Authentication vs Identification

Once again I have to return to the topic of strict antagonism between the authentication and the identification, meaning these very processes and the tokens involved as well. Before I indulge into boring you with tedious decomposition of entities you used to perceive as atomic, I present you a synthetic illustration of the difference in question. A bad guy tries to get a false-negative outcome of identification, and a false-positive outcome of authentication. This is not explanatory, yet very indicative, I hope it gives you an idea of the magnitude of the difference, and we are going to dig into this now.

Would you use your passport number as a password? Is the answer too obvious? Why?! Do you think too many people know your passport number? Then why do you allow them to use your fingerprints as your password? ...Or any other piece of biometric data, or DNA…

Your fingerprints are everywhere! in every restaurant you ever visited,
in every embassy (which effectively means: in every legal institution on Earth, ALREADY!!!) Your DNA is everywhere… physically. Go pee and enjoy your DNA floating Gulf Stream. Is this a kind of destiny you wish for a password of yours?

On the other hand, would you like to be identified with your password? Do you feel uncertain? Let's ask it other way around: Can you identify someone with his password?

  — Look! It's him! He knows his password.
  — Perhaps, but I can not verify your claim.

How can you know that someone knows his password without knowing this password? You can not. In order to verify a password knowledge claim you need to know the password, but in the very moment you learn it you compromise it, so this password can not be used for authentication purposes any longer.

A token (such as a password) can not serve both the authentication purpose and the identification purpose simultaneously, either it serves the authentication purpose or the identification purpose.

FOOTNOTE: this thought experiment (if taken a little further) reveals that a knowledge claim of any kind can not be used for identification purposes either, but it is an entirely separate and fully independent topic.

FOOTNOTE: The authentication can be construed as a special case of identification: a user wants to establish (prove) the association between him and his account within a previously established relationship between him and a service provider — this association itself constitutes an identity relation — if you want to define the «identification» as a procedure of establishing ANY identity relation, then my definition of the «identification» is this one minus the subset of the authentication. With this exclusive definition of identification we proceed, as we are interested in drawing a strict line between the authentication and all the rest identification cases (in other words what makes the authentication special).

An identification procedure is founded on the assumption that nobody (besides a legal user) knows/owns the authentication token. An identification procedure is based on the opposite assumption: everybody knows the identification token, so that we can establish a consensus associating a token owner with the token.

  — Look! It's him! I know his face.
  — Indeed! I know this face too.

The core property of this process is that these people share the information about a 3rd person identification token — precisely this property allows them to identify this 3rd person, and essentially it defines the process itself. The identification (as opposed to the authentication) is all about a consensus, it is not your private matter by any stretch of imagination, whereas the authentication is strictly private.

Thus we can ask: if a given token can be used for identification purposes? If yes, then it can not be used for authentication purposes.

The opposition between the authentication and the identification can also be formulated from a pragmatic perspective thusly: I am the passive participant of my identification and the active participant of my authentication. In an authentication procedure I act in my own interest, whereas in an identification procedure the interested party is not myself. Well, this statement is not trivial, nevertheless is surprisingly easy to prove: you are NEVER interested in identifying yourself because you are constantly aware of your identity.

This «private/public» opposition between the identification and the authentication leads to a practical question: who controls the token used for auth or ID?

Why do you think the police loves your fingerprints? Exactly because you do not control their dissemination — your fingerprints betray you in every cafeteria, this is why they are used by investigators ever since the typographic ink is discovered.

What do we require from an authentication system? Full and complete control over the authentication token, its dissemination, and its revocation.

These are the characteristic properties of the authentication and the identification: full and complete control over the authentication token, controlled and monitored dissemination, easy and unconditional revocation; NO control over the identification token, it should be unalterable, undeniable, unalienable, and visible to EVERYONE, and also reasonably unique.

These characteristic properties are completely mutually exclusive (can you imagine something more mutually exclusive than that?!), this is why you must send to hell everyone who dares to propose you any piece of biometric data as your auth token.