Quiz Entry - updated: 2026.10.22
How do a password, a look-up secret list and a smartcard compare as authenticators?
Password and look-up secrets are single-factor authenticators whose output is (part of) the secret itself; the smartcard is a multi-factor authenticator whose secret never leaves the chip and whose output is a fresh signature.
| Property | Memorized secret | Look-up secret | Smartcard |
|---|---|---|---|
| Type | SF | SF | MF |
| Category | Knowledge | Possession | Possession + knowledge |
| Secret value | Password / PIN | List of random values | Private key |
| Activation value | None | None | PIN |
| Function | None or hash | Selection | Signature |
| Output | Password (or its hash) | One value from the list | Signature over a nonce |
| Credential | Hash of the password | The chosen value, hashed | Certificate / public key |
| Replay of a captured output | Works every time | Fails (single use) | Fails (fresh nonce) |
| Stolen credential reveals | Hash for offline guessing | Hashes of codes | Nothing secret |
Reading down the columns shows how strength grows: from a reusable secret, to single-use secrets, to a hardware-protected key with local activation and fresh outputs. The table is also a template for analysing any other authenticator, such as an OTP app, a passkey or an SMS code.
Go deeper:
NIST SP 800-63B-4: Summary of usability considerations — the same authenticator types compared from the user's side.