Re: Comment on the paper by Rotondi, et al.

Hi Alan,
thanks for the comment. The issue you mention is a real and serious one, but don't 
forget we have a PDP to manage additional rules (even if currently it only limits to 
check if a capability has been revoked or not).
Adding rules to the PDP such that only capability owned by vetted subjects can be 
accepted is easy.
Ciao
   Domenico



On 31 Jan 2014 at 6:50, Karp, Alan H wrote:

    I’m reading the paper section by section as time permits, and I just finished the piece on 
    revocation.  Here I want to comment on the feature that allows revocation of just the 
    capability and not those delegated from it.  I believe that feature has a serious flaw, but Marc 
    Stiegler has come up with the correct variant.
     
    As described in the paper, a revocation request can be for the capability itself or the 
    capability and all capabilities delegated from it.  The problem with the former is that it is too 
    easy to bypass the revocation.  Say that Alice delegates a capability that expires in a year to 
    Bob, a manager in her department.  Bob re-delegates capabilities with subsets of the 
    permissions to people reporting to him.  Three months later, Bob leaves the company under 
    suspicion of stealing company secrets.  Alice clearly wants to revoke Bob’s capability, but 
    she doesn’t want to disrupt the work of people in his former department.  As a result, she 
    revokes Bob’s capability but not the capabilities delegated from it.  Unfortunately, one of 
    those delegated capabilities was one Bob delegated to himself with a key not controlled by 
    the company.  The result is that Bob retains access even after being fired.
     
    Marc Stiegler’s solution to Alice’s dilemma uses the distinction between vetted and unvetted 
    identities.  Say that the enterprise provides a mechanism by which Bob denotes the target of 
    the delegation by specifying someone in the company directory.  That’s a vetted identity.  If 
    Bob delegates to someone not known to the enterprise, that’s an unvetted identity.  When 
    Bob’s capability is revoked, the rule is to revoke all capabilities delegated to unvetted 
    identities but leave the others. 
     
    ________________________
    Alan Karp
    Principal Scientist
    Enterprise Services, Office of the CTO
    Hewlett-Packard Company
    1501 Page Mill Road
    Palo Alto, CA 94304
    (650) 857-3967, fax (650) 857-7029
    http://www.hpl.hp.com/personal/Alan_Karp

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk