Which factor of authentication is an X.509 certificate

Question

Given 3 factors of authentication:

• Type 1: something you know
• Type 2: something you have
• Type 3: something you are

Which factor of authentication would be an X.509 certificate, assuming this certificate is stored in the filesystem of the device I use? For example, let's place it in the context of TLS mutual authentication, where the aforementioned certificate is the client certificate. Please note this is not a question about a digital certificate stored on a separate hardware token or similar.

My understanding is that this is still a type 1, not type 2, because it does not relate to the physical posession of device other than the one client is using anyway. Is my understanding correct?

Answer 1

Within certificate based authentication the user has not only the certificate but also the secret key to this certificate, which matches the public key inside the certificate. Only the user itself should possess this secret key and this is verified within the certificate based authentication. This private key is not a secret shared with the server like in case of a password - it is something only possessed by the user. Therefore it is "something you have".

There can also more or less physical aspects be associated with this: the private key can actually be integrated inside a physical smart card or similar device. The cryptographic operations for the proof are only executed on this hardware which is also designed so that it can neither be copied nor the private key extracted. But even if the private key only resides on the clients computer or smartphone: it is expected that it is adequately protected against cloning, i.e. only stays on this specific device. So it is kind of physical too.