How does an authenticator generate its output value?

Question

Accepted Answer

Output value = authentication function(secret value, [activation values], [input values]): the secret is mandatory, while activation values (such as a PIN or fingerprint) and input values (such as a random challenge) are optional.

* The secret stays inside the authenticator; only the computed output leaves it. *

Component
German term
Role
Examples

Secret value
geheimer Wert
The core of the authenticator; must never leave it
Private key, OTP seed, password

Activation value
Aktivierungswert
Unlocks the secret locally, adding a factor
PIN, fingerprint, face

Input value
Eingabewert
Makes each output unique
Random challenge, nonce, current time

Authentication function
Authentifizierungsfunktion
Combines the above into the output
Signature, HMAC, hash, or no function at all

Output value
Ausgabewert
What is sent to the verifier
Signature, 6-digit code, password

The schema is a useful lens for comparing any two authenticators: ask what the secret is, whether something must activate it, whether a fresh input goes in, and what comes out. The answers predict most of an authenticator's strengths and weaknesses.
Go deeper:

NIST SP 800-63-4: Authenticators — secrets, activation secrets and authenticator outputs in the NIST model.

Component	German term	Role	Examples
Secret value	geheimer Wert	The core of the authenticator; must never leave it	Private key, OTP seed, password
Activation value	Aktivierungswert	Unlocks the secret locally, adding a factor	PIN, fingerprint, face
Input value	Eingabewert	Makes each output unique	Random challenge, nonce, current time
Authentication function	Authentifizierungsfunktion	Combines the above into the output	Signature, HMAC, hash, or no function at all
Output value	Ausgabewert	What is sent to the verifier	Signature, 6-digit code, password