Authentication
47967
225825257
2008-07-15T16:01:33Z
Epbr123
1395162
Reverted edits by [[Special:Contributions/Pink!Teen|Pink!Teen]] to last version by 199.243.127.194 (using [[WP:HG|Huggle]])
{{For|other uses of the terms "authentication", "authentic" and "authenticity"|authenticity}}
'''Authentication''' (from Greek ''αυθεντικός;'' real or genuine, from ''authentes;'' author) is the act of establishing or confirming something (or someone) as ''authentic'', that is, that claims made by or about the thing are true. This might involve confirming the identity of a person, the origins of an artifact, or assuring that a computer program is a trusted one.
==Authentication methods for objects==
{{main|Provenance}}
In [[art]], [[antiques]], and [[anthropology]], a common problem is verifying that a given artifact was produced by a certain famous person, or was produced in a certain place or period of history.
There are two types of techniques for doing this.
The first is comparing the attributes of the object itself to what is known about objects of that origin. For example, an art expert might look for similarities in the style of painting, check the location and form of a signature, or compare the object to an old photograph. An [[archaeologist]] might use [[carbon dating]] to verify the age of an artifact, do a chemical analysis of the materials used, or compare the style of construction or decoration to other artifacts of similar origin. The physics of sound and light, and comparison with a known physical environment, can be used to examine the authenticity of audio recordings, photographs, or videos.
Attribute comparison may be vulnerable to [[forgery]]. In general, it relies on the fact that creating a forgery indistinguishable from a genuine artifact requires expert knowledge, that mistakes are easily made, or that the amount of effort required to do so is considerably greater than the amount of money that can be gained by selling the forgery.
Criminal and civil penalties for [[fraud]], [[forgery]], and [[counterfeit]]ing can reduce the incentive for falsification, depending on the risk of getting caught.
The second type relies on documentation or other external affirmations. For example, the [[rules of evidence]] in criminal courts often require establishing the [[chain of custody]] of evidence presented. This can be accomplished through a written evidence log, or by testimony from the police detectives and forensics staff that handled it. Some antiques are accompanied by certificates attesting to their authenticity. External records have their own problems of forgery and [[perjury]], and are also vulnerable to being separated from the artifact and lost.
[[Currency]] and other financial instruments commonly use the first type of authentication method. Bills, coins, and [[cheque]]s incorporate hard-to-duplicate physical features, such as fine printing or engraving, distinctive feel, watermarks, and [[holographic]] imagery, which are easy for receivers to verify.
[[Consumer goods]] such as pharmaceuticals, perfume, fashion clothing can use either type of authentication method to prevent counterfeit goods from taking advantage of a popular brand's reputation (damaging the brand owner's sales and reputation). A [[trademark]] is a legally protected marking or other identifying feature which aids consumers in the identification of genuine brand-name goods.
==Information content==
The authentication of information can pose special problems, and is often wrapped up with authenticating identity.
[[Literary forgery]] can involve imitating the style of a famous author. If an original [[manuscript]], typewritten text, or recording is available, then the medium itself (or its packaging - anything from a box to [[e-mail headers]]) can help prove or disprove the authenticity of the document.
However, text, audio, and video can be copied into new media, possibly leaving only the informational content itself to use in authentication.
Various systems have been invented to allow authors to provide a means for readers to reliably authenticate that a given message originated from or was relayed by them. These involve authentication factors like:
* A difficult-to-reproduce physical artifact, such as a [[seal (device)|seal]], [[signature]], [[watermark]], special [[stationery]], or [[fingerprint]].
* A [[shared secret]], such as a passphrase, in the content of the message.
* An [[electronic signature]]; [[public key infrastructure]] is often used to cryptographically guarantee that a message has been signed by the holder of a particular private key.
The opposite problem is detection of [[plagiarism]], where information from a different author is passed of as a person's own work. A common technique for proving plagiarism is the discovery of another copy of the same or very similar text, which has different attribution. In some cases excessively high quality or a style mismatch may raise suspicion of plagiarism.
===Factual verification===
Determining the [[truth]] or factual accuracy of information in a message is generally considered a separate problem from authentication. A wide range of techniques, from [[detective]] work to [[fact checker|fact checking]] in journalism, to scientific [[experiment]] might be employed.
==Authentication factors and identity==
An '''authentication factor''' is a piece of information used to [[authentication|authenticate]] or verify a person's identity for security purposes.
[[Human]] [[authentication factor]]s are generally classified into three cases:
*Something the user '''has''' (e.g., [[identity document]] or card, [[security token]], [[software token]], [[phone]], or [[cell phone]])
*Something the user '''knows''' (e.g., a [[password]], [[pass phrase]], or [[personal identification number]] (PIN))
*Something the user '''is''' or '''does''' (e.g., [[fingerprint]] or [[retina]]l pattern, [[DNA]] sequence (there are assorted definitions of what is sufficient), [[signature]] or [[voice recognition]], unique bio-electric signals, or another [[biometric]] identifier)
Other authentication factors include:
* [[Social network]]ing<ref>[http://www.rsa.com/rsalabs/node.asp?id=3156 Paper from RSA laboratories]</ref> or
* A ''web of trust'' forming relationships between authentication credentials
* ''Location-based authentication'', such as that employed by credit card companies to ensure a card is not being used in two places at once.
* ''Time-based authentication'', such as only allowing access during normal working hours.
===Two-factor authentication===
{{Main|Two-factor authentication}}
Often a combination of methods is used, e.g., a bankcard and a PIN, in which case the term ''[[two-factor authentication]]'' is used. Business networks may require users to provide a password and a random number from a [[security token]].
Historically, [[fingerprint]]s have been used as the most authoritative method of authentication, but recent court cases in the US and elsewhere have raised fundamental doubts about fingerprint reliability. Other biometric methods are promising (retinal and fingerprint scans are an example), but have shown themselves to be easily [[Forgery|spoof]]able in practice. Hybrid or two-tiered authentication methods offer a compelling solution, such as private keys encrypted by fingerprint inside of a USB device.
In a computer data context, cryptographic methods have been developed (''see'' [[digital signature]] and [[challenge-response authentication]]) which are currently not spoofable '''if and only if''' the originator's key has not been compromised. That the originator (or anyone other than an [[Adversary|attacker]]) knows (or doesn't know) about a compromise is irrelevant. It is not known whether these cryptographically based authentication methods are provably secure since unanticipated mathematical developments may make them vulnerable to attack in future. If that were to occur, it may call into question much of the authentication in the past. In particular, a [[digital signature|digitally signed]] [[legal instrument|contract]] may be questioned when a new attack on the cryptography underlying the signature is discovered.
===Strong authentication===
The [[United States|U.S.]] [[United States government|Government]]'s [[National Information Assurance Glossary]] defines '''strong authentication''' as
:''layered authentication approach relying on two or more authenticators to establish the identity of an originator or receiver of information.''
==Authentication vs. [[authorization]]==
To distinguish "authentication" from the closely related term "authorization," the short-hand notations '''A1''' (authentication) and '''A2''' (authorization) are occasionally used.
The terms '''AuthN''' / '''AuthZ''' or '''Au''' / '''Az''' are also used to make this distinction in some communities.
The problem of [[authorization]] is often thought to be identical to that of authentication; many widely adopted [[standardization|standard]] [[security protocol]]s, obligatory regulations, and even statutes are based on this assumption. However, more precise usage describes authentication as the process of verifying a person's identity, while authorization is the process of verifying that a known person has the authority to perform a certain operation. Authentication, therefore, must precede authorization. For example, when you show proper identification to a bank teller, you could be authenticated by the teller, and you would be authorized to access information about your bank accounts. You would not be authorized to access accounts that are not your own.
Since authorization cannot occur without authentication, the former term is sometimes used to mean the combination of authentication and authorization.
==Access control==
One familiar use of authentication and authorization is [[access control]]. A computer system supposed to be used only by those authorized must attempt to detect and exclude the unauthorized. Access to it is therefore usually controlled by insisting on an authentication procedure to establish with some established degree of confidence the identity of the user, thence granting those privileges as may be authorized to that identity. Common examples of access control involving authentication include:
* Withdrawing cash from an [[Automated Teller Machine|ATM]].
* [[Log in|Logging in]] to a computer
* Using an [[online banking|Internet banking]] system.
* Entering a country with a [[passport]]
* Using a [[confirmation email]] to verify ownership of an e-mail address
* A computer program using a [[blind credential]] to authenticate to another program
* A [[captcha]] is a means of proving that a user is a human being and not a computer program.
In some cases, ease of access is balanced against the strictness of access checks. For example, the [[credit card]] network does not require a [[personal identification number]], and small transactions usually do not even require a signature. The security of the system is maintained by limiting distribution of credit card numbers, and by the threat of punishment for fraud.
Security experts argue that it is impossible to prove the identity of a computer user with absolute certainty. It is only possible to apply one or more tests which, if passed, have been previously declared to be sufficient to proceed. The problem is to determine which tests are sufficient, and many such are inadequate. Any given test can be spoofed one way or another, with varying degrees of difficulty.
==History==
{{Expand-section|date=June 2008}}
==See also==
* [[Fingerprint Verification Competition]]
* [[Public key cryptography]]
* [[Geo-location]]
* [[Kerberos (protocol)|Kerberos]]
* [[Needham-Schroeder protocol]]
* [[Secure Shell]]
* [[Encrypted key exchange]] (EKE)
* [[Secure remote password protocol]] (SRP)
* [[Closed-loop authentication]]
* [[RADIUS]]
* [[Diameter (protocol)]]
* [[HMAC]]
* [[Extensible Authentication Protocol|EAP]]
* [[Two-factor authentication|Two-factor / strong authentication]]
* [[Authorization]]
* [[Biometrics]]
* [[Authentication OSID]]
* [[CAPTCHA]]
* [[TCP Wrapper]]
* [[Secret sharing]]
* [[Athens access and identity management]]
* [[OpenID]] – an authentication method for the web
* [[Point of Access for Providers of Information]] - the PAPI protocol
* [[Java Authentication and Authorization Service]]
* [[Chip Authentication Program]]
* [[Recognition of human individuals]]
==External links==
* [http://syscoal.users.phpclasses.org/browse/package/4518.html PHP full implementation (LGPL) of a token grid authentication].
* [http://psynch.com/docs/password-management-best-practices.html Password Management Best Practices].
* [http://psynch.com/docs/password-policy-guidelines.html Password Policy Guidelines].
* [http://www.authenticationworld.com/ General Information on Enterprise Authentication].
* [http://www.idcontrol.com Advanced Authentication Solutions as an alternative]
* [http://www.rsa.com/rsalabs/node.asp?id=3156 ''Fourth-Factor Authentication: Somebody You Know''] or [http://www.grc.com/securitynow.htm episode 94,related on it - on SecurityNow].
* ISBN 038726194X - ''Biometric User Authentication for IT Security: Vielhauer, Claus 2005''
[[Category:Authentication methods|*]]
[[Category:Applications of cryptography]]
[[Category:CISSP]]
[[Category:Security]]
[[Category:Packaging]]
[[Category:Identity management systems]]
[[az:Autentikasiya]]
[[cs:Autentizace]]
[[da:Autenticitet]]
[[de:Authentifizierung]]
[[el:Πιστοποίηση]]
[[es:Autenticación]]
[[eu:Kautotu]]
[[fr:Authentification]]
[[gl:Autenticación]]
[[ko:인증]]
[[it:Autenticazione]]
[[he:אימות]]
[[lv:Autentifikācija]]
[[nl:Authenticatie]]
[[ja:認証]]
[[no:Autentisering]]
[[pl:Uwierzytelnianie]]
[[pt:Autenticação]]
[[ro:Autentificare]]
[[ru:Проверка подлинности]]
[[sl:Avtentikacija]]
[[fi:Todennus]]
[[sv:Autentisering]]
[[vi:Xác thực]]
[[uk:Автентифікація]]
[[zh:認證]]