Mutual Authentication
What is Mutual Authentication?
A security process in which both parties in a communication verify each other's identity before exchanging data, preventing impersonation attacks.
Terms that appear alongside mutual authentication
Each of these is named in at least one of the same controls as mutual authentication. The number is how many controls name both.
- authentication 9 shared controls
- tls 4 shared controls
- oauth 3 shared controls
- encryption 3 shared controls
- authorization 2 shared controls
Frameworks that govern mutual authentication
What the standards actually require on mutual authentication
Requirements naming mutual authentication across 6 standards, quoted from the control text.
Enforce mutual authentication between User Equipment and the network using the Evolved Packet System Authentication and Key Agreement protocol.
SP800-187-3.3 · Mutual Authentication via EPS-AKA →Security Dimension 2 Authentication per X.805 Clause 6.2: Authentication ensures the validity of the claimed identities of the entities participating in communication (e.g.
X805-Dim2-Authentication-Identity-Verification-Claimed-Identities-Entities-Communication · ITU-T X.805 Security Dimension 2 - Authentication + Identity Verification + Claimed Identity + Entity Authentication + Data Origin Authentication + Mutual Authentication + Multi-Factor + Cryptographic Authentication →5G SBI between Network Functions must be protected using TLS 1.2 or higher with mutual authentication via certificates. Direct communication may use OAuth 2.0 for service authorization.
33.501-13.1 · Service-Based Architecture Security (TLS) →802.1X authentication with EAP-TLS, using X.509 certificates, is used for mutual authentication; with all other EAP methods disabled on supplicants and authentication servers.
ISM-1321 · 802.1X authentication with EAP-TLS, using X.509 certificates, is used for mutual authentic →Implement mutual TLS + token binding + JWS signing + key management per FAPI 2.0 + national scheme requirements. mTLS for Client Authentication and Token Binding must (a) use certificate-based mutual authentication between AS + Client + (b) bind tokens to clie...
OPENBANK-3 · Mutual TLS, Token Binding, Request Signing (JWS), Key Management →Protect data in transit between SWIFT components using strong encryption and mutual authentication so that internal flows cannot be intercepted or replayed.
CSCF-2.1 · Internal Data Flow Security →Questions people ask about mutual authentication
What is Mutual Authentication?
Why is Mutual Authentication important for compliance?
Which compliance frameworks address Mutual Authentication?
Where can I learn more about Mutual Authentication?
See how Mutual Authentication applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.