An authentication factor is a piece of information and process used to authenticate or verify a person's identity or other entity requesting access under security constraints. Two-factor authentication (T-FA) is a system wherein two different factors are used in conjunction to authenticate. Using two factors as opposed to one factor shall deliver a higher level of authentication assurance.
Using more than one factor is sometimes called strong authentication. However, strength is always bound to secrecy under which the factors are kept and protected against any third party challenge.
Often a combination of methods is used, e.g., a bankcard and a PIN, in which case the term two-factor authentication (or multi-factor authentication) is used. In 2006, several scientists at RSA Laboratories published a paper exploring social networking as a fourth factor of human authentication.
It should be remembered, however, that strong authentication and multi-factor authentication are fundamentally different processes. Soliciting multiple answers to challenge questions may be considered strong authentication but, unless the process also retrieves 'something you have' or 'something you are', it would not be considered multi-factor. The FFIEC has issued supplemental guidance on this subject in August 2006, in which they clarified, "By definition true multifactor authentication requires the use of solutions from two or more of the three categories of factors. Using multiple solutions from the same category ... would not constitute multifactor authentication."
According to proponents, T-FA could drastically reduce the incidence of online identity theft, and other online fraud, because the victim's password would no longer be enough to give a thief access to their information. However, T-FA is still vulnerable to trojan and man-in-the-middle attacks.
Deployment of T-FA tools such as smart cards and USB tokens appears to be increasing. More organizations are adding a layer of security to the desktop that requires users to physically possess a token, and have knowledge of a PIN or password in order to access company data. However, there are still some drawbacks to two-factor authentication that are keeping the technology from widespread deployment. Some consumers have difficulty keeping track of one more object in their life. Also, many two-factor authentication solutions are proprietary and protected by patents. The result is a substantial annual fee per person protected and a lack of interoperability.
Adding a second factor in the authentication mechanism could lead to increase in costs for implementation and maintenance. Most systems are proprietary and charge an annual fee per user in the $50-100 USD range. Deployment of hardware tokens is logistically challenging. Hardware tokens may get damaged or lost and issuance of tokens in large industries such as banking or even within large enterprises needs to be managed. Therefore, an analysis on the cost and benefit should be made before deciding on a stronger authentication mechanism. Note: Virtual tokens typically cost considerably less ($0.50 to $1.50 USD) and have no loss or damage costs.
Despite the security advantages of strong authentication its adoption is not yet widespread. A 2007 study by Celent reports that the year 2006 was dismal in terms of getting multifactor authentication (MFA) solutions out the door. Only 50% of banks were up and running for retail online banking, 40% for small business, and 60% for corporate banking. In 2007, 90% of banks are expected to be up and running for retail and small business online banking and 95% live for corporate banking, with nearly all banks deploying solutions by year end 2008.
There are several factors that contribute to this lack of pervasiveness.
The first challenge to face is the difficulty of deploying the client PC software required to make T-FA systems work. Most vendors have created separate installation packages for network login, Web access credentials and VPN connection credentials. In other words, there may be four or five different software packages to push down to the client PC in order to make use of the token or smart card. This translates to four or five packages on which version control has to be performed, and four or five packages to check for conflicts with business applications. If access can be operated using web pages, it is possible to limit the overheads outlined above to a single application.
The most common forms of the 'something you have' are smart cards and USB tokens. Differences between the smart card and USB token are diminishing; both technologies include a microcontroller, an OS, a security application, and a secured storage area.
In both cases, vendors are beginning to add biometric readers on the devices, thereby providing multi-factor authentication. Users biometrically authenticate via their fingerprint to the smart card or token and then enter a PIN or password in order to open the credential vault. However, while this type of authentication is suitable in limited applications, this solution may become unacceptably slow and comparatively expensive when a large number of users are involved. In addition, it is extremely vulnerable to a replay attack: once the biometric information is compromised, it may easily be replayed unless the reader is completely secure and guarded.
For all biometric identifiers, the actual biometic image is not stored and checked against - a scanning algorithm extracts critical information from the image and stores the result as a string of data. Comparison is therefore made between two data strings, and if there is sufficient commonality a pass is achieved. It may be appreciated that choice of how much data to match, and to what degree of accuracy, governs the accuracy/speed ratio of the biometric device. All biometric devices, therefore, do not provide unambiguous guarantees of identity, but rather probabilities, and all may provide false positive and negative outputs. If a biometric system is applied to a large number of users - perhaps all the citizens in a country, the error rate may make the system impractical to use.
Above all, biometric information can not be changed, that is a key advantage. However, though biometrics cannot be reproduced in a growth process, a biometric identifier may be mechanically copied. And a bio-identifier can be faked: Apart from forcing a valid user to operate a reader, fingerprints can easily be captured on sticky tape and false gelatine copies made, or simple photos of eye retinas can be presented. However, intelligent biometrics sensors should be capable to distinguis between live original and dead replicas. It is likely that, as biometric identifiers become widespread, more sophisticated techniques to spoof them will be developed. The race between biometrics security means and threatening and challenging biometrics is steady as with technical alternatives.
Historically, fingerprints have been used as the most authoritative method of authentication, but recent court cases in the US and elsewhere have raised fundamental doubts about fingerprint reliability. Other biometric methods such as retinal scans are promising, but have shown themselves to be easily spoofable in practice. Hybrid or two-tiered authentication methods offer a compelling solution, such as private keys encrypted by fingerprint inside of a USB device.
A new category of T-FA tools transforms the PC user's mobile phone into a token device using SMS messaging or an interactive telephone call. Since the user now communicates over two channels, the mobile phone becomes a two-factor, two-channel authentication mechanism.
Some methods simply place a traditional telephone call to the end user's phone, prompting the user to press a key or sequence of keys. These solutions can be used with any telephone, not just mobile devices.
While such a method can simplify deployment, reduce logistical costs and remove the need for a separate hardware token devices, there are trade-offs. Users may incur fees for text/data services or cellular calling minutes. In addition, there is a latency involved with SMS services especially during peak SMS usage periods like the holidays.
There is a newer method of using the mobile phone as the processor and having the Security Token reside on the mobile as a JAVA ME client. This method does not include data latency or incur hidden costs for the end user.
Smart cards are about the same size as a credit card. Some vendors offer smart cards that perform both the function of a proximity card and network authentication. Users can authenticate into the building via proximity detection and then insert the card into their PC to produce network logon credentials. They can also serve as ID badges. The downside is that the smart card is a bigger device, the card reader is an extra expense.
Additionally, many banks and financial institutions are implementing CAP technology which pairs a banking smart card with an independent, unconnected card reader. Using the card, reader and ATM PIN as factors, an OTP is generated that can then be used in place of passwords. The technology offers support against MITM attacks by facilitating Transaction Data Signing, where information from the transaction is included in the calculation of the OTP - this is proving to be strong protection when making bank transfers or other financial transactions. During 2008, this method of T-FA will be made available in the eCommerce environment through the 3D Secure architectures managed by MasterCard (SecureCode) and VISA (Verified by Visa).
A USB token has different form factor; it can't fit in a wallet, but can easily be attached to a key ring. A USB port is standard equipment on today's computers, and USB tokens generally have a much larger storage capacity for logon credentials than smart cards.
Some manufacturers also offer a One Time Password (OTP) token. These have an LCD screen which displays a pseudo-random number consisting of 6 or more alphanumeric characters (sometimes numbers, sometimes combinations of letters and numbers, depending upon vendor and model). This pseudo-random number changes at pre-determined intervals, usually every 60 seconds, but they can also change at other time intervals or after a user event, such as the user pushing a button on the token. Tokens that change after a pre-determined time are called time-based, and tokens that require a user event are referred to as sequence-based (since the interval value is the current sequence number of the user events, i.e. 1, 2, 3, 4, etc.). When this pseudo-random number is combined with a PIN or password, the resulting passcode is considered two factors of authentication (something you know with the PIN/password, and something you have from the OTP token). There are also hybrid-tokens that provide a combination of the capabilities of smartcards, USB tokens, and OTP tokens.
Security does not happen without organizational embedding. This applies as well to structures as to individuals and their training and motivation.
Users have natural problems retaining a single authentication factor like a password. It is not uncommon for users to be expected to remember dozens of unique passwords. T-FA where one factor is a password or PIN code, does not eliminate this problem. One possible solution is to have the second factor be a biometric, instead of an entity that the user needs to memorize.
Another concern is the security of the T-FA tools and their systems. Several products store passwords in plain text for either the token or smart card software or its associated management server. In either case this largely negates one factor of the authentication since although an intruder could easily find the password/PIN used to authenticate to the device, they still need to be in possession of the relevant token or smart card for this type of attack to work.
There is a further argument that purports that there is nothing to stop a user (or intruder) from manually providing logon credentials that are stored on a token or smart card. For example to show all passwords stored in Internet Explorer, all an intruder has to do is to boot the Microsoft Windows OS into safe mode (with network support) and to scan the hard drive (using certain freely available utilities). However, making it necessary for the physical token to be in place at all times during a session can negate this.
Another concern when deploying smart cards, USB tokens, or other T-FA systems is the security of the software loaded on to users' computers. A token may store a user's credentials securely, but the potential for breaking the system is then shifted to the software interface between the hardware token and the OS, potentially rendering the added security of the T-FA system useless.
Market segments in regards to two-factor authentication are: