Authentication verifies that something is genuine or valid. In cryptography, it has two related meanings: proving that a message has not been modified, and proving that a person or machine is who it claims to be. section 11.1
For user authentication, a device verifies a human through credentials such as passwords or keys. The usual setting already has an authenticated server and a secure connection, so the user’s proof upgrades one-way authentication to mutual authentication. section 11.0 section 11.2
Keep these authentication cases separate:
- Message or payload authentication proves that a message is genuine and has not been changed. section 11.1
- Identity authentication proves that a person or machine really is who it claims to be. section 11.1
- User authentication has no universal solution: passwords can be exposed through poor storage, database breaches, or weak account recovery. section 11.2
- After successful login, a service commonly issues a cookie for later requests instead of repeatedly requesting the credentials. section 11.2
Figure 11.1 In this book, I talk about origin authentication in three types of scenarios. User authentication happens when a device authenticates a human being. Machine authentication happens when a machine authenticates another machine. User-aided authentication happens when a human is involved in a machine authenticating another machine.
Origin authentication appears in three scenarios: a device authenticating a human, a machine authenticating another machine, or a human helping machines authenticate one another. section 11.1
Logging in over HTTPS
A user visits a website through HTTPS, registers a username and password, and later logs in. The server is authenticated and the connection is secured; the login credentials then authenticate the user. Storing passwords in cleartext would make a database breach immediately reveal them. section 11.2
