Authentication - Myths and misconceptions

There is a mantra telling us that authentication is difficult. The failure to design robust authentication protocols is commonly attributed to a lack of good design strategies, and to a lack of verification tools. This paper tells the story of entity authentication arguing that clarity is more important than precision, and that formal methods sometimes even add to the confusion about the meaning of 'authentication'. Verifying claimed identities translates into checking whether a party is alive, or into checking the identity of the party at the other end of a connection. Correspondence properties can capture both aspects, obscuring an important distinction.