Why can a subject authenticate again and again after a single registration, and what does that imply for trust?
Once a credential is registered for an identity, proving possession of the matching authenticator is enough at each login; the costly identity check happens only once, at enrollment, so every later login inherits the quality of that first check.
There are two different moments:
- Enrollment (once): someone checks who the subject is (identity proofing), creates the account and binds an authenticator to it by registering its credential.
- Authentication (every time): the subject only proves control of the authenticator. Nobody looks at an ID document again.
That split is efficient, but it has a consequence: authentication proves "this is the same subject whose authenticator was registered", not "this is really Alice". If the enrollment accepted a fake passport, every perfect login afterwards still authenticates the impostor. Overall trust therefore needs both a strong authenticator and a reliable identity proofing, which is why assurance frameworks rate them separately (identity assurance and authentication assurance).
Go deeper:
NIST SP 800-63-4: Identity proofing and enrollment — how enrollment and binding precede repeated authentication.