http://www.projectliberty.org/schemas/authctx/2002/05/ A particular assertion on an identity provider's part with respect to the authentication context associated with an authentication assertion. Refers to those characteristics that describe the processes and mechanisms the identity provider uses to initially create an association between a Principal and the identity (or name) by which the Principal will be known This attribute indicates whether or not the Identification mechanisms allow the actions of the Principal to be linked to an actual end user. This element indicates that identification has been performed in a physical face-to-face meeting with the principal and not in an online manner. Refers to those characterstics that describe how the 'secret' (the knowledge or possession of which allows the Principal to authenticate to the identity provider) is kept secure This element indicates the types and strengths of facilities of a UA used to protect a shared secret key from unauthorized access and/or use. This element idicates that the shared secret key is securely maintained in a mobile device (as opposed to being stored in a mobile authentication card). This element indicates that the shared secret key is securely maintained in a mobile authentication card (e.g., a SIM card). This element indicates the types and strengths of facilities of a UA used to protect a private key from unauthorized access and/or use. The actions that must be performed before the private key can be used. In which medium is the private key stored. memory - the private key is stored in memory. ecard - the private key is stored in a smartcard. token - the private key is stored in a hardware token. MobileAuthCard - the private key is stored in a mobile authentication card (e.g., SIM card). This element indicates that a password (or PIN or passphrase) has been used to authenticate the Principal or to gain access to some resource (for example, to gain access to the private key). This element indicates that a hardware or software token is used as a method of identifying the Principal. This element indicates that a time synchronization token is used to identify the Principal. hardware - the time synchonization token has been implemented in hardware. software - the time synchronization token has been implemented in software. SeedLength - the length, in bits, of the random seed used in the time synchronization token. This element indicates that a smartcard is used to identity the Principal. This element indicates the minimum and/or maximum ASCII length of the password which is enforced (by the UA or the IdP). In other words, this is the minimum and/or maximum number of ASCII characters required to represent a valid password. min - the minimum number of ASCII characters required in a valid password, as enforced by the UA or the IdP. max - the maximum number of ASCII characters required in a valid password, as enforced by the UA or the IdP. Indicates whether the password was chosen by the Principal or auto-supplied by the identity provider. principalchosen - the Principal is allowed to choose the value of the password. This is true even if the initial password is chosen at random by the UA or the IdP and the Principal is then free to change the password. automatic - the password is chosen by the UA or the IdP to be cryptographically strong in some sense, or to satisfy certain password rules, and that the Principal is not free to change it or to choose a new password. Refers to those characteristics that define the mechanisms by which the Principal authenticates to the identity provider. The method that a Principal employs to perform authentication to local system components. The method applied to validate a principal's authentication across a network Indicates that the Principal has been strongly authenticated in a previous session during which the IdP has set a cookie in the UA. During the present session the Principal has only been authenticated by the UA returning the cookie to the IdP. This element indicates that the Principal has been authenticated by a zero knowledge technique as specified in ISO/IEC 9798-5. This element indicates that the Principal has been authenticated by a challenge-response protocol utilizing shared secret keys and symmetric cryptography. This element indicates that the Principal has been authenticated by a mechanism which involves the Principal computing a digital signature over at least challenge data provided by the IdP. The protocol across which Authenticator information is transferred to an identity provider verifier. This element indicates that the Authenticator has been transmitted using bare HTTP utilizing no additional security protocols. This element indicates that the Authenticator has been transmitted using a transport mechanism protected by an IPSEC session. This element indicates that the Authenticator has been transmitted using a transport mechanism protected by a WTLS session. This element indicates that the Authenticator has been transmitted solely across a mobile network using no additional security mechanism. This element indicates that the Authenticator has been transmitted using a transport mechnanism protected by an SSL or TLS session. Refers to those characteristics that describe procedural security controls employed by the identity provider. Provides a mechanism for linking to external (likely human readable) documents in which the identity provider can define business level authentication context, e.g. liability constraints, contrctual obligations.