurance levels for electronic identification and mandates mutual recognition of notified eID schemes across EU member states. The revised eIDAS 2.0 regulation introduces the European Digital Identity Wallet as a mandatory offering for all EU citizens. The framework encompasses electronic signatures, seals, timestamps, and registered delivery services as foundational trust services.
A biometric security mechanism that determines whether a biometric sample is captured from a live person rather than a spoofing artifact such as a photograph, mask, deepfake video, or synthetic voice. Active liveness detection prompts users to perform random actions while passive systems analyze texture, depth, and motion characteristics without user cooperation. AI models trained on presentation attack datasets achieve high detection accuracy across diverse spoofing vectors. ISO/IEC 30107 defines the presentation attack detection framework and evaluation methodology used by the biometrics industry.
The process of restoring access to a digital identity or account when the primary authentication credentials are lost, compromised, or unavailable. Secure account recovery must verify the claimant's identity to a level commensurate with the original identity proofing assurance before reissuing credentials. Common recovery mechanisms include backup codes, trusted device verification, social recovery through designated contacts, and identity reproofing. NIST guidelines emphasize that recovery procedures must not create a backdoor that undermines the overall authentication assurance level.
The policies, processes, and community structures that govern the operation and evolution of decentralized identity ecosystems without relying on a single centralized authority. Governance frameworks define rules for DID method registration, credential schema management, trust list maintenance, and dispute resolution across distributed stakeholder groups. Effective governance balances innovation with security through transparent decision-making, stakeholder representation, and interoperability requirements. Organizations such as the Trust over IP Foundation and the Decentralized Identity Foundation develop governance models for self-sovereign identity infrastructure.
A digital representation of a government-issued identity document such as a driver's license or national ID card that is stored and presented through a mobile device application. Mobile identity documents use NFC, QR codes, or Bluetooth to present verified identity attributes to relying parties while enabling selective disclosure of specific fields. The ISO/IEC 18013-5 mobile Driving License standard defines the data model, security architecture, and device engagement protocols for mobile document presentation. These digital documents complement physical credentials by enabling remote verification and privacy-preserving attribute sharing.
The application of AI, machine learning, and computer vision to automate the identity proofing process including document capture, data extraction, authenticity validation, and facial comparison against identity documents. Automated proofing reduces manual review bottlenecks, improves consistency, and enables real-time identity verification at scale. Systems must address challenges including document diversity, image quality variability, and demographic bias in facial recognition algorithms. NIST evaluates automated proofing components through face recognition and document authentication testing programs.
A tamper-evident data structure that packages one or more verifiable credentials for transmission from a holder to a verifier, including cryptographic proof of the presenter's authority to share the enclosed credentials. Verifiable presentations prevent credential replay and unauthorized forwarding by binding the presentation to the holder's authentication proof and optionally to a specific verifier challenge. The W3C Verifiable Credentials specification defines the presentation data model and proof mechanisms. Presentation exchange protocols standardize how verifiers request specific credential types and how holders construct compliant responses.
The set of controls governing the creation, maintenance, and termination of authenticated user sessions following successful authentication. Session management encompasses token generation, timeout policies, reauthentication triggers, and secure session storage to prevent hijacking and fixation attacks. Modern approaches use short-lived access tokens with refresh token rotation and bind session state to device characteristics for additional security. NIST SP 800-63B specifies reauthentication intervals and session binding requirements for different authenticator assurance levels.
An identity fraud vector that employs AI-generated synthetic media including manipulated facial images, voice clones, and video deepfakes to circumvent biometric authentication and identity proofing systems. Deepfake attacks target remote identity verification workflows by presenting algorithmically generated face swaps or injection attacks that bypass liveness detection. Countermeasures include neural network-based deepfake detectors, injection attack prevention through secure capture pipelines, and multi-modal verification combining multiple biometric modalities. The rapid advancement of generative AI models has significantly increased the sophistication and accessibility of deepfake production tools.
The capability of diverse digital identity systems, credentials, and protocols to work together seamlessly across organizational, technical, and jurisdictional boundaries. Interoperability requires agreement on common data models, transport protocols, trust establishment mechanisms, and semantic alignment of identity attributes. Standards such as W3C DID Core, OpenID Connect, and ISO mDL provide technical interoperability layers while trust frameworks address policy and governance alignment. Achieving interoperability at scale remains a central challenge in the global digital identity landscape.