Quiz Entry - updated: 2026.10.22
What are the two ways to implement multi-factor authentication?
Either several single-factor authenticators are presented, each with its own credential registered at the IdP, or one multi-factor authenticator is presented, with a single registered credential and a secret protected by a second factor (activation data such as a PIN or biometric).
* Two locks with two keys on file, or one lock whose key is itself locked by a second factor. *
| Multiple single-factor authenticators | One multi-factor authenticator | |
|---|---|---|
| What is presented | Two or more separate outputs | One output |
| Credentials at the IdP | One per authenticator | Exactly one |
| Where the second factor is checked | At the IdP | Locally, inside the authenticator |
| Example | Password + code from an authenticator app | Smartcard with PIN, security key with fingerprint |
In the multi-factor authenticator the IdP never sees the PIN or fingerprint. It only sees a valid output, which the authenticator produces only after it was activated, and it trusts that the device enforces this (which is why such devices are certified and have attempt limits).
Go deeper:
NIST SP 800-63B-4: Multi-factor cryptographic authentication — the requirements for one authenticator that carries two factors.- NIST SP 800-63B-4: AAL2 permitted authenticator types — the allowed combinations of single-factor authenticators.