What is Mutual Authentication?
Mutual authentication is a process in which a client process and server are required to prove their identities to each other before performing any application function. The client and server identities can be verified through a trusted third party and use shared secrets as in the case of Kerberos v5. The MS-CHAP v2 and EAP-TLS authentication methods support mutual authentication.
Sometimes referred to as two-way authentication, mutual authentication is an approach within the electronic communications process that allows both the point of origin and the point of termination of a communication link to verify or authenticate each other. This is a common process that is part of the basic function of many different communication systems, both private and public. The essential reason for mutual authentication is to ensure that both parties are communicating with legitimate entities and not a party that is attempting to appear to be someone else. Within a private network environment, such as within the confines of a business, mutual authentication functions as a means of allowing the client to verify or authenticate the server. This helps the client or end user know that he or she is connecting with the company server and will be able to access all data on the server that is allowed with his or her access credentials. At the same time, the server will authenticate the
Mutual authentication is really site or host authentication to the user combined with user authentication to the site. Site authentication is already provided by SSL. Unfortunately, many sites ask users to log into non-SSL sites and users rarely check SSL certificates for validity. Fraudulent websites can use self-issued SSL certificates to fool users or generate a fake SSL ‘key lock’ and position it over the key location in the browser. SSL site authentication is clearly broken.
Related Questions
- Now that I have Remote Desktop Connection 6.0, how do I get past the authentication on the client, and authenticate with the logon keyboard on the server?
- How could I use NTLM Authentication to authenticate via Windows NT Authentication for a servlet based intranet-application ?
- What is Mutual Authentication?
