Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

Can someone please tell me what does 3 way authentication mean? I cannot understand this concept? :(

Now if there are two people A and B

1.) A challenges B with a question 2.) B gives the answer and B challenges A with a question 3.) A gives the answer to B

Now if A and B receives the correct reply then both A and B are authenticated. Am I correct?

share|improve this question
Is this referring to e.g. Kerberos? Never heard it called that before, now a quick search turned up this: stackoverflow.com/q/1364114/10080 – AviD♦ Jan 23 '11 at 18:56
@user1184 - What you describe sounds like what is more commonly called a "three-way handshake" not unlike the TCP handshake process. I think calling it a "three-way authentication" may have caused some confusion. Could you clarify this some more? – Iszi Jan 24 '11 at 6:46
@user1184, where did you encounter the concept? It sounds like you're a bit confused about the concept, and as a result it's hard to know what you're asking. If you can clarify, that would help. – D.W. Jan 26 '11 at 6:07

3 Answers

up vote 5 down vote

What is described in your question is mutual authentication - two parties authenticate to each other - which is sometimes known as a 3 way handshake.

3 way authentication is typically where two parties trust a third to carry out the authentication, eg when using Kerberos both parties implicitly trust the Kerberos server. In a typical network these two parties would often be the user and the application server they want to connect to, and Kerberos authenticates the two to each other.

Kerberos is just one example - it is fairly common, but maybe the term isn't in common usage.

share|improve this answer
i think this is called strong authentication. :( in strong authentication is it in this way users get authenticated ? – user1184 Jan 24 '11 at 13:23
1  
@user1184 no, "strong authentication" is a term usually used for any type of multi-factor authentication. Though I have also seen it used as a term for any authentication mechanism that is "not weak", i.e. it works as it should. @Rory, I'd never heard the term "3way authentication" for Kerberos, till I looked it up on this question. Is it a Britishism? ;) – AviD♦ Jan 25 '11 at 6:29
up vote 2 down vote

Kerberos has to do w/ key cert exchange via a server and "three-way authentication" is a misnomer for three-factor authentication not to be confused with three-way handshake which describes the manner in which data packets themselves are authenticated within the transport layer TCP protocol. this would be supplemental to kerberos and three factor authentication - not the like. It's what happens in the TCP packet headers since every packet header will have a sequence number and following info.

In "three-way handshake:"

  1. Host A sends a randomn sequence number (E.G., SEQ=100) and Synchronization (SYN) flag bit is turned on (CTL=SYN). The SYN is always sent at the beginning of new transmission for both sender first trans. and receiver's first reply back to sender. "CTL" just describes what flag is turned on.

  2. Host B receives Host A's SYN. Host B sends it's own SYN (b\c first time transmission) for synchronization and an acknowlegment ACK=101 (ack always 1 digit number higher) to confirm it got packet 100 (host A's SEQ 100) and is waiting for 101. Host B will also send it's own SEQ number (E.G., SEQ=300). CTL=SYN, ACK

  3. Host A receives B's Syn. Synchronization is complete so no SYN needed for new transmission since synchronization has already been made and confirmed. Host A will send ACK=301 in response to host B's SEQ=300 and and new sequence number of 101 (SEQ 101). CTL= ACK

Bear in mind each step is done within a packet. I say packet because this portion happens at layer 4 after IP (OSI layer 3 network/ IP internet layer) has included its routing header etc. Also, this quick answer is just to differentiate between the three topics inquired. More research and better diagrams do a better job at illustrating this process. I just wanted to clear up the misunderstanding so you know exactly what to look for.

share|improve this answer
up vote 1 down vote

This sounds very much like mutual authentication. I've never heard it called 3 way authn. The only other thing I can think of is 3-factor authentication where there are three sources for secrets such as a One-Time-Password + biometric + user secret/password/pin.

share|improve this answer
According to stackoverflow.com/q/1364114/10080, it might be referring to "3rd party authentication", e.g. Kerberos. Not sure if this is what was meant... – AviD♦ Jan 23 '11 at 20:35
2  
yfuhs - I think what the OP means by "three-way authentication" is meant to be said "three-way handshake". Generally, this refers to the TCP/IP three-way handshake, but can also mean a type of authentication mechanism. – Iszi Jan 23 '11 at 22:30
@Iszi ahhh... hopefully the OP can clarify – SteveS Jan 24 '11 at 5:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.