RFC 8176

Authentication Method Reference Values

📅 published June 2017, from ietf

📜 RFC 8176: Authentication Method Reference Values 💖

okay bestie, let's get into it! ✨ This one is from the IETF, and it's Standards Track 👑, which means it's an actual official Internet standard, not just a vibe. It was written in June 2017 🌸 by three people: M. Jones from Microsoft, P. Hunt from Oracle, and A. Nadalin also from Microsoft 🫶. It's published as ISSN 2070-1721 🦋. It doesn't obsolete or update any other RFCs, so it's a fresh little standalone 🎀.

The whole point is the amr claim. It's in the IANA "JSON Web Token Claims" registry, but the registry has no standard values for it yet 😭. So this doc creates a registry for those values and fills in the first batch 💅.

1. Introduction ✨

okay so the amr claim (Authentication Methods References) is already registered in the IANA "JSON Web Token Claims" registry [IANA.JWT.Claims] 🦋, but nobody had defined any standard amr values yet 😭. This spec fixes that: it sets up a registry for them and adds an initial set 🎀.

so where does amr come from? It's defined in Section 2 of the OpenID Connect Core 1.0 spec [OpenID.Core] 💖, and here's the gist of it:

amr is OPTIONAL. It's a JSON array of case sensitive strings that identify the authentication methods used. Like, it might say both password and OTP were used 🔥. What the values mean is beyond that spec, so the parties using the claim have to agree on what they mean, and those meanings might depend on the context 🌈.

bestie, the way each value is a family of methods is so smart 🧚. For example, otp covers OTPs that are time-based AND HMAC-based 💜. Most relying parties just want to know "yep, an OTP happened" 💅, and they don't care which flavor. So one identifier can be satisfied in two or more nearly equivalent ways 🌸.

same energy for fingerprints 👑. Different matching algorithms have different false-positive and false-negative rates, and different sensors, and honestly most relying parties don't need that drama 🙈. The fpt identifier covers all of it ✨.

ngl, the relying party is trusting the identity provider to do reasonable stuff 🫶. If it doesn't trust the IdP like that, it has no business using it 💀. amr just lets the IdP tell the relying party extra details about what it did, when those details are actually useful 🎀.

These values are NOT meant to be the full list for every use case 🦋. Other specs can add more to the registry later 🌈. The values in this doc are intentionally a small set, and they're already being used in real life 💖.

The values only make distinctions that are actually useful to relying parties 💅. Splitting things more finely than anyone uses would hurt interoperability 😭, because relying parties would then have to figure out that a bunch of different values all mean the same thing to them 💀.

Now the important bit 🔥: even though these claim values are about authentication, OAuth 2.0 [RFC6749] is built for resource authorization 🫠. It can't be used for authentication without extensions like the ones in OpenID Connect Core 1.0 [OpenID.Core] 🙅. So having amr values does NOT mean you should go use OAuth 2.0 for authentication without proper extensions that make authentication secure ⚠️.

When OpenID Connect is in play and the IdP puts an amr claim in the ID Token after a successful login, the relying party can look at those values and learn how the login actually happened 👀. For example, it might learn only a password was used, or that iris recognition was used together with a hardware-secured key 😭. Whether amr gets provided, and which values each party understands, is beyond this spec 🌸. The OpenID Connect MODRNA Authentication Profile 1.0 [OpenID.MODRNA] is one example of an app context that uses the values defined here 💜.

1.1. Requirements Notation and Conventions 📝

okay so the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" are read as described in BCP 14 [RFC2119] [RFC8174], but ONLY when they're in ALL CAPS like that 🎀. Lowercase versions are just regular words, bestie 💅.

1.2. Terminology 🧚

this spec uses the terms from JSON Web Token (JWT) [RFC7519] and OpenID Connect Core 1.0 [OpenID.Core] 🦋.

2. Authentication Method Reference Values 🔐

here's the list of amr values this spec defines 💖. Let's go through them 🌈!

face : Biometric auth [RFC4949] using facial recognition 🙂‍↔️✨.

fpt : Biometric auth [RFC4949] using a fingerprint 👆🌸.

geo : Using geolocation info for auth, like what's provided by [W3C.REC-geolocation-API-20161108] 🗺️💜.

hwk : Proof-of-Possession (PoP) of a hardware-secured key 🔑🔥. See Appendix C of [RFC4211] for a discussion on PoP.

iris : Biometric auth [RFC4949] using an iris scan 👁️💅.

kba : Knowledge-based auth [NIST.800-63-2] [ISO29115] 🧠🎀.

mca : Multiple-channel auth [MCA] 📱💻. It involves communication over more than one distinct channel. For example, it might mean typing info into a workstation's browser AND giving info on a phone call to a pre-registered number 📞✨.

mfa : Multiple-factor auth [NIST.800-63-2] [ISO29115] 🔐👑. When this is present, the specific methods used MAY also be included 🌟.

otp : One-time password [RFC4949] 🔢. The OTP specs this covers include [RFC4226] and [RFC6238] 🦋.

pin : Personal Identification Number (PIN) [RFC4949] or pattern (doesn't have to be only numbers) that a user enters to unlock a key on the device 🔓💖. This mechanism SHOULD have a way to deter an attacker from getting the PIN by guessing over and over 🚫🙅‍♀️.

pwd : Password-based auth [RFC4949] 🔑💜.

rba : Risk-based auth [JECM] 📊🌸.

retina : Biometric auth [RFC4949] using a retina scan 👀✨.

sc : Smart card [RFC4949] 💳🫶.

sms : Confirmation using SMS [SMS] text to the user at a registered number 💬📲.

swk : Proof-of-Possession (PoP) of a software-secured key 💻🔐. See Appendix C of [RFC4211] for a discussion on PoP.

tel : Confirmation by phone call to the user at a registered number 📞🌈. This technique is sometimes also called "call back" [RFC4949] 🔁.

user : User presence test 🙋‍♀️💅. Evidence that the end user is present and interacting with the device. Sometimes also called "test of user presence" [W3C.WD-webauthn-20170216] 🦋.

vbm : Biometric auth [RFC4949] using a voiceprint 🎙️🫶.

wia : Windows integrated auth [MSDN] 🪟💖.

(Part 1 of 3. Keep your eyes peeled for part 2 🌸, bestie!)

3. Relationship to "acr" (Authentication Context Class Reference) ✨

Okay so, "acr" (Authentication Context Class Reference) and the "acr_values" request parameter are super related to the "amr" (Authentication Methods References) claim, but they are NOT the same thing 💅. An Authentication Context Class is basically a set of business rules that someone wants an authentication to satisfy. Those rules can usually be met with a bunch of different specific authentication methods, either one at a time or combined 🧩. When an interaction uses "acr_values", it's asking for the listed Authentication Context Classes to be used, and the result should include an "acr" claim that says which class was satisfied. So the "acr" claim in the reply tells you the business rules were met, and it does NOT tell you how they were met 🤷‍♀️.

Interactions that use the "amr" claim are different. They make statements about the exact authentication methods that were used 👀. That's lowkey more brittle than using "acr" 💀, because the methods that make sense for a given authentication keep changing over time. Attacks on existing methods evolve, and new authentication methods get deployed, so what's appropriate today might not be next year 📉.

4. Privacy Considerations 🔒

The list of "amr" claim values in an ID Token reveals information about how the end user authenticated to the identity provider. Honestly, in some cases that info can have privacy implications 🙈.

This specification defines identifiers for particular kinds of credentials, but it does NOT define how those credentials get stored or protected 🗝️. For example, making sure biometric credentials that some of the defined Authentication Method Reference values point to stay secure and private is beyond the scope of this specification. That's a whole other job 🫶.

5. Security Considerations 🚨

The security considerations in OpenID Connect Core 1.0 [OpenID.Core], OAuth 2.0 [RFC6749], and the entire OAuth 2.0 Threat Model [RFC6819] all apply to applications using this specification. Bestie, read those too. They are not optional vibes 😭.

As described in Section 3, depending on particular authentication methods can lead to brittle systems, since the methods that fit a given authentication will change over time. So please don't build your whole life around one method 💀🔥.

6. IANA Considerations 📋

6.1. Authentication Method Reference Values Registry 🗂️

This specification sets up the IANA "Authentication Method Reference Values" registry for "amr" claim array element values. The registry records each Authentication Method Reference value along with a reference to the specification that defines it. This specification registers the Authentication Method Reference values defined in Section 2 ✨.

Values get registered on an Expert Review [RFC5226] basis. That means a three-week review period on the jwt-reg-review@ietf.org mailing list, with advice from one or more Designated Experts 🧑‍🏫. To help with interoperability, the Designated Experts are asked to encourage registrants to share a publicly accessible specification that defines their values. That way, everyone can understand how the value is meant to be used 🌈.

Registration requests sent to the mailing list for review should use a clear subject. For example: "Request to register Authentication Method Reference value: otp" 📨.

During the review period, the Designated Experts will either approve or deny the request and tell the review list and IANA what they decided. Denials should explain why and, where it makes sense, suggest how to make the request work 🫶. If a request is still undecided after more than 21 days, it can be raised with the IESG via iesg@ietf.org for resolution ⏰.

IANA must only accept registry updates from the Designated Experts, and it should send all registration requests to the review mailing list 📬.

It is suggested that the same Designated Experts who review these requests also review the requests for the IANA "JSON Web Token Claims" registry [IANA.JWT.Claims]. Consistency is everything 💜.

The Designated Experts should weigh a few things. They should check whether the proposed registration duplicates existing functionality 🤔. They should check whether it's likely to be generally applicable, or whether it's only useful for one application 🔍. They should check whether the value is actually being used 📊. And they should check whether the registration description is clear 📝.

6.1.1. Registration Template 🎀

Here's the template, copied exactly so nothing gets lost in translation 💖:

Authentication Method Reference Name:
   The name requested (e.g., "otp") for the authentication method or
   family of closely related authentication methods.  Because a core
   goal of this specification is for the resulting representations to
   be compact, it is RECOMMENDED that the name be short -- that is,
   not to exceed 8 characters without a compelling reason to do so.
   To facilitate interoperability, the name must use only printable
   ASCII characters excluding double quote ('"') and backslash ('\')
   (the Unicode characters with code points U+0021, U+0023 through
   U+005B, and U+005D through U+007E).  This name is case sensitive.
   Names may not match other registered names in a case-insensitive
   manner unless the Designated Experts state that there is a
   compelling reason to allow an exception.

Authentication Method Reference Description:
   Brief description of the Authentication Method Reference (e.g.,
   "One-time password").

Change Controller:
   For Standards Track RFCs, state "IESG".  For others, give the name
   of the responsible party.  Other details (e.g., postal address,
   email address, home page URI) may also be included.

Specification Document(s):
   Reference to the document or documents that specify the parameter,
   preferably including URIs that can be used to retrieve copies of
   the documents.  An indication of the relevant sections may also be
   included but is not required.

6.1.2. Initial Registry Contents 🌸

Now for the fun part, the starter registry entries that this specification registers 🧚. Every one of them points to Section 2 of [RFC8176] 🦋:

o  Authentication Method Reference Name: "face"
o  Authentication Method Reference Description: Facial recognition
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "fpt"
o  Authentication Method Reference Description: Fingerprint biometric
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "geo"
o  Authentication Method Reference Description: Geolocation
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "hwk"
o  Authentication Method Reference Description: Proof-of-possession
   of a hardware-secured key
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "iris"
o  Authentication Method Reference Description: Iris scan biometric
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "kba"
o  Authentication Method Reference Description: Knowledge-based
   authentication
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "mca"
o  Authentication Method Reference Description: Multiple-channel
   authentication
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "mfa"
o  Authentication Method Reference Description: Multiple-factor
   authentication
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "otp"
o  Authentication Method Reference Description: One-time password
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "pin"
o  Authentication Method Reference Description: Personal
   Identification Number or pattern
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "pwd"
o  Authentication Method Reference Description: Password-based
   authentication
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "rba"
o  Authentication Method Reference Description: Risk-based
   authentication
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "retina"
o  Authentication Method Reference Description: Retina scan biometric
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "sc"
o  Authentication Method Reference Description: Smart card
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "sms"
o  Authentication Method Reference Description: Confirmation using
   SMS
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "swk"
o  Authentication Method Reference Description: Proof-of-possession
   of a software-secured key
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "tel"
o  Authentication Method Reference Description: Confirmation by
   telephone call
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "user"
o  Authentication Method Reference Description: User presence test
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "vbm"
o  Authentication Method Reference Description: Voice biometric
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

o  Authentication Method Reference Name: "wia"
o  Authentication Method Reference Description: Windows integrated
   authentication
o  Change Controller: IESG
o  Specification Document(s): Section 2 of [RFC8176]

7. References 📚

7.1. Normative References ✨

okay so these are the docs this spec literally can't function without 📚 bestie, read these first 💅

[IANA.JWT.Claims]
           IANA, "JSON Web Token Claims",
           <http://www.iana.org/assignments/jwt>.

[OpenID.Core]
           Sakimura, N., Bradley, J., Jones, M., de Medeiros, B., and
           C. Mortimore, "OpenID Connect Core 1.0", November 2014,
           <http://openid.net/specs/openid-connect-core-1_0.html>.

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <http://www.rfc-editor.org/info/rfc2119>.

[RFC5226]  Narten, T. and H. Alvestrand, "Guidelines for Writing an
           IANA Considerations Section in RFCs", BCP 26, RFC 5226,
           DOI 10.17487/RFC5226, May 2008,
           <http://www.rfc-editor.org/info/rfc5226>.

[RFC6749]  Hardt, D., Ed., "The OAuth 2.0 Authorization Framework",
           RFC 6749, DOI 10.17487/RFC6749, October 2012,
           <http://www.rfc-editor.org/info/rfc6749>.

[RFC7519]  Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token
           (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015,
           <http://www.rfc-editor.org/info/rfc7519>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <http://www.rfc-editor.org/info/rfc8174>.

7.2. Informative References 🌸

these ones are extra reading, super useful for context but not required to get the spec 🧠 they're all listed below, nothing skipped 🫶

[ISO29115] International Organization for Standardization,
           "ISO/IEC 29115:2013 Information technology - Security
           techniques - Entity authentication assurance framework",
           ISO/IEC 29115:2013, April 2013,
           <https://www.iso.org/standard/45138.html>.

[JECM]     Williamson, G., "Enhanced Authentication In Online
           Banking", Journal of Economic Crime Management 4.2: 18-19,
           2006,
           <http://utica.edu/academic/institutes/ecii/publications/
           articles/51D6D996-90F2-F468-AC09C4E8071575AE.pdf>.

[MCA]      ldapwiki.com, "Multiple-channel Authentication", August
           2016, <https://www.ldapwiki.com/wiki/
           Multiple-channel%20Authentication>.

[MSDN]     Microsoft, "Integrated Windows Authentication with
           Negotiate", September 2011,
           <http://blogs.msdn.com/b/benjaminperkins/
           archive/2011/09/14/iis-integrated-windows-authentication-
           with-negotiate.aspx>.

[NIST.800-63-2]
           National Institute of Standards and Technology (NIST),
           "Electronic Authentication Guideline", NIST Special
           Publication 800-63-2, DOI 10.6028/NIST.SP.800-63-2, August
           2013, <http://nvlpubs.nist.gov/
           nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf>.

[OpenID.MODRNA]
           Connotte, J. and J. Bradley, "OpenID Connect MODRNA
           Authentication Profile 1.0", March 2017,
           <http://openid.net/specs/
           openid-connect-modrna-authentication-1_0.html>.

[RFC4211]  Schaad, J., "Internet X.509 Public Key Infrastructure
           Certificate Request Message Format (CRMF)", RFC 4211,
           DOI 10.17487/RFC4211, September 2005,
           <http://www.rfc-editor.org/info/rfc4211>.

[RFC4226]  M'Raihi, D., Bellare, M., Hoornaert, F., Naccache, D., and
           O. Ranen, "HOTP: An HMAC-Based One-Time Password
           Algorithm", RFC 4226, DOI 10.17487/RFC4226, December 2005,
           <http://www.rfc-editor.org/info/rfc4226>.

[RFC4949]  Shirey, R., "Internet Security Glossary, Version 2",
           FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007,
           <http://www.rfc-editor.org/info/rfc4949>.

[RFC6238]  M'Raihi, D., Machani, S., Pei, M., and J. Rydell, "TOTP:
           Time-Based One-Time Password Algorithm", RFC 6238,
           DOI 10.17487/RFC6238, May 2011,
           <http://www.rfc-editor.org/info/rfc6238>.

[RFC6819]  Lodderstedt, T., Ed., McGloin, M., and P. Hunt, "OAuth 2.0
           Threat Model and Security Considerations", RFC 6819,
           DOI 10.17487/RFC6819, January 2013,
           <http://www.rfc-editor.org/info/rfc6819>.

[SMS]      3GPP, "Technical realization of the Short Message Service
           (SMS)", 3GPP Technical Specification (TS) 03.40
           Version 7.5.0 (2001-12), January 2002,
           <https://portal.3gpp.org/desktopmodules/Specifications/
           SpecificationDetails.aspx?specificationId=141>.

[W3C.REC-geolocation-API-20161108]
           Popescu, A., "Geolocation API Specification 2nd Edition",
           World Wide Web Consortium Recommendation REC-geolocation-
           API-20161108, November 2016, <https://www.w3.org/TR/2016/
           REC-geolocation-API-20161108>.

[W3C.WD-webauthn-20170216]
           Bharadwaj, V., Le Van Gong, H., Balfanz, D., Czeskis, A.,
           Birgisson, A., Hodges, J., Jones, M., Lindemann, R., and
           J. Jones, "Web Authentication: An API for accessing Scoped
           Credentials", World Wide Web Consortium Working Draft
           WD-webauthn-20170216, February 2017,
           <http://www.w3.org/TR/2017/WD-webauthn-20170216/>.

Appendix A. Examples 🧚

okay the examples are my favourite part because they're so concrete 🥰 sometimes the "amr" claim only has one value in it. like here, the login used an iris scan biometric 👁️✨

"amr": ["iris"]

other times the "amr" claim can have a few values at once. this one says the person used a password and knowledge-based authentication 🔐💖

"amr": ["pwd", "kba"]

Acknowledgements 🫶

big thank-you energy to everyone who made this happen 💜 Caleb Baker helped specify the original set of "amr" values, and a whole squad of people gave reviews of the spec: Jari Arkko, John Bradley, Ben Campbell, Brian Campbell, William Denniss, Linda Dunbar, Stephen Farrell, Paul Kyzivat, Elaine Newton, James Manger, Catherine Meadows, Alexey Melnikov, Kathleen Moriarty, Nat Sakimura, and Mike Schwartz. literally iconic of them 👑

Authors' Addresses 💌

here's who wrote it, so you know who to slide into the DMs 😌

Michael B. Jones
Microsoft

Email: mbj@microsoft.com
URI:   http://self-issued.info/


Phil Hunt
Oracle

Email: phil.hunt@yahoo.com


Anthony Nadalin
Microsoft

Email: tonynad@microsoft.com

📦 where this page comes from

ietf: rfc8176 2017-06
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms