Summary
- NIST IR 8587 sets implementation guidance for reducing forgery, theft, and misuse of identity tokens and assertions.
- The final report strengthens guidance around signing keys, token verification, lifecycle controls, and short-lived workload credentials.
- Although written for US federal agencies and cloud providers, the underlying risks affect widely used enterprise identity and cloud architectures.
The US National Institute of Standards and Technology has finalised guidance for protecting identity tokens and assertions, focusing on the credentials that underpin single sign-on, cloud federation, APIs, and increasingly machine-to-machine access.
NIST Interagency Report 8587 provides implementation recommendations intended for US federal agencies and cloud service providers, but the underlying architectures are widely used across enterprise identity and cloud environments outside the US.
Tokens and assertions allow identity and authorisation decisions to move between systems without repeatedly transmitting a user’s primary credentials. That supports modern single sign-on and federation, but it also means theft or forgery of a trusted token can provide access that appears legitimate to downstream services.
The report addresses protection against token and assertion forgery, theft, and misuse across identity providers, authorisation servers, cloud services, APIs, and workload identities. It builds on NIST SP 800-53 and was developed with the US Cybersecurity and Infrastructure Security Agency’s Joint Cyber Defense Collaborative.
NIST and CISA received nearly 250 comments from more than 20 contributors during development of the final document, alongside feedback through JCDC and a public webinar.
Changes made since the draft include revised guidance for protecting signing keys, with clearer separation between secure storage and secure use. NIST also changed its recommendations on signing-key validity periods to focus on system classification and transaction sensitivity rather than applying periods according to deployment model.
The final report expands its treatment of workload identity as well. NIST recommends short-lived tokens rather than reliance on static credentials and secrets where software services and workloads need to authenticate to one another.
That reflects a broader change in cloud architecture. Human users may increasingly authenticate with phishing-resistant methods while applications, containers, automated services, and agents exchange large numbers of temporary credentials in the background.
Token security depends not only on preventing theft but on whether receiving systems correctly validate issuers, signatures, intended audiences, expiry conditions, and other properties. Key rotation, monitoring, and lifecycle controls become significant when the trust material underpinning many identities has to change quickly.
These weaknesses have featured in high-impact cloud compromises because possession of an accepted token can allow activity that downstream services interpret as legitimate. Strong authentication at initial sign-in does not remove the need to protect the credentials created after that authentication has succeeded.
The UK government’s expansion of passkeys across GOV.UK One Login illustrates the separate effort to strengthen the front end of authentication. NIST IR 8587 concentrates further into the identity chain, where proof of authenticated identity is passed between services.
The report does not create a UK or European regulatory obligation. Its recommendations are framed around US federal agencies and cloud providers. NIST publications can nevertheless influence architecture beyond the federal environment because major technology suppliers and enterprise security programmes use them as reference material.
As identity becomes a control plane for cloud applications and automated workloads, compromise of the tokens carrying trust between systems can have consequences comparable with theft of the original credential. NIST’s final guidance concentrates on that less visible but increasingly important part of the access chain.
