Which security goals does withdrawing cash at an ATM require, and why does it need all of them at once?

Question

Accepted Answer

All three: confidentiality, data integrity/authenticity, and user authentication — a cash withdrawal is the textbook case where every goal matters simultaneously.
Most applications need only one or two of the goals; a cash machine needs the full set, which is exactly what makes it a good mental model for the three-goal framework:

Confidentiality — your PIN and account details must stay secret on the wire, so an eavesdropper can't harvest them.
Data integrity / authenticity — the amount and target account in each transaction must reach the bank unaltered; a silently flipped "100 → 900" or a redirected account would be catastrophic.
User authentication — the machine must be sure you are the account holder (card plus PIN), because the whole point is to hand real money to the right person.

Contrast this with the simpler cases: a public archive needs only integrity, and a Pay-TV broadcast needs mainly confidentiality. The ATM sits at the top because money changes hands, so secrecy, tamper-resistance, and identity all have to hold together.
User authentication (also called instance or entity authentication) is the third goal beyond the classic two-part crypto puzzle — it verifies who is acting, not just protects the message. Its share of cryptographic applications is expected to keep growing as more everyday transactions move online.