How does NIST SP 800-63B define authentication, and what does "in control of the secrets" imply?

Authentication is the process of determining the validity of one or more authenticators used to claim a digital identity, by establishing that a subject trying to access a digital service (the relying party, RP) is in control of the secrets used to authenticate.

The definition is deliberately modest. It does not say authentication proves who a person is; it says it proves that the subject controls certain secrets. The consequence is uncomfortable but important: whoever controls the secret is authenticated. An attacker with a stolen password, or someone who was handed an unlocked token, passes exactly like the legitimate user.

That is why the whole field revolves around how tightly a secret is bound to its owner, and why NIST insists that every authenticator contains a secret: a password, an OTP seed, a symmetric key or a private key. Methods without a real secret are not acceptable on their own. Knowledge-based questions ("name of your first pet") can be researched, and a biometric characteristic is not secret at all, since you leave fingerprints everywhere and show your face in public.

For services that people return to, successful authentication gives risk-based assurance that the subject today is the same one as last time.

Go deeper:

• NIST SP 800-63B-4: Introduction — the full definition and what it means for return visits.
• NIST SP 800-63-4: Authenticators — why every authenticator must contain a secret, and why KBA and biometrics alone do not qualify.