...
The concept of classes for credentials is far from new. Back in late 1990's the US Office of Management and Budget had issued guidance, which defined OMB M-04-04, which defined four levels of assurance, Levels 1 to 4, in terms of the consequences of authentication the consequences of authentication errors and misuse of identification credentials:
- Level 1 - Little or no confidence in the asserted identity’s validity;
- Level 2 - Some confidence in the asserted identity’s validity;
- Level 3 - High confidence in the asserted identity’s validity; and
- Level 4 - Very high confidence in the asserted identity’s validity.
. Level 1 is the lowest assurance level, and Level 4 is the highest. The OMB guidance defined the required level of authentication assurance in terms of the likely consequences of an authentication error. As the consequences of an authentication error become more serious, the required level of assurance increases. The OMB guidance provided US Federal agencies with the criteria for determining the level of authentication assurance required for specific applications and transactions, based on the risks and their likelihood of occurrence of each application or transaction.
...