2

Is username counted as one-factor, something you know?

A smart card (which contains the username and user information inside the card) is something you have.

What if the smart card doesn't contain the user information but the username is checked on the server before the smart card is used?

migrated from crypto.stackexchange.com Aug 25 '18 at 9:10

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • Make it about physical objects - say, name and driver's licence - and ask yourself whether these count as separate pieces of information. It will be the same for digital things. – Mike Ounsworth Aug 25 '18 at 15:11
5

If the username is secret and not reasonably ex tractable from card, I would say yes.

If the username is not secret, or at least easily guessable because it is strongly based on something not secret like your name it should not be considered a "factor" for authentication.

If the username is easily retrievable from the card we do not have independent factors which is what we really need when discussing Multi-Factor-Authentication.

  • if the is no independent factors, mean there is no two-factor authentication? even if you have "something you know, something you have, and something you are." rule – Wei Wen Aug 22 '18 at 7:26
  • 1
    If something I know and something I have are the same information, they are not independent. If I have a smart card and a password but my password is on a sticker on the smart card (true story) then loosing the smart card is also loosing the password. The factors are not independent which is what we need. – Meir Maor Aug 22 '18 at 8:12
  • mean independent from each other is part of two-factor authentication? Is there any other requirement to be two-factor authentication. Because i creating a two-factor authentication protocol. Which part I need to be careful about. – Wei Wen Aug 22 '18 at 8:20
  • I don't see how being independent is required for two factor authentication. My PIN is absolutely tied to my debit and credit cards, but that doesn't mean that it doesn't count as two factor authentication. – Maarten Bodewes Aug 23 '18 at 4:54
  • Your pin is not easily extracted from your card, hence the loss of one does not imply the loss of the other, this is independence IMHO. – Meir Maor Aug 23 '18 at 5:07
2

Is username counted as one-factor, something you know?

A username is not a factor of authentication, a username is used for identification. To prove what you claim to be, you authenticate your "identity" against a system by providing something that you and only you know, something secret.

What if the smart card doesn't contain the user information but the username is checked on the server before the smart card is used?

This is a standard authentication workflow, some systems check first the username and then prompt user for password or ask him to use other mean like smart-card.

1

The three factors for authentication are, again:

  • something you have
  • something you know
  • something you are

You can of course not use any of these for authentication without additional constraints. To use any of these for authentication it is important that an adversary cannot replicate the authentication factor.

Generally names can be easily guessed, which means that a user name is not suitable to use as a factor for authentication.


Similarly, having a smart card is of little use if an adversary can simply extract any secret information that is stored on the card.

Biometrics are not very useful if the authentication can be fooled by accepting a picture or gummi fingerprint.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.