Mutual Authentication
What is Mutual Authentication?
A security process in which both parties in a communication verify each other's identity before exchanging data, preventing impersonation attacks.
Terms that appear alongside mutual authentication
Each of these is named in at least one of the same controls as mutual authentication. The number is how many controls name both.
- authentication 9 shared controls
- tls 4 shared controls
- oauth 3 shared controls
- encryption 3 shared controls
- authorization 2 shared controls
Frameworks that govern mutual authentication
What the standards actually require on mutual authentication
Requirements naming mutual authentication across 6 standards, quoted from the control text.
For authenticating and authorising calls, agencies should use a two-way scheme that is encrypted and that cannot be replayed.
new-zealand-information-security-manual-nzism::18.3.13.C.02 · 18.3.13.C.02 Encrypted non-replayable mutual authentication for calls →Enforce mutual authentication between User Equipment and the network using the Evolved Packet System Authentication and Key Agreement protocol.
SP800-187-3.3 · Mutual Authentication via EPS-AKA →The asset owner shall use mutual authentication between components and services where the risk requires it, so that a component verifies what it talks to.
iec-62443::USER 1.10 · Mutual authentication →Security Dimension 2 Authentication per X.805 Clause 6.2: Authentication confirms that each party to a communication (for example a person, device, service or application) really is who it claims to be, and gives assurance that no party is impersonating anothe...
X805-Dim2-Authentication-Identity-Verification-Claimed-Identities-Entities-Communication · ITU-T X.805 Security Dimension 2 - Authentication + Identity Verification + Claimed Identity + Entity Authentication + Data Origin Authentication + Mutual Authentication + Multi-Factor + Cryptographic Authentication →To enable the data flows the provider must implement interfaces through which an NBFC-AA can submit consent artefacts, the two authenticate each other, and financial information flows securely to the NBFC-AA.
india-account-aggregator-framework-rbi::26(1) · Para 26(1): providers implement interfaces for consent submission and mutual authentication →Discloses the device's ability to authenticate communication partners: whether it provides or supports node authentication so that sender and recipient are known to each other and authorised to receive the information (for example web APIs, SMTP, SNMP) (NAUT-1...
mds2-medical-device::NAUT · NAUT Node authentication: disclose mutual authentication of communicating nodes, network access control and certificate use →Questions people ask about mutual authentication
What is Mutual Authentication?
Why is Mutual Authentication important for compliance?
Which compliance frameworks address Mutual Authentication?
Where can I learn more about Mutual Authentication?
See how Mutual Authentication applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.