What is “Implicit Authentication” in the context of authentication methods?
I searched the Web but could not find any article that describes this.
If anyone can describe it, that would be a great help.
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
I have seen that used in the context of session keys, to describe how a key
is tied to an identity without any certificate relative to that key could only be known by another identified party, without assurance that this party ever held that key.
For example, one generates a random symmetric key, encrypts it using (say) RSA and a public key, and sends the cryptogram to the alleged owner of the public key. Because only knowledge of the associated private key allows to recover the symmetric key, that symmetric key can only be known by the one that generated it and by the rightful holder of the asymmetric key, but it is not yet known if this rightful holder actually knows that symmetric key. There is thus implicit authentication of that symmetric key.
That key can later be used to demonstrate integrity and origin of a message from the holder of the asymmetric key to the originator of the cryptogram that established the symmetric key, using a MAC. As a side effect that demonstrates knowledge of the symmetric key by that rightfull holder, boosting its status from implicit to explicit authentication.
That usage occurs, for example, as "implicit key authentication" in the Key Authentication section of the Encyclopedia of Cryptography and Security, first edition. This is not a recommendation for this book, which I'm seldom using.
Update: reading that reference, I have pretty much turned around my definition. An encyclopedia is useful, sometime.