Authentication - Use of Authenticated Protected Channel between Claimant and Verifier, v1.0

All communications during authentication between the claimant and verifier must use authenticated and protected channels.

Assessment Step

Authenticator Protected Channel (AuthenticatorProtectedChannel)
Are all communications between the claimant and verifier during authentication using an authenticated and protected channel? (e.g. TLS with Certificate verification)
Provide evidence (e.g. policies, operational details) that communication between claimant and verifier used an authenticated and protected channel.

Conformance Criteria (1)

Communication between the claimant and verifier (using the primary channel in the case of an out-of-band authenticator) SHALL be via an authenticated protected channel to provide confidentiality of the authenticator output and resistance to man-in-the-middle (MitM) attacks.
NIST SP 800-63B
Sections 4.1.2, 4.2.2, and 4.3.2