Glossary
Identity security, defined precisely
63 terms across carrier signals, authentication, post-quantum cryptography, privacy engineering, and agentic identity. Each definition is original, self-contained, and written by the team that ships the systems it describes.
Identity Threat Response
- ITRaaS (Identity Threat Response as a Service)
- ITRaaS is a service layer that acts on identity threats automatically instead of only reporting them. Full definition →
- Identity threat response
- Identity threat response is the set of actions taken after an identity compromise signal fires: revoking sessions and credentials, downgrading trust, forcing re-verification, and notifying downstream systems. Full definition →
- Attestation (identity)
- An attestation is a signed statement by a verifier about facts it checked at a specific moment: this passkey assertion was valid, this phone line had not been swapped, this device posture met policy. Full definition →
- Verification gate
- A verification gate is a checkpoint placed in front of an identity provider or application that evaluates live trust signals (carrier state, passkey validity, device posture) on each sensitive request. Full definition →
- Revocation cascade
- A revocation cascade is the coordinated invalidation of everything an identity compromise touches: sessions, tokens, credentials, delegated agents, and active negotiations, executed as one atomic operation rather than a checklist. Full definition →
- Trust signal
- A trust signal is a verifiable fact about an identity's current state that a system can weigh in an access decision: how long the current SIM has been on a phone line, whether a passkey assertion verified, whether a credential appears in a breach corpus. Full definition →
- Signal freshness (TTL)
- Signal freshness is the age of an identity signal at the moment it is used, and it often matters more than the signal's strength. Full definition →
Carrier Signals
- Carrier signal
- A carrier signal is a fact about a phone line sourced from mobile network infrastructure: whether the SIM changed recently, whether the number was ported to another carrier, whether the line is currently reachable. Full definition →
- SIM swap
- A SIM swap is the transfer of a phone number to a new SIM card or eSIM profile. Full definition →
- SIM swap detection
- SIM swap detection is a check against live carrier data that reports whether, and how recently, the SIM behind a phone number changed. Full definition →
- Port-out fraud
- Port-out fraud is the unauthorized transfer of a phone number from the victim's carrier to a different carrier controlled by the attacker. Full definition →
- Silent number recycling
- Silent number recycling is the reassignment of a dormant phone number to a new subscriber without any signal reaching the services that still associate the number with its previous owner. Full definition →
- SIM tenure
- SIM tenure is the length of time the current SIM has been associated with a phone number. Full definition →
- Number verification (silent network authentication)
- Number verification, also called silent network authentication, confirms that a device requesting access actually holds the phone number it claims, using the mobile network's own session rather than an SMS code. Full definition →
- GSMA Open Gateway
- GSMA Open Gateway is a carrier-industry initiative that exposes network capabilities, including SIM-swap status, number verification, and device location, as standardized APIs (developed in the CAMARA project) so that developers can consume the same signal the same way across participating operators. Full definition →
- IMSI
- The IMSI (International Mobile Subscriber Identity) is the unique identifier stored on a SIM that identifies a subscriber to the mobile network. Full definition →
- MVNO opacity
- MVNO opacity is the reduced visibility of carrier signals for numbers served by mobile virtual network operators, resellers who run on a host carrier's network. Full definition →
- SS7 attack
- An SS7 attack abuses the signaling protocols that interconnect mobile networks to intercept calls and SMS or track location, by sending network-internal queries from a rogue interconnect. Full definition →
- eSIM swap
- An eSIM swap moves a phone number to a new embedded-SIM profile through a purely digital enrollment, no physical card, no store visit. Full definition →
Authentication & Account Security
- Passkey
- A passkey is a cryptographic credential, a public/private key pair, that replaces a password. Full definition →
- WebAuthn / FIDO2
- WebAuthn is the W3C browser API through which websites create and verify public-key credentials; FIDO2 is the umbrella standard pairing WebAuthn with CTAP, the protocol browsers use to talk to authenticators like security keys and platform biometrics. Full definition →
- Phishing-resistant MFA
- Phishing-resistant MFA is authentication that a user cannot be tricked into completing for an attacker, because the proof is cryptographically bound to the legitimate site's origin rather than typed by a human. Full definition →
- Push fatigue (MFA fatigue)
- Push fatigue is an attack that bombards a user with authentication approval prompts until one is tapped, by accident, in annoyance, or on the assumption the system is glitching. Full definition →
- SMS OTP
- An SMS OTP is a one-time passcode delivered by text message. Full definition →
- Account takeover (ATO)
- Account takeover is an attacker gaining control of a legitimate user's account, typically by stealing or resetting its credentials rather than exploiting software. Full definition →
- Credential stuffing
- Credential stuffing is the automated replay of username-password pairs leaked from one service against many others, exploiting password reuse. Full definition →
- Account recovery fraud
- Account recovery fraud is the abuse of forgot-password and account-reset flows to mint fresh credentials for an attacker. Full definition →
- Step-up authentication
- Step-up authentication is demanding stronger proof of identity when the stakes of a request rise: a wire release, a password change, a new payee. Full definition →
- Continuous authentication
- Continuous authentication re-evaluates trust throughout a session instead of only at login, using signals that update in real time: carrier events, device posture, behavioral consistency. Full definition →
- Device binding
- Device binding ties a credential or session to a specific physical device so that stealing the credential alone is not enough; the attacker would need the hardware too. Full definition →
- DPoP (Demonstrating Proof of Possession)
- DPoP, defined in RFC 9449, binds OAuth access tokens to a cryptographic key held by the client, so a stolen token is useless without the private key that signs each request using it. Full definition →
Cryptography & Post-Quantum
- Post-quantum cryptography (PQC)
- Post-quantum cryptography comprises algorithms designed to remain secure against attackers equipped with large quantum computers, which would break today's RSA and elliptic-curve schemes. Full definition →
- ML-DSA
- ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is the NIST-standardized post-quantum signature scheme defined in FIPS 204, derived from CRYSTALS-Dilithium. Full definition →
- Hybrid signatures
- A hybrid signature signs the same message with two schemes at once, one classical (such as ECDSA or Ed25519) and one post-quantum (such as ML-DSA), so the signature remains valid if either scheme survives. Full definition →
- Harvest now, decrypt later
- Harvest now, decrypt later is the strategy of recording encrypted traffic or signed artifacts today in order to break them once quantum computers can. Full definition →
- Keyed hashing
- Keyed hashing computes a digest under a secret key (typically HMAC) so that producing or precomputing hashes requires the key. Full definition →
- Pepper
- A pepper is a server-held secret used as the key in hashing personal identifiers, stored separately from the database it protects. Full definition →
- HMAC
- HMAC (Hash-based Message Authentication Code, RFC 2104) is a construction that combines a cryptographic hash function with a secret key to produce a keyed digest. Full definition →
- JCS canonicalization
- JCS (JSON Canonicalization Scheme, RFC 8785) defines a single, deterministic byte representation for any JSON document, fixing key order, number formatting, and escaping. Full definition →
- QRNG (Quantum Random Number Generator)
- A QRNG derives randomness from quantum-mechanical processes, such as photon behavior, whose outcomes are unpredictable in principle rather than merely hard to model. Full definition →
- DRBG (seed-and-stretch)
- A DRBG (Deterministic Random Bit Generator) expands a small high-quality seed into a large stream of cryptographically strong randomness. Full definition →
- Crypto-agility
- Crypto-agility is a system's ability to replace cryptographic algorithms without redesign: swapping a deprecated hash, rotating to a post-quantum scheme, or running two schemes side by side during migration. Full definition →
- Keyspace enumeration
- Keyspace enumeration is reversing a hash by trying every possible input, which is feasible whenever the input space is small. Full definition →
Privacy Engineering
- Zero-PII architecture
- A zero-PII architecture is a system design in which no plaintext personal identifiers exist in storage: identifiers are keyed digests, operational personal data is encrypted with purpose-bound access, and the property holds structurally rather than by policy. Full definition →
- Pseudonymization
- Pseudonymization is processing personal data so it can no longer be attributed to a person without additional information kept separately, GDPR Article 4(5)'s definition. Full definition →
- Data minimization
- Data minimization is collecting and retaining only the data a stated purpose requires, a GDPR principle that doubles as security engineering: data never collected cannot be breached, subpoenaed, or leaked. Full definition →
- k-anonymity
- k-anonymity is a privacy property in which any individual record is indistinguishable from at least k-1 others, so nothing can be attributed to one person. Full definition →
- Derived data
- Derived data is anything computed from personal data: hashes, fingerprints, embeddings, scores. Full definition →
Agentic & Machine Identity
- Agentic identity
- Agentic identity is the discipline of establishing who an AI agent acts for, what it is currently permitted to do, and how its authority ends. Full definition →
- A2A trust attestation
- A2A (agent-to-agent) trust attestation is a protocol by which two autonomous agents establish scoped, revocable trust before transacting, using attestations anchored to their delegation chains rather than a shared secret. Full definition →
- Delegation chain
- A delegation chain is the auditable path from an acting agent back to the human who authorized it, through every intermediate delegation. Full definition →
- Trust coefficient
- A trust coefficient is a continuously maintained numeric score of an agent's trustworthiness, derived from its behavioral history, scope usage, and environmental signals, that maps to concrete authority: what it may do, how much it may move, how fast. Full definition →
- Machine identity (non-human identity)
- Machine identity covers the credentials and authority of non-human actors: services, workloads, bots, and AI agents. Full definition →
- Just-in-time capability token
- A just-in-time capability token grants an agent exactly the permission a specific task needs, minted at the moment of need and expiring when the task ends. Full definition →
- Standing privilege
- Standing privilege is authority that persists whether or not it is being used: durable admin rights, long-lived API keys, accumulated OAuth scopes. Full definition →
- Trust decay
- Trust decay is the deliberate erosion of an agent's trust score over time or under behavioral drift, so that trust must be continuously re-earned by consistent action rather than granted once. Full definition →
Standards & Compliance
- Verifiable credential (VC)
- A verifiable credential is a W3C-standardized digital credential, an attribute set about a subject, signed by an issuer, that any verifier can check cryptographically without contacting the issuer. Full definition →
- DID (Decentralized Identifier)
- A DID is a W3C-standardized identifier that resolves to a document containing public keys and service endpoints, letting the identified party prove control cryptographically without a central registry. Full definition →
- CAEP (Continuous Access Evaluation Profile)
- CAEP is an OpenID standard for transmitting security events between identity systems while sessions are live: a session revoked here, a credential compromised there, delivered as signed security event tokens so that relying systems can react mid-session instead of at the next token refresh. Full definition →
- Shared Signals Framework (SSF)
- The Shared Signals Framework is the OpenID Foundation's transport layer for security event exchange between systems: how transmitters and receivers establish streams, verify each other, and deliver signed event tokens. Full definition →
- eIDAS 2.0 / EUDI Wallet
- eIDAS 2.0 is the EU regulation establishing a European Digital Identity Wallet that member states must offer citizens, holding government-recognized credentials usable across the EU for public and private services. Full definition →
- SD-JWT (Selective Disclosure JWT)
- SD-JWT is an IETF format that lets a credential holder reveal individual claims from a signed credential without revealing the rest: the issuer signs hashed claim values, and the holder discloses only the claims a given verifier needs, with each disclosure verifiable against the signature. Full definition →
- SOC 2
- SOC 2 is an attestation framework in which an independent auditor examines a service organization's controls against the AICPA Trust Services Criteria, security, availability, processing integrity, confidentiality, privacy. Full definition →