What is activation data in a multi-factor authenticator, and why is it never sent to the verifier?

Activation data (Aktivierungsdaten), a PIN or biometric, unlocks the secret stored in the authenticator locally; only the resulting output travels to the verifier, so the activation secret cannot be intercepted on the network or stolen from a server.

Take a smartcard: the PIN goes to the card, the card checks it itself, and only then does it allow its private key to sign the verifier's challenge. The verifier receives a signature; it never learns the PIN.

This design has several consequences:

• Short secrets are fine: a 6-digit PIN would be weak as a server password, but here the card itself blocks after a few wrong attempts, so it cannot be brute-forced. NIST requires activation secrets of at least 4 characters and recommends at least 6.
• No central database: there is no PIN hash on a server to steal.
• Theft alone is not enough: whoever steals the card still needs the PIN, which is what makes the card count as two factors.

NIST calls such a local PIN an activation secret to distinguish it from a centrally verified password, which is sent to the verifier and must be much stronger.

Go deeper:

• NIST SP 800-63B-4: Activation secrets — length, attempt limits and local verification of activation secrets.