Authenticity establishes with confidence who the parties to a communication are and provides evidence that can prove those identities to others. It protects relationship integrity by preventing impersonation, fraud, data manipulation, and repudiation. section 2.7.1 section 2.7.3
Authenticity differs from confidentiality and privacy. Confidentiality protects communication content, while privacy concerns control over metadata or personal information. A TLS-protected health consultation may remain confidential even when visible IP addresses and domain information make the participants identifiable. section 2.7.1
Banking and relationship integrity
A bank must be able to identify the customer behind an authenticated session for regulatory reasons, including anti–money-laundering obligations. The bank can retain activity logs while restricting their use to authorized personnel, preserving information privacy despite reduced communications privacy. Authenticity therefore works alongside confidentiality, privacy, and authorization rather than replacing them. section 2.7.2 section 2.7.3
Authentication is two-way: users authenticate to systems, and systems authenticate to users. Transport Layer Security (TLS) uses certificates from trusted Certificate Authorities to bind a server domain to a public key. Misconfigured or expired certificates, man-in-the-middle attacks, and deceptive domains can still undermine confidence. section 3.2
Figure 3.2 The cascade of consequences triggered by a loss of relationship integrity. Compromised internal authentication undermines the trusted relationship between administrators and the system, leading to a broader loss of integrity for verified accounts. As confidence diminishes, individuals are deceived, which can result in financial loss, account lockouts, and reduced trust in the platform.
The cascade illustrates how compromised internal authentication can weaken trusted relationships, deceive users, cause financial loss and account lockouts, and reduce platform trust. section 3.2
