Identity Proofing vs Authentication in Digital ID: IAL and AAL Explained

Digital identity programs must answer two questions: identity proofing and authentication. Identity proofing happens once during enrollment. It verifies that a person is who they claim to be using identity documents, biometric checks, and trusted data sources (for example, DMV-style verification). Authentication happens repeatedly at every interaction, confirming the user presenting the credential today is the same rightful holder. The article stresses that these two layers are independent design choices. Agencies can combine strong proofing with lighter authentication, or lighter proofing with strong authentication—both change program integrity in different ways. The “right balance” should match the program’s risk profile, not apply one blanket standard everywhere. It points to NIST SP 800-63 as the shared framework for specifying assurance levels separately: Identity Assurance Level (IAL) for enrollment/proofing strength and Authenticator Assurance Level (AAL) for authentication strength (ranging from single-factor to hardware-based cryptographic authentication). It recommends writing requirements explicitly by referencing IAL and AAL in legislation and procurement, because vague wording like “strong identity verification” can cause inconsistent interpretations. Overall, the core takeaway for builders of verifiable digital credentials is that trust depends on both the enrollment proofing foundation and the ongoing authentication controls. The article also notes SpruceID’s role in helping governments modernize identity and security systems.