Which of the following is the best description of the means used to confirm the identity of a user, process, or device?
A. Password
B. Authenticator
C. Secret key stored in a hardware token
D. Private key stored in a token protected by a PIN

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

My suggested answer is B. Authenticator.

Passwords, the secret key stored in a hardware token, and the private key stored in a token protected by a PIN are authenticators, “the means used to confirm the identity of a user, process, or device (e.g., user password or token).” (NIST SP 800-53 Rev. 4)

Authenticator

• Something the claimant possesses and controls (typically a cryptographic module or password) that is used to authenticate the claimant’s identity. In previous editions of SP 800-63, this was referred to as a token. (NIST SP 800-63-3)
• Any use of authenticators, such as passwords, personal identification numbers (PINs) and hardware tokens, should be included. For example, in PKI cryptographic applications, role and identity-based authentication and authorization, and the use of any tokens should be described. (NIST SP 800-57 Part 2 R1)

Digital Authentication

The following is an excerpt from Digital Identity Guidelines (NIST SP 800-63-3):

• In digital authentication the claimant possesses and controls one or more authenticators that have been registered with the CSP and are used to prove the claimant’s identity. The authenticator(s) contains secrets the claimant can use to prove that he or she is a valid subscriber, the claimant authenticates to a system or application over a network by proving that he or she has possession and control of one or more authenticators.
• The secrets contained in authenticators are based on either public key pairs (asymmetric keys) or shared secrets (symmetric keys). A public key and a related private key comprise a public key pair. The private key is stored on the authenticator and is used by the claimant to prove possession and control of the authenticator. A verifier, knowing the claimant’s public key through some credential (typically a public key certificate), can use an authentication protocol to verify the claimant’s identity by proving that the claimant has possession and control of the associated private key authenticator.
• Shared secrets stored on authenticators may be either symmetric keys or memorized secrets (e.g., passwords and PINs), as opposed to the asymmetric keys described above, which subscribers need not share with the verifier. While both keys and passwords can be used in similar protocols, one important difference between the two is how they relate to the subscriber. While symmetric keys are generally stored in hardware or software that the subscriber controls, passwords are intended to be memorized by the subscriber. Since most users choose short passwords to facilitate memorization and ease of entry, passwords typically have fewer characters than cryptographic keys. Furthermore, whereas systems choose keys at random, users attempting to choose memorable passwords will often select from a very small subset of the possible passwords of a given length, and many will choose very similar values. As such, whereas cryptographic keys are typically long enough to make network-based guessing attacks untenable, user-chosen passwords may be vulnerable, especially if no defenses are in place.
• In this volume, authenticators always contain a secret. Some of the classic authentication factors do not apply directly to digital authentication. For example, a physical driver’s license is something you have, and may be useful when authenticating to a human (e.g., a security guard), but is not in itself an authenticator for digital authentication. Authentication factors classified as something you know are not necessarily secrets, either. Knowledge-based authentication, where the claimant is prompted to answer questions that are presumably known only by the claimant, also does not constitute an acceptable secret for digital authentication. A biometric also does not constitute a secret. Accordingly, these guidelines only allow the use of biometrics for authentication when strongly bound to a physical authenticator.

Reference

• Digital Identity Guidelines (NIST SP 800-63-3)
• Recommendation for Key Management: Part 2 – Best Practices for Key Management Organizations (NIST SP 800-57 Part 2 R1)

以下哪項是對用來確認用戶，進程或設備身份的方法的最佳描述？
A. 密碼
B. 身份驗證器(authenticator)
C. 儲存在硬件令牌(token)中的密鑰
D. 儲存在受PIN保護的令牌(token)中的私鑰