Overview

Authentication is the process of establishing the legitimacy of an entity or object: proving that a person is who they claim to be, that a document or artifact is genuine, or that a program or device may be trusted. The goal is verification of a claim, not to be confused with authorization, which determines what an authenticated party is allowed to do. Authentication underpins security in both physical and digital domains and is a prerequisite for many trust-based interactions.

Common methods

Practically, authentication relies on three broad factors: something you know, something you have, and something you are. Examples include:

  • Knowledge: shared secrets such as a password or PIN.
  • Possession: physical tokens, smart cards, or cryptographic keys—often described as "something you have" such as a key.
  • Inherence: biometric traits like fingerprints, facial features, or voice patterns — "something you are", here represented by biometrics.

Mechanisms and examples

In computing, authentication can be local (a system checks credentials directly) or federated (an external provider vouches for identity). Methods range from simple password verification to multi-factor authentication that combines factors for stronger assurance. Cryptographic techniques such as public key infrastructure (PKI), digital signatures, and challenge–response protocols establish trust for software and devices; for instance, code signing is used to confirm that a piece of software has not been altered and is from a trusted publisher. User authentication processes authenticate an individual before granting access to resources, whether a human user logging in or a machine service requesting an API.

History and development

Authentication practices evolved from simple seals and signatures to sophisticated cryptographic systems. Historically, physical marks and documents served to attest origin; with digital communication came the need for mathematically based assurances. The rise of personal computing and the internet increased emphasis on scalable, interoperable methods such as PKI, federated identity, and standards for biometric verification.

Distinctions, risks, and notable facts

Key distinctions to remember: identification asserts an identity, authentication verifies it, and authorization governs permitted actions. Weak or reused secrets, poor implementation of cryptographic protocols, and social engineering are common attack vectors. Biometrics improve convenience but raise privacy concerns since biometric identifiers cannot easily be changed if compromised.

Best practices

Effective authentication combines multiple factors when possible, uses salted and hashed storage for secrets, implements secure key management, employs multi-factor authentication for sensitive access, and leverages standards for interoperability. Regular review, monitoring for anomalous access, and user education about phishing and credential hygiene further reduce compromise risk.