2.3User authentication and multi-factor authentication

With phishing scams and credential-stuffing attacks rampant today, the first question a security professional must ask when choosing a user-authentication method is "what is this method resistant to, and what is it not resistant to?" A one-time password resists shoulder-surfing and reuse, but may still be entered into a well-crafted phishing site; FIDO/WebAuthn, by contrast, is fundamentally phishing-resistant by design, since no secret is ever sent to the server. Building on the three authentication factors, this section covers how to choose an authentication method suited to a given real-world threat scenario.

2.3.1The three authentication factors and MFA

• The three authentication factors are knowledge (something only the person knows, such as a password or PIN), possession (something only the person has, such as an IC card, smartphone, or token), and biometric (a physical or behavioral characteristic unique to the person, such as a fingerprint, face, or iris).
• Multi-factor authentication (MFA) combines two or more different factors. Note that using two instances of the same factor does not make it multi-factor (e.g., a password plus a secret question are both knowledge factors, so this is two-step but not multi-factor authentication). Because a compromise of one factor is blocked by the other, MFA is far more secure than a single factor.

2.3.2One-time passwords, challenge-response authentication, and risk-based authentication

• A one-time password (OTP) is a disposable password that becomes invalid after a single use. It is typically paired with a possession factor (a token or smartphone app) and is strongly resistant to eavesdropping and reuse, but can still be vulnerable to real-time relay attacks if a user is tricked into entering the OTP directly into a phishing site.
• Challenge-response authentication has the server send a different challenge (a random number) each time, and the client compute a one-time-only response using a shared key or similar. Because the password itself is never sent over the wire, it is strongly resistant to password exposure via eavesdropping.
• Risk-based authentication requires additional authentication (such as an OTP) only when it detects an "unusual situation"—such as a login from an unfamiliar location, device, or time. It strikes a good balance between convenience and security, keeping the burden low for legitimate users while imposing stronger authentication only on anomalous access.

2.3.3Biometric authentication and FIDO/WebAuthn, Kerberos, and RADIUS

• The accuracy of biometric authentication is evaluated by the trade-off between the False Rejection Rate (FRR) (the rate at which the legitimate person is incorrectly rejected) and the False Acceptance Rate (FAR) (the rate at which an impostor is incorrectly accepted). Lowering FAR (raising security) tends to raise FRR (lowering convenience), and vice versa.
• FIDO/WebAuthn is a standard for passwordless authentication using biometrics or a secure on-device key pair, in which no password is ever sent to the server. Because the private key generated on the device never leaves it and the server holds only the public key, the risk of handing over credentials even if tricked by a phishing site is fundamentally low (high phishing resistance).
• Kerberos is an authentication protocol that uses tickets issued by a trusted third party (the Key Distribution Center, KDC) to allow access to multiple services after a single authentication (an SSO-like model). RADIUS is a protocol that centrally manages authentication, authorization, and accounting (AAA) when connecting to network equipment such as VPNs and wireless LAN access points, and is widely used at the entry point of enterprise networks.

Suppose a company's security lead is reviewing the employee authentication infrastructure. The backdrop is a series of reports from other companies over the past six months of damage from "real-time relay phishing," in which phishing emails lure victims into entering both their password and OTP into a well-crafted fake site, which the attacker then immediately relays to the real site to complete authentication. The company's existing method (password plus SMS OTP) is multi-factor (knowledge plus possession), but it has the weakness that if a user enters the password and OTP into the fake site, the attacker can relay them to the real site in real time and break through authentication. In light of this, the lead decides to migrate to FIDO/WebAuthn—because the private key generated on the device is never sent to the server, and the authentication exchange takes the form of a signature bound to the destination domain, even if a user is lured to a fake site, a valid signature for the fake site's domain cannot be generated, structurally neutralizing real-time relay phishing. In addition, since authentication, authorization, and accounting must be centrally managed whenever all remote employees connect to the corporate network via VPN equipment, the lead places RADIUS between the VPN equipment and the authentication server to consolidate AAA. Furthermore, for the internal SSO infrastructure that lets a single login grant access to multiple internal systems (file servers, mail servers, the internal portal, etc.), the lead adopts Kerberos, where a trusted third party (the KDC) issues tickets. If biometric authentication (e.g., fingerprint) is also being considered, a trade-off must be tuned: for a use case like physical access control, where being unable to enter due to false rejection must absolutely be avoided, FRR should be set lower; conversely, for a use case like access control to confidential information, where unauthorized access due to false acceptance must absolutely be avoided, FAR should be set lower. In this way, the lead chooses among OTP, challenge-response, FIDO/WebAuthn, Kerberos, and RADIUS starting from the question of "which threat (eavesdropping, reuse, real-time relay phishing, or misidentification) needs to be resisted."

2.3.4Section summary

• Combining different instances of the three authentication factors (knowledge, possession, biometric) is multi-factor authentication; using multiple instances of the same factor does not count
• OTP resists eavesdropping/reuse but can be vulnerable to real-time relay phishing; FIDO/WebAuthn is structurally phishing-resistant via never sending the private key and domain-bound signatures
• Biometric authentication involves the FRR/FAR trade-off; SSO uses Kerberos; centralized AAA for network-device connections uses RADIUS