Authentication (Authentifizierung) is the recurring process of checking that a (partial) identity really belongs to the subject presenting it, by verifying with a certain confidence that the subject's credentials match the claimed identity.

Three words in that definition carry the meaning:

• Recurring: authentication happens at every login, again and again. The one-off steps that come before it (checking who someone is and registering them) are identity proofing and enrollment, a different process.
• (Partial) identity: a person has many partial identities, such as an employee account, a private mail account or a bank customer number. Authentication checks the link between one of them and the subject in front of the system.
• With a certain confidence: authentication never delivers certainty, only a degree of assurance that depends on the means used.

It helps to separate it from identification: typing a user name claims an identity ("I am alice"); authentication is the proof of that claim. Only after both comes authorisation, the decision about what the authenticated subject may do.

German uses several words for the same process: Authentifizierung, Authentifikation, Authentisierung, and in everyday speech simply Login. Some German texts distinguish Authentisierung (the subject presents proof) from Authentifizierung (the system checks it), but they are often used as synonyms.

Go deeper:

• Authentication (Wikipedia) — authentication in computer science, its factors and types.
• OWASP Authentication Cheat Sheet — how authentication is built and hardened in real applications.

The strength of the binding between the (partial) identity and the subject, which in turn depends on the number and the type of authentication means used.

Authentication can only be as strong as the link it relies on. A password can be shared, guessed, phished or written on a sticky note, so it ties an account to a person only loosely. A smartcard that only works with a PIN ties it much more tightly: an attacker would need both the physical card and the PIN.

Two levers raise the strength:

• Number: every additional independent means forces an attacker to break one more thing. Two means of the same kind (two passwords) add little, because the same attack (phishing, a keylogger) captures both.
• Type: means differ in how hard they are to steal or copy. A secret that is typed in can be observed and replayed; a private key that never leaves a chip and signs a fresh challenge cannot be replayed at all.

Assurance frameworks turn this idea into levels. NIST SP 800-63B, for example, requires one factor at AAL1, two distinct factors at AAL2, and at AAL3 two factors plus a phishing-resistant cryptographic authenticator with a non-exportable key. How such levels are defined and assessed is the subject of authentication quality and assurance levels.

Go deeper:

• NIST SP 800-63B-4: Authentication Assurance Levels — how number and type of authenticators map to AAL1, AAL2 and AAL3.