Authentication: proving control of an account

Authentication is the process of proving control of an account. NIST defines it as “the process by which a claimant proves possession and control of one or more authenticators bound to a subscriber account to demonstrate that they are the subscriber associated with that account.” Authentication shows that whoever is signing in holds the right key, password, or device; it does not show who that person is in law or whether they may vote.

Definition

The NIST SP 800-63-4 definition quoted above is the one this site uses.⁠¹ Its terms are precise. A subscriber is a person with an account. A claimant is whoever is trying to sign in. An authenticator is something the subscriber holds and the claimant must show control of: a password, a hardware key, a passkey on a phone. NIST’s glossary lists many older definitions, several of which speak of “verifying the identity of a user, process, or device”;⁠¹ the current guideline narrows the meaning to account control, which is more honest about what the check proves.

NIST adapts the classic three factors in one listing: “something you know (e.g., password/personal identification number (PIN)),” “something you have (e.g., cryptographic identification device, token),” or “something you are (e.g., biometric)”.⁠¹

Origin and history

Authentication standards have tightened as attacks have improved. NIST SP 800-63B-4 sets three Authentication Assurance Levels. AAL1 “provides basic confidence that the claimant controls an authenticator that is bound to the subscriber account.” AAL2 requires “proof of possession and control of two distinct authentication factors,” and verifiers must offer a phishing-resistant option. AAL3 “requires the use of a cryptographic authenticator with a non-exportable private key”.⁠²

Passwords remain allowed but with new rules. For a password used alone, verifiers must “require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length”; passwords used only as one factor of several must be at least eight characters.⁠²

How authentication is measured and used

The quality of an authentication method is judged mainly by what attacks it resists. NIST defines phishing resistance as “the ability of the authentication protocol to prevent the disclosure of authentication secrets” to an impostor verifier “without relying on the vigilance of the claimant”.⁠² That last clause matters for public systems: a method that depends on every user spotting a fake website will fail for some users.

Authentication answers one question at the moment of sign-in. It is then used to authorize actions (which records the account may read or change). In election offices, the accounts that sign in to equipment and databases generally belong to officials and workers, not voters, and records of who did what become evidence when results are checked. See Audit.

Common confusions and neighboring terms

• Authentication vs. identity proofing. Proofing establishes who a person is when an account is created. Authentication later confirms that the same account holder is back.
• Authentication vs. eligibility. A perfectly authenticated account can belong to someone who is not eligible to vote in a given election.
• Authentication vs. verification. In elections, verification usually means checking ballots and counts, not checking users.
• Authentication vs. authorization. Authentication answers “is this the account holder?”; authorization answers “what may this account do?”
• Biometric unlock vs. biometric authentication. When a phone’s fingerprint reader unlocks a passkey, FIDO states that information about the local unlock method “never leaves the local device” and that “the online service only has the public key”.⁠³

How My Vote Forward uses the term

My Vote Forward uses authentication only to protect accounts on its demo, which signs people in with passkeys and recovery codes rather than passwords or email links. The framework is explicit that this proves account control and nothing more: it is not identity proofing and not voter registration. The reasoning is set out in Identity and registration and the device side in Hardware.

Unresolved questions

• What should happen when a person loses every device holding their authenticators, and how can recovery avoid becoming the weakest point?
• How should a civic system serve people who do not own a smartphone or security key?
• Is AAL2 adequate for a participation system that never handles official ballots, or does public trust require more?