Re: Outreach via wikipedia articles on authentication and authorization

While your example is a great example of how identity works fine at the
granularity level where all entities are people, my concern is more that
it braked down when entities are programs, libraries, objects or services.

Consider your document example. You, as a representative of a big tech
company and me, representing law enforcement are coauthoring a
confidential document regarding a subject that for example the eff would
love to get its hands on. Now consider I delegate access to the document
to my editor (Alice) and seeing I'm overusing the same words over and over
decide to make use of a cool new editor feature that can suggest synonyms.
I ask my editor Alice to suggest synonyms within a single paragraph. Now
what happens, my editor delegates access to the paragraph to a module Bob.
Bob splits up the
paragraph into sentences, and in order not to disclose the full paragraph,
Bob shuffles the sentences before one asking an other module (Carol) to
look for synonyms in that sentence. Carol takes each sentence, finds verbs
and nouns in the sentences, stems the verbs, shuffles the nouns and verb
stems and one by one asks an other module (Dick) to suggest synonyms.

So far everything is fine, we've done all we can so that Dick is granted
only least authority to do what Dick is meant to do. But now consider that
Dick uses a public web-service Mallet, incidentally provided by the EFF.

Now consider that Alice,Bob,Carol,Dick and Mallet are all given access to
my unattenuated identity, given that we can not meaningfully attenuate or
decompose the authority to hold 'me' responsible.

Now consider the following attack:

Mallet uses my identity to determine that I am one of 10,000 law
enforcement people (within her 100,000,000 user-base) that she needs to
keep tabs on.
Mallet than uses a relatively large amount of computing power to create
10.000 linguistically correct candidate paragraphs from the nouns and verb
stems provided to her. Mallet uses her index of 10,000 tech-company people
(that includes you) to create 100,000,000 hypothesis's: "This is a
paragraph
coauthored by Rob and tech-company person X", and uses an amazingly fast
algorithm that reliably tests this hypothesis in close to no time, in such
a way that in two weeks time Mallet has a set of 10 candidate paragraphs
that score >99% probability of being a paragraph coauthored by the two of
us.
After human inspection, one of the ten documents seem to make perfect sense,
and happens to be almost identical to the original paragraph that Alice
delegated to Bob.

Without my identity, Mallet could not have carried out this attack in the
relative short time-span of a few weeks. The problem is that while my
authority gets decomposed and attenuated with every delegation, my
identity does not, and in the end its my very identity that effectively
leaks the
authority I had regarding reading the paragraph.

I know the attack may be a bit far fetched, but I think it illustrates my
points while being still close to your example. My point that identity
isn't
decomposable and that identity carries authority.

In my view, Alice delegating my identity to Bob is where the problem starts.
And if we agree that identity, other than authority, should not just be
handed down to lower granularity levels of entities holding authority,
than we can also agree that at these finer levels of granularity, identity
and authentication should not be considered a relevant precursor for
authorization.

I hope I'm making sense here.

Rob


On Tue, August 13, 2013 17:15, Karp, Alan H wrote:
> Rob Meijer  wrote:
>
>> 2) Identity is not decomposable or attenuable, so the authority
>>    to access the information, either for access control or
>> accountability
>>    is not really suitable to do POLA with.
>
> As a practical matter, identity is decomposable in an interesting way.
> Let's say that we have an agreement to work on a document that we wish to
> keep secret, but we don't fully trust each other not to leak it for
> personal gain.  We write a contract specifying that whoever leaks any part
> of the document will pay the other a $100 penalty.  For the sake of
> argument, let's say that we have a perfect mechanism for determining who
> leaked the document.
>
> After we sign the contract, I delegate read/write permission to you, you
> delegate read permission to Alice.  Alice delegates read permission of
> Chapter 1 to Bob.  Bob delegates read permission to the first paragraph to
> Carol.  (I can keep going, but you get the drift.)  The granularity gets
> arbitrarily fine.  Each delegation and each access to the document records
> the identity of the person taking the action and the entire delegation
> chain to that point.  Sounds horrible.  There's no privacy at all.
> Identities are everywhere.  I assume that's what you mean when you say
> that identity is not attenuatable.
>
> Now say that Carol leaks her paragraph, and I find out about it.  What
> will I do?  I will ask YOU for $100.  The point is that I never heard of
> Carol, have no way to contact her, and even if I did, I have no contract
> with her to force her to pay.  You, also, never heard of Carol, but you
> know from the recorded delegation chain that she got it from somebody
> named Bob that you never heard of.  Fortunately for you, you know that Bob
> got it from Alice, whom you do know.  You enforce your contract with Alice
> to get $100 from her.  The process continues until we reach the end of the
> delegation chain or somebody doesn't demand payment from the next person.
>
> The point here is that a delegation carries rights and responsibilities,
> which is the definition of a contract.  We need a mechanism to assign
> blame when the terms of the contract are violated even if it's only an
> implicit contract.  That mechanism involves identity, but that identity
> need only be pairwise.  I know you, you know Alice, etc.  However, I get
> to choose what I call you, you get to choose what you call Alice, etc.
> When I find out that Carol leaked the paragraph, I tell you that your
> Alice's Bob's Carol is the culprit, but I have no way to use that
> information to identify Carol directly.  It's up to you to handle the next
> link in the delegation chain.  In this sense identity is attenuatable down
> to the granularity of the pairwise relationships.
>
> ________________________
> Alan Karp
> Principal Scientist
> Enterprise Services, Office of the CTO
> Hewlett-Packard Company
> 1501 Page Mill Road
> Palo Alto, CA 94304
> (650) 857-3967, fax (650) 857-7029
> http://www.hpl.hp.com/personal/Alan_Karp
>
>
>
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>
>