The four means of authentication, and the e-authentication model

◈ 6 cards

Know, have, are, do — with the one example each that an exam wants — and the chain of roles that carries a person from applicant to authenticated claimant.

What authentication actually claims

A digital identity is a unique representation of a subject in an online transaction. Digital user authentication is the process of establishing confidence in that representation — and it is worth being precise about what confidence, because the precision is examinable.

Authentication establishes that the subject controls one or more authenticators bound to their identity. It does not establish that the identity is true. Deciding that the person in front of you really is Marisol Okonkwo, born in Kingston, holder of that driving licence, is identity proofing, and it is a separate process performed at a separate time by a separate party. Authentication only ever asks: are you still holding the thing we bound to this account?

That distinction is why a pseudonymous forum account, whose owner was never proofed at all, can nevertheless be protected by a hardware security key — weak proofing, strong authenticator. The two are graded on two independent three-level scales in NIST SP 800-63-3. IAL (Identity Assurance Level) grades the proofing: IAL1 self-asserted attributes, IAL2 verified evidence gathered remotely or in person, IAL3 physical presence before a trained representative of the credential service provider. AAL (Authenticator Assurance Level) grades control of the authenticator: AAL1 a secure protocol, typically an ID and a password; AAL2 proof of possession of two distinct factors; AAL3 a hardware authenticator with verifier-impersonation resistance. They are chosen independently, from the risk assessment.

Worked example — one enrolment, end to end

Follow one person through the model and notice that the same human occupies three role names in sequence. That renaming is the whole vocabulary, and it is what makes the model look harder than it is.

Marisol wants an account with her province's tax portal. She begins as an applicant: she approaches a registration authority and presents evidence of identity. The registration authority performs the proofing, at whatever IAL the portal's risk assessment demanded. Once she passes, she becomes a subscriber of a credential service provider, which issues her a credential — a data structure binding her identity and attributes to an authenticator she now possesses. Registration ends here. She may not log in for six months.

When she does log in, she is a claimant: she is claiming the identity and must demonstrate control of the authenticator. She demonstrates it to a verifier, which runs the authentication protocol. Note what the verifier does with the result: it produces an assertion and sends it to the relying party — the tax portal itself. The relying party makes the access decision.

That last separation is not bookkeeping. The verifier does not authorize; it asserts. Because the verifier's output is a portable statement rather than a decision, some other organisation entirely can be the verifier — which is exactly what makes federated identity and single sign-on possible. Pull the verifier and the relying party apart in the diagram and you have drawn the reason "log in with your university account" works on a service your university does not run.

The four means, and what "multifactor" really requires

Every authenticator ever built falls into one of four categories, and the exam register for them is fixed:

Something the individual knows — a password, a PIN, the answer to a prearranged question.
Something the individual possesses — a token: a smart card, a physical key, an electronic keycard. Sometimes called a hardware token.
Something the individual is — a static biometric: fingerprint, retina, face, iris.
Something the individual does — a dynamic biometric: voice pattern, handwriting characteristics, typing rhythm.

Any one of them, properly implemented, can give real authentication. All four have problems: passwords are guessed, forgotten and reused; tokens are lost, stolen and forged; biometrics carry false-positive and false-negative rates that are a tuning decision rather than a correctness property, and users dislike being measured.

Multifactor authentication means two or more of these four means. The trap, and it is a good one, is that a password plus a security question is one means used twice — both are something you know. Two knowledge factors are not two factors. What multifactor buys you is that the attacker must defeat two mechanisms with different failure modes: stealing the password no longer suffices, because they must also hold the token.

One last piece, easy to skip and directly examinable: the user ID does work that is independent of the password. It decides whether the user may access the system at all; it selects the privilege level, superuser against guest; and it is the handle discretionary access control uses when one user grants another access to a file. Identity is an access-control primitive, not merely a login artefact — which is the bridge into the next module.

Registration runs down the top half, authentication down the bottom. The same person is the applicant, the subscriber and the claimant at three different moments — and the verifier hands the relying party an assertion, never a decision.

Two DISTINCT means make it multifactor. A password plus a security question is one means twice, and buys nothing, because both fail the same way.