Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 10 Jun 2016 13:17:14 +0200
From: "" <>
Subject: Authentication vs Identification

Once again I have to return to the topic of strict antagonism between 
the authentication and the identification, meaning these very processes 
and the tokens involved as well. Before I indulge into boring you with 
tedious decomposition of entities you used to perceive as atomic, I 
present you a synthetic illustration of the difference in question. A 
bad guy tries to get a false-negative outcome of identification, and a 
false-positive outcome of authentication. This is not explanatory, yet 
very indicative, I hope it gives you an idea of the magnitude of the 
difference, and we are going to dig into this now.

(a html formatted version is available, if you like)

Would you use your passport number as a password?
Too obvious? Why?!
Do you think too many people know your passport number?
Then why do you allow them to use your fingerprints as your password? 
...Or any other piece of biometric data, or DNA…

Your fingerprints are everywhere! in every restaurant you ever visited,
in every embassy (which effectively means: in every legal institution on 
Earth, ALREADY!!!) Your DNA is everywhere… physically. Go pee and enjoy 
your DNA floating Gulf Stream. Is this a kind of destiny you wish for a 
password of yours?

On the other hand, would you like to be identified with your 
Let's ask it other way around: Can you identify someone with his password?

  — Look! It's him! He knows his password.
— Perhaps, but I can not verify your claim.

How can you know that someone knows his password without knowing this 
password? You can not. In order to verify a password knowledge claim you 
need to know the password, but in the very moment you learn it you 
compromise it, so this password can not be used for authentication 
purposes any longer.

A token (such as a password) can not serve both the authentication 
purpose and the identification purpose simultaneously, either it serves 
the authentication purpose or the identification purpose.

FOOTNOTE: this thought experiment (if taken a little further) reveals 
that a knowledge claim of any kind can not be used for identification 
purposes either, but it is an entirely separate and fully independent topic.

FOOTNOTE: The authentication can be construed as a special case of 
identification: a user wants to establish (prove) the association 
between him and his account within a previously established relationship 
between him and a service provider — this association itself constitutes 
an identity relation — if you want to define the «identification» as a 
procedure of establishing ANY identity relation, then my definition of 
the «identification» is this one minus the subset of the authentication. 
With this exclusive definition of identification we proceed, as we are 
interested in drawing a strict line between the authentication and all 
the rest identification cases (in other words what makes the 
authentication special).

An identification procedure is founded on the assumption that nobody 
(besides a legal user) knows/owns the authentication token. An 
identification procedure is based on the opposite assumption: everybody 
knows the identification token, so that we can establish a consensus 
associating a token owner with the token.

  — Look! It's him! I know his face.
— Indeed! I know this face too.

The core property of this process is that these people share the 
information about a 3rd person identification token — precisely this 
property allows them to identify this 3rd person, and essentially it 
defines the process itself. The identification (as opposed to the 
authentication) is all about a consensus, it is not your private matter 
by any stretch of imagination, whereas the authentication is strictly 

Thus we can ask: if a given token can be used for identification 
purposes? If yes, then it can not be used for authentication purposes.

The opposition between the authentication and the identification can 
also be formulated from a pragmatic perspective thusly: I am the passive 
participant of my identification and the active participant of my 
authentication. In an authentication procedure I act in my own interest, 
whereas in an identification procedure the interested party is not 
myself. Well, this statement is not trivial, nevertheless is 
surprisingly easy to prove: you are NEVER interested in identifying 
yourself because you are constantly aware of your identity.

This «private/public» opposition between the identification and the 
authentication leads to a practical question: who controls the token 
used for auth or ID?

Why do you think the police loves your fingerprints?
Exactly because you do not control their dissemination — your 
fingerprints betray you in every cafeteria, this is why they are used by 
investigators ever since the typographic ink is discovered.

What do we require from an authentication system?
Full and complete control over the authentication token, its 
dissemination, and its revocation.

These are the characteristic properties of the authentication and the 
full and complete control over the authentication token, controlled and 
monitored dissemination, easy and unconditional revocation;
NO control over the identification token, it should be unalterable, 
undeniable, unalienable, and visible to EVERYONE, and also reasonably 

These characteristic properties are completely mutually exclusive (can 
you imagine something more mutually exclusive than that?!), this is why 
you must send to hell everyone who dares to propose you any piece of 
biometric data as your auth token.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.