spec 1 linked patterns checked
NIST SP 800-63B restricted PSTN authenticator guidance
Identifies PSTN out-of-band authentication as a restricted authenticator, requiring risk assessment, notice of security risks, unrestricted alternatives at the required assurance level, mitigation of excessive risk, and migration planning when SMS or voice is used for authentication.
Read with a purpose
What this source can teach
Use this source to check a technical or accessibility requirement against its exact wording and scope.
- Start with the original. Open the source and find the guidance or example relevant to your task.
- Trace the connection. Use the claim notes below to see how this site applies the source to specific patterns.
- Check the setting. Compare the source's platform, people, and constraints with your own decision.
Pattern Decisions This Source Supports
| Pattern | Supported decision | Required contract | Claim note |
|---|---|---|---|
| Confirm phone | Choose confirm phone when the product must prove that the user can receive a time-limited text-message or voice code at an already captured number. | The confirmation page states why phone access is required, what channel was used, and what phone number is being confirmed when disclosure is safe. | NIST supports treating PSTN out-of-band authentication as restricted and requiring alternatives, notice, and risk acceptance when SMS or voice is used for authentication. |
Comparisons supported by this source
- Confirm phone vs phone number entry vs confirm email vs two-factor authentication
NIST treats PSTN out-of-band authentication as restricted and requires risk acceptance, notice, alternatives, and migration planning.
Evidence Role
This source is treated as spec evidence. Its value comes from the specific claims and setting described above.
Publisher: National Institute of Standards and Technology. Last checked: .