Two-Step vs. Two-Factor Authentication - Is there a difference?

Question

These days, there's pretty much three forms of authentication in general use on the web:

• Single-factor authentication, e.g.: PIN or password.
• Two-factor authentication, e.g.: Single-factor plus a software- or hardware-generated token code, or a smart card.
• "Two-step" authentication, e.g.: Single-factor plus a code sent to the user out-of-band.

Usually, the second step in two-step authentication involves the user receiving a code via e-mail or SMS and entering it alongside (or after) their pin/password on the website/app being used. The e-mail inbox or receiving phone could be considered as "something you have", thus qualifying this as two-factor authentication. However, the code that is actually used (and the credentials used to access the account/device which receives the code) in the second step is still a "something you know".

So, is two-step authentication a new form of two-factor authentication? Or is it really just multi-single-factor authentication?

Answer 1

Two-factor authentication refers specifically and exclusively to authentication mechanisms where the two authentication elements fall under different categories with respect to "something you have", "something you are", and "something you know".

A multi-step authentication scheme which requires two physical keys, or two passwords, or two forms of biometric identification is not two-factor, but the two steps may be valuable nonetheless.

A good example of this is the two-step authentication required by Gmail. After providing the password you've memorized, you're required to also provide the one-time password displayed on your phone. While the phone may appear to be "something you have", from a security perspective it's still "something you know". This is because the key to the authentication isn't the device itself, but rather information stored on the device which could in theory be copied by an attacker. So, by copying both your memorized password and the OTP configuration, an attacker could successfully impersonate you without actually stealing anything physical.

The point to multi-factor authentication, and the reason for the strict distinction, is that the attacker must successfully pull off two different types of theft to impersonate you: he must acquire both your knowledge and your physical device, for example. In the case of multi-step (but not multi-factor), the attacker needs only to only pull off one type of theft, just multiple times. So for example he needs to steal two pieces of information, but no physical objects.

The type of multi-step authentication provided by Google or Facebook or Twitter is still strong enough to thwart most attackers, but from a purist point of view, it technically isn't multi-factor authentication.

Answer 2

Here's a flow diagram explaining the differences.

Source: https://ramblingrant.co.uk/the-difference-between-two-factor-and-two-step-authentication

Answer 3

I wouldn't really classify the "two-step" as a distinction. It's a mechanism of a factor that may or may not still be something you know. For example, if the code is sent to a cellphone, then it's really something you know (password) and something you have (cellphone). If it's sent to an e-mail, it's really still single factor since both the e-mail and account are (most likely) password derived.

It's certainly still a mechanism of validation in the e-mail sense, but it doesn't add any more than asking for a second password would do in terms of authentication.

Answer 4

You can simply say that every Two-Factor authentication is a Two-Step authentication, but not the other way around.

When, I enter my password and scan my fingerprint, I am doing a Two-Step authentication and using a Two-Factor (something you know, something you are)

However, when I entered my regular account password and a one-time-password, I am doing Two-Step but only use One-Factor (something I know)

Answer 5

The difference is addition versus multiplication.

Two-step is an additive process: you authenticate once with one independent credential (a password), and then again with another independent credential (a OTP, either delivered via SMS, phone, or in some generator app). You have authenticated yourself twice.

Two-factor is multiplicative: you're combining one independent credential (a PIN or secret key or biomarker) with another (a certificate, or a cryptographic token code) to derive a stronger single credential than each independent credential.

Assigning completely arbitrary and convenient numbers to credential types (1=none, 2=password [any kind: self-defined, OTP, etc], 3=crypto credential [cert, token code]), I can demonstrate that a password is stronger than no password (2>1); that two-step authentication is stronger than a single password ((2+2=4)>2) or a crypto credential ((2+2=4)>3) independently, but always weaker than any multi-factor scheme ((2+2=4)<(2*3=6)).

Answer 6

EDIT (15/5/2015): Paul Moore's answer seems sounder technically than mine (upvoted it)

---

I am missing any reputable source in current answers, so I will refer to Schneier and to Google's own help pages to argue that "two-step" is just a layperson-friendly name for two-factor authentication:

Schneier:

Recently, I've seen examples of two-factor authentication using two different communications paths: call it "two-channel authentication." One bank sends a challenge to the user's cell phone via SMS and expects a reply via SMS. If you assume that all the bank's customers have cell phones, then this results in a two-factor authentication process without extra hardware. And even better, the second authentication piece goes over a different communications channel than the first; eavesdropping is much more difficult.

Google support (and others that I can't post because lack of reputation): Just notice how they interchangeably use them, rather falling back to "factor" when the thing gets technical.

Answer 7

From an information-theory point of view, there isn't any difference between them. This is why entanglement doesn't allow for FTL transmission of data, it's as if you wrote down the information on a piece of paper and walked a mile, and then opened it. The information wasn't transmitted across time, it was there all along. Perceptually it's different for us, but it's all chained to preexisting "information you know."

That being said, there ARE security implications between the two. Cracking a deterministic token generally requires social engineering or rubber-hose based attacks. If the man is out to get you and they know you depend on 2-step authentication, they can monitor the out-of-band signal and correlate your activities. Let's say, for example, you operate .onion site on the TOR network that requires a text message for the out-of-band second step. If you are 1/100 people on a list of possible suspects, they could check the time-stamps on all of your text messages and correlate changes on the site.

Answer 8

Your definitions are a little off. Two Step Verification (I'm assuming you are thinking of Google) can use tokens too, and Two Factor Authentication could use codes, or biometrics, or really anything that gives you two or more of the categories: What you know, what you have, or what you are.

What distinguishes Google's two step verification from proper two factor authentication is that you are not always required to use the second factor to authenticate. It only asks you to use it to verify your identity when there is doubt, or when the cookie it set in your browser expires.

As to the status of a phone or e-mail account as a factor, I'd classify it as something you have. It is as much something you have as a software token is. Sure you know the password to the e-mail account, but you could also know the seed data to re-create a software token.

Answer 9

Two factor usually means that you know something (like a password) and that you own or have something like a token or a mobile phone.

Therefor two step means, that the authentication is done in two steps, one after another. Whether you use two steps just by knowing something like two passwords or you use tokens doesnt matter.

Bruce Schneier even differs between two step and two channel authentication. Two channel authentication is more or less if you have two channels you communicate on. For example if you start an authentication at your desktop computer but you need to end the authentication using your smartphone means that both are used whether in two-step or two-factor authentication but both use different channels.