Subject: RE: Comments Re: [seamoby] ct problem statement

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Fri, 8 Jun 2001 14:54:20 -0500

-----Original Message-----
From: Pat Calhoun [mailto:[email-masked]]
Sent: Thursday, June 07, 2001 3:41 PM
To: Nakhjiri Madjid-MNAKHJI1
Cc: 'Charles E. Perkins'; Gary Kenward; [email-masked]'; 'seamoby'
Subject: Re: Comments Re: [seamoby] ct problem statement

On Thu, Jun 07, 2001 at 03:43:29PM -0500, Nakhjiri Madjid-MNAKHJI1 wrote:
> Hi Charlie,
> 
> Correct me if I am wrong, 
> I have not been very successful in finding specs that
> discriminate between authentication and authorization.
> So far I have only seen it in AAA Arch. 
> Otherwise people use authentication credentials
> and authorization credentials interchangably.
> 
> So we created a requirement that the CT peers should
> mutual authenticate each other prior to CT. Do you think
> a separate requirement for authorization is needed?

   Authentication
      The act of verifying the identity of an entity (subject).

   Authorization
      The act of determining whether a requesting entity (subject) will
      be allowed access to a resource (object).

MN>> Sure. I get it, but my question is:
do we have different credential for authentication and authorization today?

Madjid

---

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 08 Jun 2001 13:04:17 -0700

Hello Madjid,

> do we have different credential for authentication and authorization today?

It seems to me that today we typically use authentication when
we really need authorization.  I guess the theory is that if you
really know who is on the other side of the communiations fence,
you'll be able to track them down if anything goes wrong.

Regards,
Charlie P.

---

From: Arthur Ross <[email-masked]>
Date: Fri, 8 Jun 2001 13:54:47 -0700

>you'll be able to track them down if anything goes wrong.
Close ... Arthur's [slightly cynical] definitions:

Authentication = the person/thing is indeed really who they claim to be.

Authorization = the bill is likely to be paid, i.e. it's ok to run up charges.

Different functions, but, as several folks have said, intertwined & often
treated as though they are the same thing.

   -- ahmr

---

From: Michael Thomas <[email-masked]>
Date: Fri, 8 Jun 2001 17:38:28 -0700 (PDT)

> you'll be able to track them down if anything goes wrong.

   I really wish you'd read a book or something. The two
   are not comparable; you need both to make decisions,
   and the entities that make each decision are separable.

		Mike

---

From: Charlie Perkins <[email-masked]>
Date: Fri, 08 Jun 2001 17:53:56 -0700

Rather than slinging mud onto a well-intentioned piece of
e-mail, maybe you could point out what is wrong with
what I said.  Maybe I read the wrong book for my
information, or maybe I missed the part that would have
pointed out the error in my thinking.

>    and the entities that make each decision are separable.

I'm pretty sure this is wrong, but you seem so certain of your
statement that I wonder where the mismatch could be.
I do not think that one always needs authentication to perform
authorization, and I do not think that one always needs
authorization to perform authentication.  Do you have anything
more that would clarify this?  What was wrong with my examples?
Or did you mean something else?

...
Charlie P.

---

From: Michael Thomas <[email-masked]>
Date: Fri, 8 Jun 2001 18:13:14 -0700 (PDT)

> pointed out the error in my thinking.

Charlie,

See my next piece of mail. You have consistantly
not understood this as was abundantly evident at
the last IETF about the BU problem. All you've
managed to do is replace in your mind that it was
really authorization instead of authentication
which was the root problem, when in fact it has
always been *both* which are necessary. It has
never been either/or. Never.

If you're going to be conversant about both this
and the BU problem, you need to grasp these
concepts.

	    Mike

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 11 Jun 2001 10:06:08 -0700

All,

Could I please ask the participants on this list to please try
to communicate in a gentler way? I understand that at times some
people may not necessary see things the way you do, but educating
them leads to cooperation much faster than simply telling them they
are stupid.

Let's stop this, folks!

PatC (sorry he wasn't around earlier to kill this)