1. A method comprising: receiving, at a computing device that executes an authentication service, an authentication request that identifies a transaction; determining, by the computing device, a risk associated with the transaction; determining, by the computing device, an authentication score based upon the risk, wherein the authentication score comprises a level of nonrepudiation that is to be satisfied to allow the transaction; and determining, by the computing device, groups of authentication factors, wherein a one of the groups of authentication factors is determined to satisfy the authentication score based on relative strengths and nonrepudiation aspect strengths of the authentication factors.