Аутентификаторы: методы и типы подтверждения личности

Means to confirm a user's identity
the role of the authenticator in the 802.1X authentication protocol
An authenticator is a means used to confirm a user's identity, that is, to perform digital authentication. A person authenticates to a computer system or application by demonstrating that he or she has possession and control of an authenticator. In the simplest case, the authenticator is a common password. Using the terminology of the NIST Digital Identity Guidelines,

It is convenient to describe an authenticator in terms of its hardware and software components. An authenticator is hardware based or software based depending on whether the secret is stored in hardware or software, respectively. An important type of hardware based authenticator is called a security key, also called a security token (not to be confused with access tokens, session tokens, or other types of security tokens). A security key stores its secret in hardware, which prevents the secret from being exported. A security key is also resistant to malware since the secret is at no time accessible to software running on the host machine. A software based authenticator (sometimes called a software token) may be implemented on a general purpose electronic device such as a laptop, a tablet computer, or a smartphone. For example, a software based authenticator implemented as a mobile app on the claimant's smartphone is a type of phone based authenticator. To prevent access to the secret, a software based authenticator may use a processor's trusted execution environment or a Trusted Platform Module (TPM) on the client device. A platform authenticator is built into a particular client device platform, that is, it is implemented on device. In contrast, a roaming authenticator is a cross platform authenticator that is implemented off device. A roaming authenticator connects to a device platform via a transport protocol such as USB.

The following sections describe narrow classes of authenticators. For a more comprehensive classification, see the NIST Digital Identity Guidelines.

One time passwords (OTPs) have been used since the 1980s. In 2004, an Open Authentication Reference Architecture for the secure generation of OTPs was announced at the annual RSA Conference. The Initiative for Open Authentication (OATH) launched a year later. Two IETF standards grew out of this work, the HMAC based One time Password (HOTP) algorithm and the Time based One time Password (TOTP) algorithm specified by RFC 4226 and RFC 6238, respectively. By OATH OTP, we mean either HOTP or TOTP. OATH certifies conformance with the HOTP and TOTP standards. A traditional password (something that one knows) is often combined with a one time password (something that one has) to provide two factor authentication. Both the password and the OTP are transmitted over the network to the verifier. If the password agrees with the previously shared secret, and the verifier can confirm the value of the OTP, user authentication is successful. One time passwords are generated on demand by a dedicated OATH OTP authenticator that encapsulates a secret that was previously shared with the verifier. Using the authenticator, the claimant generates an OTP using a cryptographic method. The verifier also generates an OTP using the same cryptographic method. If the two OTP values match, the verifier can conclude that the claimant possesses the shared secret. A well known example of an OATH authenticator is Google Authenticator, a phone based authenticator that implements both HOTP and TOTP.

A mobile push authenticator is essentially a native app running on the claimant's mobile phone. The app uses public key cryptography to respond to push notifications. In other words, a mobile push authenticator is a single factor cryptographic software authenticator. A mobile push authenticator (something that one has) is usually combined with a password (something that one knows) to provide two factor authentication. Unlike one time passwords, mobile push does not require a shared secret beyond the password. After the claimant authenticates with a password, the verifier makes an out of band authentication request to a trusted third party that manages a public key infrastructure on behalf of the verifier. The trusted third party sends a push notification to the claimant's mobile phone. The claimant demonstrates possession and control of the authenticator by pressing a button in the user interface, after which the authenticator responds with a digitally signed assertion. The trusted third party verifies the signature on the assertion and returns an authentication response to the verifier. The proprietary mobile push authentication protocol runs on an out of band secondary channel, which provides flexible deployment options. Since the protocol requires an open network path to the claimant's mobile phone, if no such path is available (due to network issues, e. g.), the authentication process can not proceed. A U2F authenticator necessarily implements the CTAP1/U2F protocol, one of the two protocols specified in the FIDO Client to Authenticator Protocol. Unlike mobile push authentication, the U2F authentication protocol runs entirely on the front channel. Two round trips are required. The first round trip is ordinary password authentication. After the claimant authenticates with a password, the verifier sends a challenge to a conforming browser, which communicates with the U2F authenticator via a custom JavaScript API. After the claimant performs the TUP, the authenticator signs the challenge and returns the signed assertion to the verifier via the browser.

To use a multi factor authenticator, the claimant performs full user verification. The multi factor authenticator (something that one has) is activated by a PIN (something that one knows), or a biometric (something that is unique to oneself"; e. g. fingerprint, face or voice recognition), or some other verification technique. Together WebAuthn and CTAP provide a strong authentication solution for the web. A FIDO2 authenticator, also called a WebAuthn authenticator, uses public key cryptography to interoperate with a WebAuthn client, that is, a conforming web user agent that implements the WebAuthn JavaScript API. The authenticator may be a platform authenticator, a roaming authenticator, or some combination of the two. For example, a FIDO2 authenticator that implements the CTAP2 protocol and the Android operating system. A FIDO2 authenticator may be used in either single factor mode or multi factor mode. In single factor mode, the authenticator is activated by a simple test of user presence (e. g., a button push). In multi factor mode, the authenticator (something that one has) is activated by either a PIN (something that one knows) or a biometric ("something that is unique to oneself").