Authentication Mechanisms

Authentication Mechanisms (CIPT: Data Collection, Use, Dissemination and Destruction)

Authentication Mechanisms: A Complete CIPT Study Guide

1. What Are Authentication Mechanisms?
Authentication is the process of verifying that an entity (a user, device, service or application) is who or what it claims to be. It differs from two related concepts:
• Identification: claiming an identity, for example entering a username.
• Authentication: proving that claim, for example entering a password or scanning a fingerprint.
• Authorization: deciding what the authenticated entity may access or do.

The usual sequence is Identification, then Authentication, then Authorization, then Accountability (auditing). This is often called IAAA.

In the CIPT (Certified Information Privacy Technologist) body of knowledge, authentication sits within the data lifecycle (collection, use, dissemination and destruction). It is the gatekeeper that decides who can reach personal data at each stage.

2. Why Authentication Is Important for Privacy
• Confidentiality of personal data: weak authentication is a leading cause of breaches, including credential stuffing, phishing and account takeover.
• Regulatory compliance: several laws require appropriate technical measures to secure personal data.
  - GDPR Art. 32 (security of processing) and Art. 25 (data protection by design).
  - HIPAA Security Rule, which treats person or entity authentication as a technical safeguard.
  - PCI DSS, which requires MFA for access to the cardholder data environment.
  - PSD2, which requires strong customer authentication.
  - NYDFS Part 500 and various US state laws.
• Accountability: tying actions to verified identities enables audit trails and incident investigation.
• The privacy paradox: authentication itself collects personal data, such as biometrics, phone numbers, device fingerprints and behavioral patterns. Privacy technologists must balance security against data minimization.
• Data subject rights: organizations must verify the identity of people making access, deletion or portability requests. If they do not, they may disclose data to impostors. They also must not over-collect data in the verification process.

3. Authentication Factors: How It Works
Authentication relies on one or more factors:
• Something you know (knowledge): passwords, PINs, passphrases, security questions.
• Something you have (possession): smart cards, hardware tokens such as FIDO2/YubiKey, mobile phones receiving OTPs, authenticator apps (TOTP/HOTP), digital certificates.
• Something you are (inherence): biometrics such as fingerprint, face, iris, voice, palm vein.
• Contextual factors: somewhere you are (geolocation, IP address) and something you do (keystroke dynamics, gait, mouse movement, i.e., behavioral biometrics).

Single-factor vs multi-factor
• Single-factor authentication (SFA): one factor, typically a password.
• Two-factor / multi-factor authentication (2FA/MFA): two or more different categories of factor.

Key exam trap: a password plus a security question is NOT MFA. Both are knowledge factors, so this is only multi-step authentication.

4. Common Authentication Mechanisms in Detail

Passwords
• The most common mechanism, and the weakest.
• Risks: reuse, phishing, brute force, dictionary attacks, credential stuffing.
• Best practice follows NIST SP 800-63B:
  - Favor length over complexity.
  - Screen passwords against breached-password lists.
  - Do not force periodic changes unless compromise is suspected.
  - Allow paste so users can use password managers.
  - Rate-limit login attempts.
• Storage: never store passwords in plaintext. Use salted, slow, adaptive hashing (bcrypt, scrypt, Argon2, PBKDF2). Hashing is one-way, unlike encryption, which is reversible.

One-time passwords (OTP)
• TOTP is time-based (e.g., Google Authenticator). HOTP is counter-based.
• SMS OTP is considered weaker because of SIM swapping and SS7 interception. NIST classes it as a restricted authenticator.

Hardware tokens and smart cards
• Examples include PIV/CAC cards and FIDO U2F/FIDO2 security keys.
• They resist phishing because they use public key cryptography bound to the origin.

Passwordless and FIDO2/WebAuthn (passkeys)
• Uses a public/private key pair. The private key stays on the device and is unlocked locally, often by a biometric.
• Privacy benefit: biometric data never leaves the device, and no shared secret is stored on the server.

Biometrics
• Convenient, but biometrics cannot be changed if compromised.
• Classified as special category data under GDPR Art. 9 when used for unique identification.
• Regulated by Illinois BIPA, which requires notice, written consent, a retention schedule and destruction policies. Texas and Washington have similar laws.
• Key metrics:
  - False Acceptance Rate (FAR): impostors wrongly accepted.
  - False Rejection Rate (FRR): legitimate users wrongly rejected.
  - Crossover Error Rate (CER), also called the Equal Error Rate: the point where FAR equals FRR. A lower CER means a more accurate system.
• Privacy-enhancing practices: store templates rather than raw images, process on the device, and use cancelable or revocable biometric templates.

Certificate-based authentication / PKI
• Digital certificates issued by a Certificate Authority bind a public key to an identity.
• Used in mutual TLS (mTLS), S/MIME and device authentication.

Kerberos
• A ticket-based network authentication protocol that uses a Key Distribution Center (KDC) with an Authentication Server and a Ticket Granting Server.
• Common in Windows Active Directory environments.

Single Sign-On (SSO) and federated identity
• Users authenticate once with an Identity Provider (IdP) and gain access to multiple Service Providers or relying parties.
• Main protocols:
  - SAML 2.0: XML-based, common in enterprises.
  - OAuth 2.0: an authorization framework for delegated access with tokens. It is not an authentication protocol by itself.
  - OpenID Connect (OIDC): an identity/authentication layer built on OAuth 2.0 that issues ID tokens (JWTs).
• Privacy considerations:
  - The IdP can track users across services, creating linkability.
  - Attribute release should be minimized.
  - Social login shares data with third parties.
  - Pairwise or pseudonymous identifiers reduce correlation.

Risk-based / adaptive authentication
• Evaluates context such as device, location, time and behavior, and requests step-up authentication only when risk is high.
• Privacy concern: it relies on collecting device fingerprints and behavioral data. Transparency and minimization are therefore required.

Device and machine authentication
• API keys, client certificates, and the OAuth client credentials flow, used for IoT and service-to-service communication.

Privacy-enhancing authentication
• Anonymous credentials / attribute-based credentials (e.g., Idemix, U-Prove): prove an attribute such as 'over 18' without revealing identity.
• Zero-knowledge proofs: prove knowledge of a secret without revealing it.
• Selective disclosure in verifiable credentials and decentralized identity (DIDs).
• These support data minimization and unlinkability.

5. Assurance Levels (NIST SP 800-63-3)
NIST separates assurance into three dimensions:
• IAL (Identity Assurance Level): how strongly identity was proofed at enrollment.
• AAL (Authenticator Assurance Level): strength of the authentication process.
  - AAL1: single factor.
  - AAL2: two factors.
  - AAL3: hardware-based, phishing-resistant authenticator with verifier impersonation resistance.
• FAL (Federation Assurance Level): strength of assertions in federated systems.

The EU equivalent is eIDAS levels of assurance: low, substantial and high.

6. Authentication Across the Data Lifecycle
• Collection: collect only the authentication data that is needed. Explain why a phone number is requested for 2FA, and do not reuse it for marketing (purpose limitation).
• Use: protect credentials in transit (TLS) and at rest (hashing). Limit internal access to authentication databases. Log authentication events with appropriate retention.
• Dissemination: in federation, share minimal attributes with relying parties. Never pass credentials to third parties. Use tokens instead.
• Destruction: define retention for biometric templates, login logs and inactive accounts. Revoke tokens and certificates and deprovision accounts promptly when employees leave. Securely delete biometric data when its purpose ends, as BIPA requires.

7. Common Attacks and Mitigations
• Phishing: phishing-resistant MFA (FIDO2), user training.
• Credential stuffing: MFA, breached-password checks, rate limiting.
• Brute force and dictionary attacks: account lockout or throttling, CAPTCHA, long passwords.
• Rainbow table attacks: salting.
• Replay attacks: nonces, timestamps, OTPs.
• Session hijacking: secure, HttpOnly cookies, session timeouts, re-authentication for sensitive actions.
• SIM swapping: avoid SMS OTP for high-risk accounts.
• MFA fatigue / push bombing: number matching, rate limits.
• Man-in-the-middle: TLS, certificate pinning, origin-bound credentials.

8. Exam Tips: Answering Questions on Authentication Mechanisms

Tip 1: Separate identification, authentication and authorization.
Many distractors swap these terms. Ask whether the scenario is about proving identity (authentication) or granting permissions (authorization). For example, role-based access control is authorization, not authentication.

Tip 2: Count factor categories, not steps.
MFA requires different categories of factor:
• Password + PIN = one factor (both knowledge).
• Password + fingerprint = two factors.
• Smart card + PIN = two factors.

Tip 3: Know OAuth vs OIDC vs SAML.
• OAuth 2.0 = authorization or delegated access.
• OIDC = authentication on top of OAuth.
• SAML = XML-based federated SSO.
If a question asks which protocol authenticates the user in a modern web or mobile app, OIDC is usually the answer.

Tip 4: Think like a privacy technologist, not just a security engineer.
CIPT answers usually favor the option that achieves security and privacy. Prefer:
• On-device biometric matching over central biometric databases.
• Hashed templates over raw images.
• Pseudonymous or pairwise identifiers in federation.
• Collecting only the attributes needed (e.g., age verification without a full date of birth).

Tip 5: Remember the special rules for biometrics.
• GDPR treats biometrics used for identification as special category data, requiring an Art. 9 condition and often a DPIA.
• BIPA requires informed written consent, a public retention policy and destruction timelines, and provides a private right of action.
• Biometrics are irrevocable, so breach impact is severe.

Tip 6: Know the metrics.
• FAR is a security concern.
• FRR is a usability concern.
• CER/EER is used to compare systems; lower is better.
• Raising sensitivity lowers FAR but raises FRR.

Tip 7: Use modern password guidance.
If an answer suggests mandatory 90-day password rotation or complex composition rules as best practice, it is likely outdated under NIST 800-63B. Choose length, breached-password screening, MFA and salted slow hashing.

Tip 8: Hashing vs encryption for stored passwords.
The correct answer is salted, adaptive hashing (bcrypt, Argon2, PBKDF2). Encryption is reversible and therefore not ideal. Plain MD5 or SHA-1 without a salt is wrong.

Tip 9: Choose phishing-resistant options for high-risk scenarios.
For privileged or remote access to sensitive data, FIDO2 hardware keys or certificate-based MFA beat SMS OTP.

Tip 10: Watch for data subject request (DSR) verification scenarios.
• Verify identity in proportion to the sensitivity of the request.
• Use existing account authentication where possible.
• Do not demand excessive new data, such as passport copies for a low-risk request.
CCPA regulations and GDPR guidance both stress reasonable, proportionate verification.

Tip 11: Apply lifecycle thinking.
When a question mentions offboarding, account inactivity or end of purpose, the expected answer involves:
• Deprovisioning accounts.
• Revoking tokens and certificates.
• Deleting authentication data (especially biometrics) according to retention schedules.

Tip 12: Read for the 'BEST' or 'MOST' qualifier.
Several answers may be technically valid. Pick the one that:
• Addresses the stated risk directly.
• Minimizes personal data.
• Aligns with privacy by design.
• Is proportionate to the sensitivity of the data.

Tip 13: Recognize the privacy side effects of SSO and adaptive authentication.
• SSO centralizes risk and enables tracking by the IdP.
• Adaptive authentication collects behavioral and location data.
Expect questions asking which concern a privacy technologist should raise. Linkability, profiling and transparency are typical answers.

9. Quick Review Checklist
• IAAA order: Identification, Authentication, Authorization, Accountability.
• Factors: know, have, are, plus context (where, do).
• MFA means different factor types.
• NIST 800-63: IAL, AAL, FAL.
• OAuth = authorization; OIDC and SAML = authentication or federation.
• Passwords: salted adaptive hashing, length, breach screening.
• Biometrics: special category data, BIPA, irrevocable, FAR/FRR/CER, on-device matching.
• Privacy-enhancing options: ZKPs, anonymous credentials, selective disclosure, pairwise identifiers.
• Lifecycle: minimize at collection, protect in use, limit sharing in dissemination, delete and revoke at destruction.

Master these concepts and always weigh security strength against data minimization. That balance is the lens through which CIPT examiners frame authentication questions.