What does MFA actually prove?
Summary: MFA strengthens assurance that a claimant controls authenticators bound to an identity. By itself, it is not proof of the physical situation in which authentication occurs.
Multi-factor authentication is a fundamental mechanism in modern digital security. Its purpose is to avoid making an authentication decision depend on a single type of evidence.
But understanding what MFA protects --- and what it does not claim to protect --- requires a simple question:
What exactly does a successful authentication prove?
What "multi-factor" actually means
Authentication factors are traditionally associated with categories such as something a user knows, something they possess, or a biometric characteristic.
NIST formalizes assurance through its Authenticator Assurance Levels. At AAL2, for example, a claimant must demonstrate possession and control of two distinct authentication factors. AAL3 adds requirements including hardware-based authentication and verifier-impersonation resistance.
The wording matters.
MFA increases confidence that the claimant controls authenticators bound to the account. That is not the same claim as:
"The claimant is physically in the situation the service assumes."
Identity and situation are different dimensions
Consider a perfectly valid authentication:
- the password is correct;
- the second factor is valid;
- the cryptographic protocol succeeds;
- the server recognizes the expected account.
These elements can provide strong assurance about digital identity and control of authenticators.
They do not necessarily describe the physical relationship between the equipment involved.
Where is the authenticator?
Where is the terminal?
Are they actually together?
Does the observed communication correspond to their real physical relationship?
Those questions belong to another layer of the security model.
NIST already separates different properties
NIST guidance demonstrates that authentication cannot be reduced to the number of factors.
SP 800-63B separately addresses replay resistance, verifier-impersonation resistance and authentication intent --- whether the subject demonstrates an explicit intent to authenticate.
That last property is particularly instructive. NIST notes that a wireless connection to an authenticator alone does not necessarily establish intent: a nearby attacker could potentially initiate or proxy an interaction.
Different security properties therefore answer different questions, even inside the conventional authentication model.
Adding factors does not automatically transform identity evidence into evidence of physical context.
What about adaptive authentication?
Modern systems may also use IP address, geolocation, time of day, transaction type or behavioral patterns as risk signals.
Those signals can be valuable.
NIST nevertheless distinguishes them from authenticators themselves: its Digital Identity Guidelines FAQ describes risk-based and adaptive signals as additional controls rather than, by themselves, valid authenticator types.
This distinction helps separate three questions:
Is the identity authenticated?
Does the transaction appear risky?
Has a physical property of the interaction been established?
These mechanisms can complement one another. They are not interchangeable.
The special case of co-presence
Suppose an application should authorize an operation only when two devices are physically co-present.
A successful MFA transaction may provide high confidence that the user controls the required factors.
But the application is asking for a different property:
Are the two devices actually in the same physical situation at the time of the operation?
Relay-attack research demonstrates why this question matters. In some systems, legitimate devices can participate in a relayed transaction without an attacker compromising their underlying secrets.
The problem is not necessarily a false identity.
It can be a false physical relationship between potentially valid identities.
A different layer of trust
At Keypulse, we treat this distinction as a research problem in its own right.
MFA answers an essential question: which authenticators does the claimant control?
Co-presence asks another: what physical property actually relates the participants at the moment of interaction?
This is not an argument for replacing MFA. Evidence of co-presence does not replace passwords, cryptographic keys or biometrics when those mechanisms are required.
It addresses a different property.
Identity and situation can therefore be considered complementary dimensions of trust:
Strong authentication can establish who participates in an interaction without, by itself, establishing the physical situation in which that interaction occurs.
That distinction matters whenever a security decision depends not only on who is acting, but also on the physical reality of where, when and with what.
References
- NIST, SP 800-63B --- Digital Identity Guidelines: Authentication and Authenticator Management. https://pages.nist.gov/800-63-4/sp800-63b/authenticators/
- NIST, SP 800-63 Digital Identity Guidelines FAQ, adaptive authentication and authentication intent. https://pages.nist.gov/800-63-FAQ/
- NIST, SP 800-63B Implementation Resources --- Authenticator Assurance Levels. https://pages.nist.gov/800-63-3-Implementation-Resources/63B/AAL/
- Aurélien Francillon, Boris Danev, Srdjan Čapkun, Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars, NDSS, 2011. https://eprint.iacr.org/2010/332