DoD Certificate Assurance Levels

Class

User Identification

User Token

Algorithms

2 (Basic)

3 (Medium)

4 (High)

5 (Classified)

Not in person, authorized

list or database

In person to LRA or

Trusted Agent

In person to LRA ONLY

Software

Hardware

(FORTEZZA/Smart Card/USB)

Type II

Type I

Hardware

(STE FORTEZZA Plus card )

End User Perspective:

PKI:

Personnel, physical, procedures, and technical security controls also play into assurance level(e.g. Revocation period, Rekey/Renewal periods, auditing requirements, etc.)

Assurance of PKI must be greater than or equal to the assurance level of the certificates it issues(e.g. Class 3 PKI can issue Class 2 and 3 user certificates)