NIST on Cloning of Authentication Keys

Comments (3)

evanjrowley · 32d ago

Look for Appendix B. Syncable Authenticators: https://pages.nist.gov/800-63-4/sp800-63b.html#appB

Interesting they feel comfortable using WebAuthn for Authenticator Assurance Level 2. It does seem like the right middle-ground for an exportable private key.

They referenced WebAuthn quite a bit in Appendix B. I'm surprised the FIDO Alliance's Credential Exchange Format/Protocol was not mentioned: https://fidoalliance.org/specifications-credential-exchange-...

I haven't taken a deep dive on it, but I wonder if those FIDO Alliance specifications would meet/support NIST's AAL2 criteria for WebAuthn.

mooreds · 32d ago

Thanks. I didn't notice that the anchor tag got stripped from the submission. Thanks for adding that link in the comment.

gnabgib · 32d ago

This isn't the title (NIST Special Publication 800-63B.. yeah NIST docs aren't very accessibly named), nor the intent of this document.

> This document provides requirements to credential service providers (CSPs) for remote user authentication at each of three Authentication Assurance Levels (AALs).

Self-hosted x86 back end is now default in debug mode (ziglang.org)

Why Android can't use CDC Ethernet (2023) (jordemort.dev)

Tracking Copilot vs. Codex vs. Cursor vs. Devin PR Performance (aavetis.github.io)

Riding high in Germany on the world's oldest suspended railway (theguardian.com)

Finding Shawn Mendes (ericneyman.wordpress.com)

I used AI-powered calorie counting apps, and they were even worse than expected (lifehacker.com)

Omnimax (computer.rip)

FSE meets the FBI (blog.freespeechextremist.com)

Administering immunotherapy in the morning seems to matter. Why? (owlposting.com)

The wire that transforms much of Manhattan into one big, symbolic home (2017) (atlasobscura.com)

Endangered classic Mac plastic color returns as 3D-printer filament (arstechnica.com)

Panjandrum: The ‘giant firework’ built to break Hitler's Atlantic Wall (bbc.com)

My first attempt at iOS app development (mgx.me)

Kagi Reaches 50k Users (kagi.com)

Enterprises are getting stuck in AI pilot hell, say Chatterbox Labs execs (theregister.com)

Forests offset warming more than thought: study (news.ucr.edu)

Gaussian integration is cool (rohangautam.github.io)

Software Is About Promises (bramadams.dev)

Startup Equity 101 (quarter--mile.com)

Show HN: Let’s Bend – Open-Source Harmonica Bending Trainer (letsbend.de)

Joining Apple Computer (2018) (folklore.org)

The Illusion of "The Illusion of Thinking" (seangoedecke.com)

What happens when people don't understand how AI works (theatlantic.com)

Generating Pixels One by One (tunahansalih.github.io)

Self-Host and Tech Independence: The Joy of Building Your Own (ssp.sh)

Cheap yet ultrapure titanium might enable widespread use in industry (2024) (phys.org)

The last six months in LLMs, illustrated by pelicans on bicycles (simonwillison.net)

Web designs are getting too complicated (websmith.studio)

Building supercomputers for autocrats probably isn't good for democracy (helentoner.substack.com)

How to get started with writing tech video essays

How Compiler Explorer Works in 2025 (xania.org)

FAA to eliminate floppy disks used in air traffic control systems (tomshardware.com)

<Blink> and <Marquee> (2020) (danq.me)

Analyzing IPv4 Trades with Gnuplot (ipv4a-5539ad.gitlab.io)

Building an AI server on a budget (informationga.in)

Binfmtc – binfmt_misc C scripting interface (netfort.gr.jp)

Poison everywhere: No output from your MCP server is safe (cyberark.com)

Coventry Very Light Rail (coventry.gov.uk)

Launching the BeOS on Hitachi Flora Prius Systems (1999) (testou.free.fr)

Field Notes from Shipping Real Code with Claude (diwank.space)

Efficient mRNA delivery to resting T cells to reverse HIV latency (nature.com)

Focus and Context and LLMs (taras.glek.net)

There's not much point in buying Commodore (oldvcr.blogspot.com)

OpenBSD IO Benchmarking: How Many Jobs Are Worth It? (rsadowski.de)

tcpulse: A TCP/UDP load generator that provides fine-grained, flow-level control (github.com)

Rkyv (archive) is a zero-copy deserialization framework for Rust (rkyv.org)

Low-Level Optimization with Zig (alloc.dev)

Ask HN: How to learn CUDA to professional level

Why We're Moving on from Nix (blog.railway.com)

The time bomb in the tax code that's fueling mass tech layoffs (qz.com)

NIST on Cloning of Authentication Keys

Comments (3)