What it means
Authenticity addresses the question, Is this what it claims to be? It applies to people signing in, systems communicating, software updates, digital records, certificates, and messages. Authenticity is related to integrity, but the concepts are not identical: integrity concerns unauthorized change, while authenticity concerns genuineness and origin.
How it works
Evidence of authenticity can come from credentials, cryptographic signatures, certificates, hardware roots of trust, verified distribution channels, identity proofing, and trusted records. Confidence depends on the entire chain, including enrollment, key protection, validation, revocation, and the trust placed in issuing authorities.
A digitally signed software package can provide evidence that it came from the expected publisher and was not altered after signing. That assurance weakens if the publisher's signing key is stolen or if the user ignores a failed signature check.
Practical focus
- Verify identities and sources before granting trust
- Protect signing keys, certificates, and enrollment processes
- Define how authenticity failures are detected and handled
- Use independent evidence for high-consequence decisions
Common mistakes
- Assuming encryption automatically proves who sent the data
- Trusting a familiar name or logo without validating the source
- Keeping expired or revoked credentials in active trust stores
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: