Which of the following authentication methods provides credentials that are only valid during a single session?

A token, in the context of modern authentication, refers to a credential, such as a One-Time Password (OTP) or a session token (e.g., SAML, JWT), that is generated for temporary use. After a user successfully authenticates with primary credentials, a session token is issued. This token is then presented to access resources and is valid only for the duration of that specific session or for a very short, predefined time. This mechanism avoids the repeated transmission of long-term credentials like passwords.

A. Kerberos v5: Kerberos tickets have a configurable lifetime, typically several hours, and are designed to be reused for multiple requests within that period, not for a single session.

B. Smart card: A smart card holds a private key and a corresponding digital certificate, which are long-lived credentials valid for many sessions until they expire or are revoked.

C. Certificate: A digital certificate has a defined validity period, often a year or more, and is used to authenticate a subject across numerous sessions, not just one.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-63B: Digital Identity Guidelines

Authentication and Lifecycle Management.

Section 4.2.2

Multi-Factor OTP Devices: This section describes One-Time Password (OTP) devices (a type of token)

stating

"OTPs are generated by a device (something you have) and are valid for a single authentication transaction or a short period of time." This directly supports the single-session/single-use nature of token-based credentials.

2. Internet Engineering Task Force (IETF). (2015). RFC 7519: JSON Web Token (JWT).

Section 4.1.4

"exp" (Expiration Time) Claim: This RFC

which defines a common format for session tokens

specifies the exp claim. This claim defines the expiration time on or after which the JWT MUST NOT be accepted for processing

tying the credential's validity to a specific session or timeframe.

3. Neuman

C.

Yu

T.

Hartman

S.

& Raeburn

K. (2005). RFC 4120: The Kerberos Network Authentication Service (V5).

Section 2.3

Tickets: This document states

"Each ticket has a limited lifetime." and "The TGT is a special ticket that permits the client to obtain other tickets." This confirms Kerberos tickets are valid for a duration allowing multiple service requests

not a single session.