Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 659

The DOI matches its Crossref record; 1 of the 1 references it cites were found in a registry or an index.

Comparing passwords, tokens, and biometrics for user authentication

O'Gorman, L.·2003·Proceedings of the IEEE
DOI 10.1109/jproc.2003.819611
Open this paper in CoChat — free account

Abstract

For decades, the password has been the standard means for user authentication on computers. However, as users are required to remember more, longer, and changing passwords, it is evident that a more convenient and secure solution to user authentication is necessary. This paper examines passwords, security tokens, and biometrics-which we collectively call authenticators-and compares these authenticators and their combinations. We examine their effectiveness against several attacks and suitability for particular security specifications such as compromise detection and nonrepudiation. Examples of authenticator combinations and protocols are described to show tradeoffs and solutions that meet chosen, practical requirements. The paper endeavors to offer a comprehensive picture of user authentication solutions for the purposes of evaluating options for use and identifying deficiencies requiring further research.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/jproc.2003.819611

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 1 references

Research works printed but not linked: 52

  1. Kahn, 1996, The Codebreakers: The Story of Secret Writing
  2. Stocksdale, NSA Glossary of Terms Used in Security and Intrusion Detection
  3. Rescorla, 2000, SSL and TLS: Designing and Building Secure Systems
  4. 2001, Federal Information Processing Standards Publication, FIPS-197
  5. 10.1145/359168.359172 · DOI · Paper page
  6. 10.1016/0167-4048(89)90049-7 · DOI
  7. 10.1016/0167-4048(89)90006-0 · DOI
  8. 10.1007/0-387-34805-0_6 · DOI
  9. 10.1016/0167-4048(95)00003-Q · DOI
  10. 10.1016/S0167-4048(97)00008-4 · doi:10.1016/s0167-4048(97)00008-4
  11. 10.1016/S0167-4048(00)06027-2 · DOI
  12. 10.1016/S0167-4048(00)07023-1 · DOI
  13. Smith, 2002, Authentication, From Passwords to Public Keys, 255
  14. Jain, 1998, Kluwer
  15. 10.1007/978-1-4757-4036-3 · DOI · Paper page
  16. 10.1002/9781119644682 · DOI · Paper page
  17. Stallings, 1999, Cryptography and Network Security: Principles and Practice, 490
  18. 10.1002/9781119183471 · DOI · Paper page
  19. Weiss, 1988, Method and apparatus for positively identifying an individual
  20. O’Gorman, Seven issues with human authentication technologies, 185
  21. 10.1117/12.462719 · DOI · Paper page
  22. 10.1147/sj.403.0614 · DOI · Paper page
  23. 10.1109/RISP.1992.213269 · DOI · Paper page
  24. 10.1109/49.223865 · DOI · Paper page
  25. Wu, The secure remote password protocol, 97
  26. 10.1109/TPAMI.2002.1023799 · DOI · Paper page
  27. 1999, CCIMB, Common Criteria Interpretations Management Board, 8
  28. 10.1016/S0167-4048(00)05029-X · doi:10.1016/s0167-4048(00)05029-x
  29. Schneier, 1998, Biometrics: Truths and fictions
  30. 10.1109/99.641608 · DOI · Paper page
  31. 10.1109/100.755813 · doi:10.1109/100.755813
  32. Rigney, 2000, Remote Authentication Dial in User Service (RADIUS), 10.17487/rfc2865 · DOI · Paper page
  33. Black, 2000, Internet Security Protocols: Protecting IP Traffic, 113
  34. Rivest, 1992, The MD5 Message-Digest Algorithm, 10.17487/rfc1321 · DOI · Paper page
  35. Steiner, Kerberos: An authentication service for open network systems, 191
  36. Kohl, 1993, The Kerberos Network Authentication Service (V5), 10.17487/rfc1510 · DOI · Paper page
  37. 10.1145/359657.359659 · DOI · Paper page
  38. Taschek, 2002, Liberty alliance or passport?
  39. Stinson, 2002, Cryptography Theory and Practice
  40. 1995, U.S. Dept. Commerce, Nat. Inst. Sci. Technol. (NIST)
  41. McCabe, ANSI/NIST-ITL 1-2000 Data Format for the Interchange of Fingerprint, Facial, and Scar Mark & Tattoo (SMT) Information
  42. 10.17487/rfc2828 · DOI · Paper page
  43. Howard, 2000, Designing Secure Web-Based Applications for Microsoft Windows 2000, 407
  44. 2002, Oxford Univ. Press
  45. 10.1016/S0031-3203(02)00038-9 · DOI
  46. 10.1109/89.861378 · DOI
  47. Rabiner, 1993, Fundamentals of Speech Recognition
  48. van Renesse, 1994, Optical Document Security
  49. 10.1006/dspr.1999.0355 · DOI
  50. Blackburn, 2001, FRVT 2000 Evaluation Report
  51. 10.1109/34.990140 · DOI · Paper page
  52. Mansfield, 2001, Biometric Product Testing Final Report

Cited by

See all 659

Metadata

Authors
O'Gorman, L.
Venue
Proceedings of the IEEE
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2003-12
Volume
91
Issue
12
Pages
2021-2040
ISSN
0018-9219 (ISSN-L)
DOI
10.1109/jproc.2003.819611
OpenAlex
W2111303254
Cited by
659
References
1
FWCI
32.61
Type
journal article
Language
en
Open access
closed
Licence
ieeexplore.ieee.org/Xplorehelp/downloads/license-information/IEEE.html (vor)

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

How to cite

Cite CoChat for the checks on this page, and the paper for its own findings.

This page
CoChat. (2026). Citation check: Comparing passwords, tokens, and biometrics for user authentication. https://app.cochat.ai/papers/10.1109/jproc.2003.819611
The paper
O'Gorman, L. (2003). Comparing passwords, tokens, and biometrics for user authentication. Proceedings of the IEEE. https://doi.org/10.1109/jproc.2003.819611

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.