Re: Outreach via wikipedia articles on authentication and authorization

Comments inline.

________________________
Alan Karp
Principal Scientist
Enterprise Services, Office of the CTO
Hewlett-Packard Company
1501 Page Mill Road
Palo Alto, CA 94304
(650) 857-3967, fax (650) 857-7029
http://www.hpl.hp.com/personal/Alan_Karp


> -----Original Message-----
> From: Mike Samuel [mailto:[email protected]]
> Sent: Tuesday, August 06, 2013 12:56 PM
> To: Karp, Alan H
> Cc: General discussions concerning capability systems.
> Subject: Re: [cap-talk] Outreach via wikipedia articles on authentication and
> authorization
> 
> 2013/8/6 Karp, Alan H <[email protected]>:
> > I have some stuff on slides I used for an RSA talk that talks about access
> control having four steps.
> >
> > 1. Identification - knowing who to throw in jail.  Well, OK, just knowing who to
> hold responsible.  It's what we do when setting up an account for a new user.
> >
> > 2. Authentication - what a process must do to be able to use the privileges
> assigned to an identified individual
> 
> So authentication is necessarily protocol related?  "Attach these
> identity-related secrets to this request in this way."

Not necessarily.  In a ZBAC system the authentication would be used to grant authorization tokens to whomever presented the credentials.
> 
> > 3. Authorization - granting a right to be associated with a particular
> authentication, e.g., adding an entry in an ACL
> 
> Would encrypting something using the intended recipient's public key
> be an authorizing action then?
> If authentication is a process action, then could decoding using a
> private key achieve that, and could identification involve storing the
> public key in the right place?
> 
I don't see how encryption is relevant other than potentially as a means of authentication.

> > 4. Access decision - deciding whether or not to honor a request
> 
> So the outputs of access control code are access decisions?

As they say in the song, that's what it's all about.
> 
> > By the way, the statement about authentication is imprecise in a significant
> way.  Authentication only proves that you possess specific credentials.  It only
> specifies who you are (identification) if those credentials were not shared either
> intentionally or unintentionally.
> 
> Does this section from Wikipedia use terms properly?

No.
> 
> > However note that if a stranger tries to access someone else's account with
> > his own identification credentials, the stranger's identification credentials will
> > still be successfully authenticated because they are genuine and not
> > counterfeit, however the stranger will not be successfully authorized to
> > access the account, as the stranger's identification credentials had not been
> > previously set to be eligible to access the account, even if valid (i.e.
> > authentic).
> 
> It seems to use "authorized" the way you use "access decision" whereas
> the part where it says "previously set to be eligible" would
> correspond to the way you use "authorized."

I agree with your interpretation.