When Alice signs in to an employer’s financial system, a possession factor helps prove that she controls a required object or device, not merely an account identifier. section 3.5 section 3.6.3
A possession factor is something the requester has, such as a smartphone, hardware token, smart card, or security key. It can strengthen authentication but may be lost, stolen, cloned, or phished. section 3.5.1
Common possession-factor implementations include:
- One-time passwords (OTPs) delivered by SMS or email, generated by an authentication app, or issued through a push notification. section 3.6.3
- Passwords combined with an OTP create multifactor authentication, requiring control of both a knowledge factor and a possession factor. section 3.5.3 section 3.6.3
- Registration binds selected factors to an identifier; later logins verify the identifier and its associated factors before granting or denying access. section 3.6.3
Figure 3.7 Identifier with authentication factors flow. During registration, Alice provides an identifier (such as a username or email) and one or more authentication factors (such as a password or biometric). The authentication service securely stores them. At login, Alice is prompted for her identifier and corresponding authentication factors. The service verifies both before granting or denying access. This is the most common authentication pattern, and it serves as the foundation for multifactor authentication, where the combination of factors improves security by requiring control over multiple types of evidence.
Trace the registration and login flow from an identifier and stored factors through verification and the access decision. section 3.6.3
