Editing Authenticator (section)

===NIST authenticator assurance levels===

NIST defines three levels of assurance with respect to authenticators. The highest authenticator assurance level (AAL3) requires multi-factor authentication using either a multi-factor authenticator or an appropriate combination of single-factor authenticators. At AAL3, at least one of the authenticators must be a cryptographic hardware-based authenticator. Given these basic requirements, possible authenticator combinations used at AAL3 include:

# A multi-factor cryptographic hardware-based authenticator
# A single-factor cryptographic hardware-based authenticator used in conjunction with some other authenticator (such as a password authenticator)

See the NIST Digital Identity Guidelines for further discussion of authenticator assurance levels.<ref name="NIST-SP-800-63B" />