NIST Releases New Digital Identity Update Allowing Agencies to Utilize Synchronized Passkeys

The National Institute of Standards and Technology (NIST) has released a new update to its digital identity guidelines, addressing a key discrepancy in federal policy that may have been hindering the adoption of stronger forms of multifactor authentication by some agencies.

In the supplement to the guidelines, NIST provides guidance on incorporating “syncable authenticators” into both enterprise and public-facing use cases. This update comes after receiving feedback from many individuals about the lack of support for synced passkeys in the current guidelines.

Ryan Galluzo, the digital identity program lead at NIST, emphasized the importance of allowing agencies to utilize this technology to enhance authentication for the public. He highlighted the benefits of using passkeys, which provide a more intuitive and secure way for users to authenticate to online services.

Under the federal zero trust strategy, agencies are directed to offer phishing-resistant multifactor authentication for public-facing online services. The supplement from NIST aims to help agencies implement password-less authentication methods endorsed by the FIDO Alliance, an industry association focused on reducing reliance on passwords.

Jeremy Grant, who led NIST’s digital identity work during the Obama administration, believes that the new supplement will facilitate the adoption of FIDO authentication in the U.S. government. This endorsement is expected to remove barriers to adoption and enhance security measures for online access to government services.

Overall, the update from NIST is seen as a significant step towards improving authentication methods and enhancing cybersecurity in government agencies. The move towards using synced passkeys is expected to provide a more secure and user-friendly experience for individuals accessing online services.