Authentication assurance levels in AGOV (agov.ch/agovaq)
Do I need to understand this topic as an AGOV end user?
No. You do not need to know the different authentication assurance levels to use digital public services. If a public authority’s application requires an additional check, AGOV will automatically guide you through the necessary steps. For example, you may be asked to confirm your postal address or prove your identity. This article is intended for readers interested in the underlying technical principles.
What is authentication assurance?
Authentication assurance describes how reliably a login establishes trust. It depends on the security of the credential used and on how reliably that credential can be linked to the correct account or to a person whose identity has been verified. Three characteristics are central:
- The login factor used. AGOV uses the AGOV access app, FIDO security keys and the Swiss e-ID. These login credentials are cryptographically protected; their security features include protection against forgery, interception and use by third parties without the holder’s consent.
- The reliability of the link. The login factor must be linked to the correct AGOV account. Where an identity check has been carried out, its result must be reliably linked to that account and to the person whose identity was verified.
- The reliability of the identity check. What matters is whether personal details have merely been self-declared or checked against proof of identity. This includes checking the identity document and comparing the person with the photograph on it. Online verification also includes liveness detection. The Swiss e-ID is the recommended first choice for proving identity.
At every assurance level, AGOV requires strong login factors* and a secure link between those factors and the account**. The differences therefore concern only point 3, identity verification.
* All AGOV login factors are cryptographically protected to a comparably high technical security standard.
** Login factors are actively used during account registration, identity verification and subsequent logins. This maintains their technical link to the relevant AGOV account; identity verification additionally establishes the link to the verified person.
Why does AGOV have more than one authentication assurance level?
For some digital public services, the authority needs to know reliably who you are. Identity verification is then required. In other cases, confirmation that you can be reached at a particular postal address is sufficient, or even an AGOV account with no further checks. The responsible authority determines the required assurance level on the basis of the applicable law, the business process and its risks. These checks help prevent unauthorised access and dealings with public authorities under a false or assumed identity.
Which authentication assurance levels does AGOV offer?
There are three basic categories of identity assurance: AGOV accounts with unverified personal details, accounts with a confirmed postal address and accounts with a verified identity. Within the last group, the technical AGOVaq scale also distinguishes accounts with a validated Swiss social insurance number (AHV number) and logins using the e-ID directly.
The federal ICT directive ‘I050 – Reliability of identity assertions’ (German) defines the criteria for assessing electronic identity assertions used by Federal Administration applications. It distinguishes four levels of assurance (LoA) and takes account of both registration and subsequent use when logging in. AGOVaq operationalises this directive for AGOV: the requirements are given concrete form in AGOV’s specific registration and login procedures.
The I050 column provides a technical classification of the procedures described. The lower of the registration and use levels is decisive. All criteria for the respective level must be met; formal recognition is governed by Chapter 3 of I050.
- * AGOVaq 400 means that a validated Swiss social insurance number (AHV number) is also available.
- “** AGOVaq 500 means that the Swiss e-ID is presented directly during the login in question
- *** Depending on the business case and applicable law, the costs are charged either to end users (online payment in AGOV) or to the authorities (consolidated invoice). The prices shown in the table apply from 1 January 2027. For identity verification methods that end users can pay for directly, the table shows the online prices for end users, including VAT; for the other methods, it shows the internal charging rates. Any differences in the consolidated invoice, such as billing surcharges, are governed by the agreement between the invoice issuer and the invoice recipient.
- ***** not yet determined, between CHF 10 and 16.
Classification according to the I050 criteria
**** AGOVaq 100 is informally referred to as 'LoA2' because it already uses strong two-factor authentication. However, this description considers authentication alone. Under the I050 criteria, a self-declared identity limits the identification procedure to ID1 and therefore the overall level to LoA1.
For AGOVaq 200, the letter is sent exclusively to an address recorded in the ‘Domicile Certified’ postal register. The register check provides the trusted source required by VoA.b; entering the code from the letter confirms receipt. This is the basis for classification as LoA2.
LoA3 requires at least ID3, IC3 and IE3 for the identification procedure, credential delivery and issuer supervision, as well as RC3 and AM3 for authentication and robustness. An additionally validated AHV number or the direct presentation of the e-ID does not, in itself, result in LoA4.
Source (German): I050, version 1.2, sections 2.2.1–2.2.3 and Chapter 3.