I am reading The Basics of Information Security, 2nd. Ed., Andress, Jason.
He says on p.25, "Identity verification is a step beyond identification, but it is still a step short of authentication, which we will discuss in the next section." He then goes on to mention that even if documents proving who one are presented that that is only "verification" and not "authentication." Okay, but he never discusses "verification" again in detail.
On p.26 he says that, "Authentication is, in an information security sense, the set of methods we use to establish a claim of identity that has been made is correct." Okay great.
On p.31, he says, "When we complete an authentication transaction with a biometric identifier, we are essentially asking the user to provide evidence that he or she is who he or she claims to be; this by definition, verification, and not authentication." Now I am lost.
I have researched more on the difference between "verification" and "authentication," but just don't know where the crucial, and I assume subtle, difference is.
I know that there are two types of biometric authentication, verification that the data matches the data of the person that the presenter says he is, and identification, where an attempted match is tried against all entries in the biometric database.
How can presenting per-enrolled biometric info be anything other than authentication?