What is a memorized secret (gespeichertes Geheimnis), and what does its authenticator profile look like?
A secret value, such as a password, PIN or (in older practice) answers to security questions, usually chosen by the user and kept in memory or another safe place; it is a single-factor, knowledge-based authenticator.
| Property | Memorized secret |
|---|---|
| Type | Single-factor (SF) |
| Category | Knowledge-based (kenntnisabhängig) |
| Secret value | Password / PIN |
| Activation value | None |
| Authentication function | None, or a hash function |
| Output value | Password, or hash of the password |
| Credential | (Password or) hash of the password |
The profile shows the trivial case of the authenticator schema: nothing activates the secret, no fresh input goes in, and the output is the secret itself. The only protection is that the secret is hard to guess, so passwords need enough length and randomness that an attacker can neither guess nor compute them. On the verifier side only a properly salted and hashed form should be stored; keeping the plain password as the credential is no longer acceptable.
NIST SP 800-63B-4 now simply calls this authenticator type passwords, and it no longer accepts security questions as an authentication secret.
Go deeper:
NIST SP 800-63B-4: Passwords — the authenticator type and its verifier requirements.
How to Choose a Password (Computerphile, YouTube) — why length and unpredictability beat clever substitutions.