What are the steps of the NIST authentication process?
The relying party requests authentication, the claimant submits its authenticator output to the verifier (authentication request), the verifier checks the output and returns the result to the RP (authentication confirmation), and the RP opens an authenticated session with the subscriber.
* Three parties, four messages: the verifier checks the output, the relying party only receives the verdict. *
- Request authentication: the subject wants to use a service; the relying party (RP) asks it to authenticate.
- Submit authenticator output (Authentifizierungsanfrage): the claimant uses its authenticator, for example types a password or lets a smartcard sign a challenge, and sends the output to the verifier.
- Verify: the verifier checks the output against the credential it holds for that account.
- Return the result (Authentifizierungsbestätigung): the verifier tells the RP whether authentication succeeded, and the RP opens an authenticated session.
The verifier is a functional role, not necessarily a separate machine: it can be part of an identity provider (IdP), as in federation, or built into the RP itself, as in a classic website login. Separating the roles makes clear that the RP never needs to see the secret; it only needs a trustworthy verdict.
Go deeper:
NIST SP 800-63-4: Authentication process — the sample process with RP, claimant and verifier.