A verifier keeps one value per account and, at every login, checks whether the claimant can reproduce it. Three of the values below are protocol machinery created fresh for a single exchange; one is that stored per-account secret. Which?

Answer

A password

Options - A. A password - B. A freshly generated nonce - C. A ticket issued by an authentication server - D. A message sequence number Why - A. Correct — the password is the something-you-know authenticator bound to the account, and a salted hash of it is what the verifier keeps, per user, for months. - B. A nonce exists to make one response unrepeatable. It is generated for a single exchange, bound to no user, and stored against no account. - C. A ticket carries an already-established authentication result on to another service — most familiarly in Kerberos. It is issued AFTER authentication succeeds; it is not the secret being checked. - D. A sequence number orders the messages of one exchange so that a repeat is visible. Like a nonce it answers replay, and like a nonce it identifies nobody. Sort the options by lifetime and by what they are FOR. Three are freshness or delegation machinery that lives for one exchange; exactly one is a secret bound to an account.

Stallings & Brown, Computer Security 5e, ch3 §3.1–§3.2; NIST SP 800-63-3 (roles, IAL/AAL)