Four tiers of presence, matched to what an action can cost

There is no single right level of authentication assurance, because there is no single consequence. The useful question is which tier each action deserves, and the answer is usually the lowest one that survives the relevant attack.

Part of Receipt cryptography and standards

The four tiers

Read the fourth column. Each tier is defined by what it still permits, and that is the honest way to choose.

P1 and why it is usually right

A click in a session is the default for almost everything, and correctly so. Most actions are reversible, low-value and high-frequency, and adding friction to them is a net loss.

P1 fails against a stolen session, which is the most common enterprise compromise. That is acceptable when the action's consequence is small; it stops being acceptable at the point where undoing the action is expensive.

P2 and the one attack it leaves

A platform authenticator requires a gesture on the device — a fingerprint, a face, a device PIN. A stolen session cannot produce it, and neither can a remote operator controlling the machine.

What it does not address is the display. Malware on the host can show one statement and submit another; the authenticator signs a digest and has no view of the screen.

P3 and what the extra hardware buys

A roaming key is separate hardware, which matters in two ways.

• The key material is not on the host at all, so a full host compromise does not reach it
• It can be attested, so you can require corporate-issued hardware and verify distinctness between approvers
• It cannot be forwarded over a remote session, if redirection is disabled

The display gap remains. P3 is stronger than P2 against host compromise and equally exposed to display manipulation.

P4 and why you cannot have it

An authenticator with its own display, showing the statement, would close the remaining gap. Devices supporting this exist and are rare; browser and platform support is not there.

It belongs in the model because it names what is missing. A system designed with P4 as a defined tier can adopt it if it arrives without restructuring, and in the meantime P3 with independent verification is the practical ceiling.

Assigning tiers

The distribution matters more than any individual row. If P3 appears more than a handful of times a week for a given person, the tiering is wrong and the control will decay.

The counter-intuitive rule

Escalating too much is worse than escalating too little.

A user prompted for a hardware key twenty times a day performs the gesture without reading anything, which converts P3 into P1 with extra steps. The security value of the tier comes from its rarity as much as from its mechanism.

This is why the enumeration exercise — finding the genuinely irreversible actions — is the important work. It is what keeps the high tiers meaningful.

Recording the tier

Whatever tier was used should be in the record, because it tells a later reader what the approval is worth.

{
  "action": "payment.release",
  "presence": {
    "tier": "P3",
    "user_verified": true,
    "authenticator_type": "cross-platform",
    "aaguid": "...",
    "attestation_verified": true
  }
}

An auditor sampling approvals can then see the distribution, and an exception — a P1 approval on an action that should have been P3 — is visible rather than buried.

The counter-intuitive rule

Escalating too much is worse than escalating too little. A user prompted for a hardware key twenty times a day performs the gesture without reading anything, which turns P3 into P1 with extra steps. The security value of a tier comes from its rarity as much as from its mechanism.

Objections and honest limits

“Why include a tier nobody can deploy?” Because naming P4 identifies exactly what is missing, and a system designed with it as a defined tier can adopt it without restructuring if it arrives.

“P3 everywhere would be safest.” It would be least safe. If P3 fires a dozen times a day it becomes reflexive, and the tier that was meant to guard the irreversible actions no longer means anything.

Applying the hierarchy

1. Enumerate irreversible actions. Usually ten to thirty per application.
2. Assign tiers by what each leaves open. Not by how important the action feels.
3. Count how often each tier will fire per person. If P3 fires daily, the tiering is wrong.
4. Record the tier used in the receipt. So a later reader knows what the approval is worth.

Terms used here

User presence

A physical interaction with the authenticator, asserted in a flag the authenticator signs.

Roaming authenticator

A separate hardware key, whose key material is not on the host and which cannot be forwarded over a remote session.

Trusted display

An authenticator that renders the statement on its own screen and includes it in the signature.

Frequently asked questions

How do you choose a tier? By what it still permits. Each tier is defined by the attacks it does not defeat, and the right tier is the lowest one that survives the attacks you care about.

Why is over-escalating worse than under-escalating? A user prompted twenty times a day stops reading, which turns the high tier into a click with extra steps. Rarity is part of the mechanism.

Why include a tier that is not deployable? Naming P4 identifies what is missing and lets a system adopt it later without restructuring. P3 with independent verification is today's ceiling.

Why record the tier in the receipt? It tells a later reader what the approval is worth, and makes exceptions — a low-tier approval on a high-tier action — visible.

Why is over-escalating worse? A user prompted constantly stops reading, which turns a strong tier into a click. Rarity is part of the mechanism.

Why record the tier? So a later reader knows what the approval is worth, and so a low-tier approval on a high-tier action is visible.

Sources and further reading

• NIST SP 800-63B — Authentication and authenticator management
• W3C Web Authentication: An API for accessing Public Key Credentials Level 3
• FIDO Alliance specifications
• Published research on authentication fatigue and habituation.