ISO 25023 divides the authenticity into authentication protocols and establishment of authentication rules. I understand that the authentication protocols aim to authenticate the user using different methods such as ID/password.

I hope that someone explain to me the difference between authentication rules and protocols.


1 Answer 1


The two notions may indeed be confusing since by definition a protocol is itself a set of rules. But in case of ISO/IEC 25023 the meanings are different and I think the best definition could be a tangible example:

Suppose you use any authentication protocol that uses ID/Password method as you said: the authentication rules could be, for example, a set f these ones:

  • The password must be hashed
  • The inputs must be sanitized to prevent SQL injections
  • The ID must be number
  • The ID must not exceed 25 digits
  • ...

An authentication rule is a set of measures taken to deploy the authentication protocol in practice.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .