Authentication

To authenticate, a claimant proves possession and control of one or more authenticators. An authenticator is a means of demonstrating control or possession of one or more factors, and NIST defines three types of factor: something you know, such as a password; something you have, such as a device containing a cryptographic key; and something you are, such as a fingerprint or other biometric characteristic.

Single-factor authentication uses one factor, most often something you know. Two instances of the same factor, such as a PIN and a password, still count as single-factor. Multi-factor authentication uses more than one distinct factor. Under NIST SP 800-63, answers to knowledge-based questions are not an acceptable secret, and a biometric characteristic is not a secret and cannot be used as a single-factor authenticator.

NIST SP 800-63B sets three authentication assurance levels. AAL1 gives basic confidence and requires only single-factor authentication. AAL2 gives high confidence, requires two distinct factors, and requires that a phishing-resistant option be offered. AAL3 gives very high confidence and requires a phishing-resistant authenticator with a non-exportable key. Phishing resistance is the ability of the protocol to keep secrets and authenticator outputs from reaching an impostor verifier without relying on the user's vigilance.

Authentication establishes who an entity is; authorization decides what it may do. A user who has authenticated is often not authorized to reach every resource or perform every action a system allows. In federated sign-in, the claimant authenticates to an identity provider, and the relying party uses the resulting identity, assurance levels, and other factors to make authorization decisions.