What is Mutual Authentication?
Mutual Auth IRL (In Real Life)
This is exactly what you do when you go to the bank. You "authenticate" the teller from the second you think about the bank.
- You think "where is the bank" (location, check)
- Does the bank look like a bank? (look around, looks like a bank, reputation, check)
- Does the teller work for the bank? (She's behind the desk, so someone let her back there, uniform, name tag, and she is holding cash. Check)
Check, check, check. You're at a bank talking to an employee.
Now she authenticates you. Asks for
- your ID,
- your photo comes up on the screen, and
- you know your ATM pin.
Check, check, check. She trusts you are you.
Mutual authentication. You both think you know who the other is.
Mutual Auth in Computers
In computers it's about the same. Both sides need to trust each other. And bad guys could be executing a man-in-the-middle attack.
One place we use mutual authentication is SSH. You want to SSH to a server, you want to know it's really the server you think it is.
Let's say you're going to copy up some secret information. How do you know for sure you're connecting to the right server? What if somebody is trying to trick you into uploading the secret info to their server? SSH servers do prove to the client connecting to them that they have a secret key. Read about it here: https://support.alertlogic.com/hc/en-us/articles/360002999732-How-does-SSL-mutual-authentication-work-
EVERY TIME YOU LOGIN ON A SERVER you are mutually authenticating.
Your browser trusts the remote server and puts the lock in the address bar. Then you type in a username and password, and now the server trusts you.
Or HTTPS - Sometimes still called SSL, but TLS is the accurate name for the protocol.
There are same protocol exchanges that mutually authenticate. You can mutually authenticate over https. You have a "client" certificate that you use in the key exchange with the server. The server verifies your client certificate is signed by a certificate authority that the server trusts to sign client certs. Just like your browser checks that the server's cert is signed by a certificate authority that the browser trusts.
Look at mutual TLS authentication in action
NodeJS is an interesting implementation. It's both a pain in the hind at first, and sorta easy code to read once you figure it out. Have a look at this writeup and the nodejs docs.
Mutual Authentication: https://en.wikipedia.org/wiki/Mutual_authentication
Definitions of authentication:
an act, process, or method of showing something (such as an identity, a piece of art, or a financial transaction) to be real, true, or genuine : the act or process of authenticating something
Source: “Authentication.” The Merriam-Webster.com Dictionary, Merriam-Webster Inc., https://www.merriam-webster.com/dictionary/authentication. Accessed 25 January 2020.
authentication is the process of verifying that identity. It might involve validating personal identity documents, verifying the authenticity of a website with a digital certificate,1 determining the age of an artifact by carbon dating, or ensuring that a product or document is not counterfeit.