Quiz Entry - updated: 2026.10.22
Which properties should a good authentication protocol have, and how does it guarantee freshness?
Security (resistance to attacks such as replay, guaranteed freshness), integrity and confidentiality, usability, scalability, interoperability and flexibility, plus compliance and auditability; freshness typically comes from nonces.
| Property | What it means in practice |
|---|---|
| Security | Resists attacks, in particular replay attacks, where a captured valid message is simply sent again later. |
| Freshness | Every run proves it is happening now: a random nonce (number used once) or a timestamp is bound into the messages, so an old recording does not verify. |
| Integrity and confidentiality | Messages cannot be read or altered in transit: secure channels (TLS, a direct server-to-server back channel), digital signatures or encryption. |
| Usability | Users can actually complete it; an unusable protocol gets bypassed. |
| Scalability | Works for millions of users and many services without per-pair setup. |
| Interoperability and flexibility | Different vendors' implementations work together; new methods can be added. |
| Compliance and auditability | Events can be logged and checked against regulation and policy. |
The nonce is the key idea for freshness: the verifier picks an unpredictable value, the response must contain it, and since the verifier never accepts the same nonce twice, a replayed message is rejected. In OpenID Connect the nonce parameter of the authentication request plays exactly this role for the ID token.
Go deeper:
Replay attack (Wikipedia) — how replays work and the standard countermeasures (nonces, timestamps, session tokens).- Cryptographic nonce (Wikipedia) — what a nonce is and how it guarantees freshness.