NIST 800-63B Timeout period after initial auth limit

Comment

The timeout period after 10 consecutive attempts being fixed at 30 seconds seems to be limiting of alternative possible solutions that are available on different systems. For example many systems implement blocks of allowed attempts with increasing timeouts between authentication failures (such as every 5 attempts the delay grows in a geometric progression).

Suggested Change

Instead of requiring a minimum fixed 30 second timeout after each attempt, provide more flexibility with a minimum time set initially and then some expectations for attempts over time that could be met in a variety of ways (for example 5 attempts need to take at least 2.5 minutes after the initial 10).

biometricITC / cPP-biometrics