I am currently reading Engineering Security by Peter Gutmann, on page 7 he states:

proper mutual authentication is quite different from unilateral authentication in both directions

He references What is authentication by Dieter Gollmann which is a transcript of a discussion. The relevant part here is:

Next point, if you scan the literature on entity authentication you will find, starting around 1991, comments that mutual authentication is something different from unilateral authentication going both ways.

Unfortunately I cannot follow the transcribed discussion. Can you explain the difference between bilateral authentication and double unilateral authentication both ways? Why is double unilateral authentication not sufficient?

  • $\begingroup$ So what precisly is your question? "What is the difference between unilateral and bilateral authentication?"(title) is quite vague and the answer is: "The one authenticates both parties and the other doesn't." Or are you asking "What is the difference between bilateral authentication and double reciproke unilateral authentication?" (i.e. between bilateral and two unilateral executions) $\endgroup$ – SEJPM Feb 13 '16 at 12:52
  • $\begingroup$ The latter one: "What is the difference between bilateral authentication and double reciproke unilateral authentication?". Gutmann compares TLS-PSK/TLS-SRP for "proper mutual authentication" and TLS with certificate authentication (both parties) for "unilateral authentication both ways". I understand the difference on the implementation level but the sentence reads for me as if there is a qualitative (formal) difference. $\endgroup$ – xcvbn Feb 13 '16 at 20:22
  • $\begingroup$ @FlorianZiegler, I edited to clarify the question. Feel free to edit further if you think I butchered it. $\endgroup$ – otus Feb 14 '16 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.