Germany’s Information Security Office Achieves FIDO’s First Level 3+ Authenticator Certification

The German Federal Office for Information Security (BSI) is now the world’s first organization with Certified Authenticator Level 3+ certification. The tier currently stands as the FIDO Alliance’s highest level of validation.

The Certified Authenticator program was established in 2018, and evaluates each Authenticator based on its ability to protect its private key. In doing so, it provides people with more assurances about the integrity of an individual Authenticator, above and beyond the standard FIDO security specifications. Vendors need only adopt those standards to achieve Level 1 certification, or introduce a restricted operating environment to reach Level 2. Level 3 Authenticators, on the other hand, need to have companion program certification, which is based on Common Criteria and speaks to a device’s ability to fend off brute force attacks.

According to the FIDO Alliance, BSI’s accomplishment is noteworthy because it creates a roadmap that other organizations can follow to obtain Level 3+ certification. The Alliance also expects more organizations to express interest in Level 3+ certification now that they know that it is possible. As a result, the BSI classification will increase the overall level of cybersecurity as more organizations start to work toward and achieve that higher security standard.

“This certification clearly demonstrates the value of our certified authenticator program – particularly at the higher levels,” said FIDO Certification Director Rae Rivera. “The protection profile serves as good guidance for those that are seeking the higher levels as to what they need to do and what modifications they need to make to their implementation.”

The BSI recently received praise for a decision that will allow German organizations to take advantage of identity verification technologies that rely on artificial intelligence. The FIDO Alliance, meanwhile, has asked the NIST to differentiate between secret-based forms of authentication and FIDO’s stronger cryptographic solutions in its latest Digital Identity Guidelines.