Subject: [Ace] comments about draft-gerdes-ace-actors-05

From: "Kim, William G" <[email-masked]>
Date: Thu, 28 May 2015 17:53:39 +0000

Below are my comments from reviewing the draft-gerdes-ace-actors-05 document.

----
In Terminology section 1.1, the Principal definition:

   Principal:  (Used in its English sense here, and specifically as:) An
      individual that is either RqP or RO or both.

I suggest replacing this parenthetical statement with what is actually meant by "its English sense". If that's defined, then IMO the second part of this definition becomes unnecessary taken together with the definitions of RqP and RO. How about something like:

   Principal:  An individual that acts as the main authority of an entity.

----

In section 3, there is the following statement:

   Authentication mechanisms can achieve additional security objectives
   such as non-repudiation and accountability.  These additional
   objectives are not related to authorization and thus are not in scope
   of this draft, but may nevertheless be relevant.

This statement seems to imply that this draft is strictly about authorization, which is untrue of this document in its current state. Not sure what change would be appropriate--maybe others on this list can clarify.

----

In section 5.3,

   CAS performs the following tasks:

   o  Validate on the client side that an entity has certain attributes.

   AS performs the following tasks:

   o  Validate on the server side that an entity has certain attributes.

I would suggest to rewording these to use the word authenticate/authentication instead, since it is practically spelling out the RFC 4949 definition of authentication anyways. My suggested text:

   CAS performs the following tasks:

   o  Client side authentication of resource domain entities

   AS performs the following tasks:

   o  Resource side authentication of client domain entities

Also, I don't really like "client" and "server" to distinguish the two sides, which appears to be the way it's described in the current document. Maybe "client side/domain" and "resource side/domain" instead?

----

Section 8.3 typo: similary --> Similarly

----

William Kim
Software Engineer
The MITRE Corporation

---

From: Göran Selander <[email-masked]>
Date: Fri, 29 May 2015 04:56:28 +0000

Hello William,

Thanks for comments! I’m fine with your proposed changes. Let me just comment on this :

> Also, I don't really like "client" and "server" to distinguish the two sides, which appears

> to be the way it's described in the current document. Maybe "client side/domain" and

> "resource side/domain" instead?"

We’ve had a long terminology discussion where each party had there preferences. (Just as a note: my preference is "resource provider" and "resource consumer” / “resource user”. ) The current client-server terminology may sometimes conflict with CoAP such that a Resource Server is a CoAP Client. But we had to give up this discussion and settled for some established terminology, in this case OAuth /UMA. This has the advantage that people who know those don’t have to learn new terms when speaking about a similar problem in a different context.

Göran

From: <Kim>, William G <[email-masked]<mailto:[email-masked]>>
Date: Thursday 28 May 2015 19:53
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [Ace] comments about draft-gerdes-ace-actors-05

----

----

----

In section 5.3,

----

----

William Kim
Software Engineer
The MITRE Corporation