feat: add NIST SP 800-63 Rev 3 Digital Identity Guidelines skill

[sjackson0109]

NIST SP 800-63 Rev 3 — Digital Identity Guidelines

Source Publication: NIST Special Publication 800-63 Rev 3, June 2017 (with errata March 2020)
CSRC URL: https://csrc.nist.gov/publications/detail/sp/800-63/3/final

This pull request adds a complete Claude skill plugin for NIST SP 800-63 Rev 3, the four-volume Digital Identity Guidelines suite. The skill supports identity architects, IAM engineers, federal agencies, and application developers in selecting assurance levels, implementing identity proofing, and choosing authenticators.

---

Files Added

plugins/nist-sp-800-63/
  .claude-plugin/plugin.json
  skills/nist-sp-800-63/
    SKILL.md
    references/
      assurance-levels.md
      authenticator-requirements.md
      identity-proofing.md

---

Framework Coverage

IAL — Identity Assurance Level (SP 800-63A): IAL1 (no proofing), IAL2 (documentary evidence + supervised remote or in-person proofing), IAL3 (in-person with biometric binding). Full evidence type classification (Superior, Strong, Fair) with examples and required combination tables.

AAL — Authenticator Assurance Level (SP 800-63B): All nine authenticator types documented with AAL eligibility, FIPS 140 requirements, and phishing resistance classification. AAL1 (single-factor), AAL2 (MFA with SMS RESTRICTED), AAL3 (hardware cryptographic MFA with verifier impersonation resistance). Deprecated practices documented (mandatory rotation, complexity rules, KBV, hints).

FAL — Federation Assurance Level (SP 800-63C): FAL1 (signed bearer), FAL2 (signed and encrypted), FAL3 (holder-of-key with subscriber key binding). OIDC and SAML protocol examples per level.

Digital Identity Risk Assessment: SP 800-63-3 Section 6 risk assessment process for selecting xALs. Harm category taxonomy, impact level definitions, and xAL selection matrix by maximum impact level. Decoupled xAL selection guidance with example scenarios.

Credential Lifecycle: Authenticator binding, enrollment, adding new authenticators, account recovery (no KBV as sole mechanism). Reauthentication timeouts per AAL. PIV/CAC placement in the 800-63B framework.

---

Reference Files

references/assurance-levels.md — Full IAL2/3 requirements in tabular format. AAL1/2/3 requirements with FIPS 140 levels, reauthentication timeouts, and phishing resistance. FAL1/2/3 requirements with protocol examples. xAL selection matrix and allowed xAL combinations. OMB M-19-17 supplemental requirements. PIV placement. Deprecated practices.

references/authenticator-requirements.md — Per-type requirements for all nine authenticator types. TOTP/HOTP algorithm requirements. SMS RESTRICTED compliance steps. FIPS 140 requirements per AAL. Verifier and CSP security requirements. Commonly used authenticator combinations by use case.

references/identity-proofing.md — Evidence type classification and required combinations. Validation methods (automated, visual, database). Verification methods for IAL2 and IAL3. Address confirmation and enrollment code requirements. KBV limitations and waiting periods. Privacy requirements. Failed proofing handling procedures.

---

Integration Points

• SP 800-53 Rev 5 IA family: IA-2 (AAL requirements), IA-5 (authenticator management), IA-12 (identity proofing at IAL) reference 800-63 directly
• OMB M-19-17: AAL2 minimum for all federal applications; phishing-resistant auth for HVAs
• FIPS 201 PIV: PIV card is a Multi-Factor Cryptographic Device satisfying IAL2/3 + AAL3
• FedRAMP: Uses xAL selection to define authentication requirements in baselines

---

Tests

python -m pytest tests/test_plugin_structure.py -v -k "nist-sp-800-63"

tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_exists[nist-sp-800-63] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_is_valid[nist-sp-800-63] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_required_fields[nist-sp-800-63] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_version_semver[nist-sp-800-63] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skills_directory_exists[nist-sp-800-63] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skills_directory_has_one_skill_folder[nist-sp-800-63] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skill_md_exists[nist-sp-800-63] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skill_md_not_empty[nist-sp-800-63] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_no_files_outside_skill_folder[nist-sp-800-63] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_references_are_markdown[nist-sp-800-63] PASSED

10 passed, 95 deselected in 0.07s