How do authenticator and credential work together, and who holds which?
The subject holds and controls the authenticator; the verifier holds the credential. At login the authenticator produces an output, and the verifier checks it against the credential registered under the claimed identifier.
* The identifier binds the identity to the credential, and the credential lets the verifier recognise the authenticator's output. *
| Authenticator (subject side) | Output sent | Credential (verifier side) | Check |
|---|---|---|---|
| Password | The password | Salted hash of the password | Hash the input, compare |
| Finger on a sensor | A fresh biometric sample | Biometric template | Similarity score above a threshold |
| Smartcard with private key | Signature over a challenge | Certificate / public key | Verify the signature |
The pairing explains where the damage lands when something leaks. Steal the authenticator and you can impersonate the subject. Steal the credential and the effect depends on the type: a public key or certificate is harmless (it is public by design), a password hash enables offline guessing, and a leaked biometric template is a permanent problem because a finger cannot be replaced.
Go deeper:
NIST SP 800-63-4: Authentication and authenticator management — how authenticators are bound to subscriber accounts and verified.