Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the paradigm. Can anyone shed some light on this?

share|improve this question
Someone who knows you is the fourth factor AFAIR. – Deer Hunter Apr 3 '13 at 8:27
@Deer Hunter There have been a few expansions of the three factors proposed lately - something you do, etc. But three factors is how it has been known for a long time, and generally how it is still referred to, even when the new factors are proposed. There is no consensus I'm aware of for additional factors of authentication. – thelionroars1337 Apr 3 '13 at 8:32
At least for something you know/are the origins can be traced to the Holy Bible (shibboleth). – Deer Hunter Apr 3 '13 at 8:37
Oldest mention in the Google Books corpus of two-factor authentication seems to be 1979, but from context it seems to have been a well established term at that time. – Graham Hill Apr 3 '13 at 17:27
@DeerHunter - The fourth factor of authentication is usually referred to as someplace you are (based on location and typically uses GPS), at least according to ISC2 and some others. ;) – TildalWave Apr 5 '13 at 17:32

The origin of three-factor authentication paradig is unknown, but one thing is for certain: it predates mankind. Controversial? Let's see. Ask yourself, how does e.g. a father gorilla recognize a newborn cub as being one of his offspring, even if its mom is not around? By something it has - a smell of its mom. Something it knows - the distress call. Something it is - a newborn gorilla cub. So, we have a newborn gorilla cub that's calling in distress the way gorilla cubs do, and smells of its mom, the way she did when father gorilla mated with her. That's a three-form authentication, and as far as nature is concerned - it's good enough. Does it predate gorillas? Sure. Any animal species that exhibit certain amount of social responsibility, and/or their behavioral patterns dictate the need for such identification of its members would - by this necessity alone - have similar methods in place. Or such goes the Darwinian explanation.

But what about its etymology, the origins of this phrase as us humans use it? The answer is, that we don't know for sure who exactly coined this phrase first, or indeed when. The phrase describing this method of authentication was probably changed many times throughout history, but its modus operandi remained the same. One example of three-form authentication - that would be used in early days of our civilization - would have been in use with military couriers, or diplomatic envoys. Their messages would face authentication scrutiny that is sufficiently confirmed by a three-form authentication. Messengers would be required to know something (password), have something (a recognizable seal) and be something (e.g. a member of some tribe), before they would be allowed to deliver their message to its intended recipient. I believe it's relatively safe to assume, that we do have historical records of such authentication methods being used, that they were described by various names, and that we can not tell with any degree of certainty who could hold a claim to its first use.

share|improve this answer
The concepts of identity and authentication are very old, and I would agree that they are fairly fundamental concepts for any social animal. However any of the other factors of authentication I've seen proposed - someone who knows you, somewhere you are, something you do - have been used by humans (at least) from ancient times for authentication, alone or with other factors. So at some point a decision has been made about which factors of authentication are appropriate (for some specific context). – thelionroars1337 Apr 6 '13 at 1:26
Well, I wanted to show that they're ubiquitous in security literature because of its fundamentally ubiquitous nature. Yes, which three forms of authentication would be used (out of all kinds of possible ones) in some specific context, or indeed if three by number, depends on which set of methods is considered sufficiently identifiable with acceptable margin of error. The three methods mentioned just so happen to be most widely adopted and provide a secure enough mechanism for message authentication in most cases. Who first realized that and wrote it down - we simply don't know. – TildalWave Apr 6 '13 at 13:11
If by 'we' you mean you and me, you're right. But otherwise it's too sweeping a statement. It may just be that not many people have considered it. I take your point about sufficiently identifiable with acceptable margin of error though. – thelionroars1337 Apr 7 '13 at 7:38
@thelionroars1337 - By 'we' I meant me, you, everyone that read your question and didn't have any additional information, and all the literature that all of us have ever read on the topic (refers to this three-factor authentication paradigm in the same way) yet fails to credit any author for it (which is rare and inexcusable in scientific and other expert publications). Google, or other search engines, are none the wiser either. I think it's fairly safe to ascertain my assumption can be read in the broadest meaning of 'we'. ;) – TildalWave Apr 9 '13 at 0:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.