Subject: RE: Comments Re: [seamoby] ct problem statement

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Fri, 8 Jun 2001 15:49:36 -0500

Thanks Charlie, see below

-----Original Message-----
From: Charles E. Perkins [mailto:[email-masked]]
Sent: Friday, June 08, 2001 3:04 PM
To: Nakhjiri Madjid-MNAKHJI1
Cc: [email-masked]'; 'seamoby'
Subject: Re: Comments Re: [seamoby] ct problem statement

Hello Madjid,

Nakhjiri Madjid-MNAKHJI1 wrote:

> MN>> Sure. I get it, but my question is:
> do we have different credential for authentication and authorization today?
> 
> Madjid

It seems to me that today we typically use authentication when
we really need authorization.  I guess the theory is that if you
really know who is on the other side of the communiations fence,
you'll be able to track them down if anything goes wrong.

Regards,
Charlie P.

-------------

That was exactly my point, today there is no difference between
the credential 

The reason that I asked the question
was your following answers to Phil:
 
[
> Is authentication needed?

Probably not.

> Is authorization needed?

I think this is the central requirement.
]

how would we separate the two? This is actually a question
that I have? (now I am contradicting myself with the DoS email
that I just sent, but anyway). 
Sorry for getting philosophical, but that is in theory, tracking
down the attacker afterward might not get the damage undone.
, and the statistics (I don't remember) says that a lot of DoS and 
security attacks comes from inside firewalls, but I don't know how
we can separate peer authentication from just in time authorization 
for each session without requiring registrations or introducing delays?

Regards,
Madjid

---

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 08 Jun 2001 16:11:39 -0700

Hello Madjid,

I think people usually want secure authorization, and they
ask for authentication because it's less abstract somehow.

You and I wrote:

>> Sure. I get it, but my question is:

> That was exactly my point, today there is no difference between

I'm not very clear on what you mean.  If you mean that today people
usually accept authentication credentials as good enough for authorization,
then I reckon that may be true, but I am not sure why it is relevant
to the discussion we were having.

> how would we separate the two?

We can separate the two in a lot of ways, depending on the
purpose for which authorization is needed.  If you want to
know that someone can pay, and the credit card company says
they can pay, that is good enough.  If you want assurance
that someone is authorized to see your documents, you need
some other sort of authorization; it still doesn't have to
be done by authenticating their identity.  If you have an
access control list of authorized identities, then you can
use authentication.

It seems to me that we don't need a general authorization
algorithm.  We could use a general authentication algorithm,
but then we have to decide whether that implicitly solves
the authorization problem (whatever the latter is determined
to be).

I believe that we can and should separate authorization and
authentication for the purpose of context transfer.  All that
matters is that the requester is the same node that used to
own the context at the previous access router.  It doesn't
really matter what IP address belongs to the requester (for
this purpose of authorizing a context transfer).

Regards,
Charlie P.

---

From: Michael Thomas <[email-masked]>
Date: Fri, 8 Jun 2001 18:07:37 -0700 (PDT)

> ask for authentication because it's less abstract somehow.

   Bzzt. You need authentication to know whether somebody's
   *impersonating* somebody who has authorization to do 
   what the attacker wants to do.

 > to the discussion we were having.
   
   False. On your typical OS, you log in first. That is
   authentication first and foremost. It may also authorize
   you for, say, a shell, but that's orthogonal. Other
   services may use your user name or UID, to determine
   finer grained authorization, but they all expect that
   the OS has provided a sufficient authentication. Indeed,
   if the credentials are either not sufficient, or perhaps
   in a different realm, it's up to the application to 
   authenticate itself using whichever authentication
   methods it deems appropriate.

 > they can pay, that is good enough.

   Uh, do you *really* think that credit card
   company doesn't attempt to authenticate you
   before they issue a card? All you're saying
   here is that you trust third party authentication
   (the credit card company) to make an authorization
   decision based on that identity (give service).

 > If you want assurance
 > be done by authenticating their identity.  

   False. Only a fool would authorize something
   without authenticating them first.

 > algorithm.

   There is no such thing.
   
 > We could use a general authentication algorithm,

   Authentication can never solve authorization. They're
   apples and oranges.
 
 > this purpose of authorizing a context transfer).

   Pray tell, how can you tell if they are "the same node"
   if you don't authenticate them? Just because you claim
   to be the same node?

   Please people, I urge people who are confused
   to do some reading. This is really basic stuff
   and we're headed off into durable nonsense
   la-la land.

	 Mike

---

From: Charlie Perkins <[email-masked]>
Date: Fri, 08 Jun 2001 18:28:00 -0700

>    what the attacker wants to do.

This is manifestly wrong, because one can carry something
that gives authorization for some resource without having
to be identified.

>    authentication first and foremost.   ...

This is a case where authentication provides sufficient authorization
(according to the system design).

>    decision based on that identity (give service).

It's often enough true, however, that someone can use a
credit card to get authorization for transfer of resources,
without being the owner of the card.  And this is often
enough quite legitimate.

>    without authenticating them first.

False.  I would authorize a lot of things if you give
me enough money, and I wouldn't care who you are.

>  > It seems to me that we don't need a general authorization

You seem so sure of yourself.

>    Authentication can never solve authorization. They're

What about your OS login example?  Never say never.
It depends on the system design.

>    if you don't authenticate them? Just because you claim

If the node exhibits knowledge of a particular secret, I can
believe they are authorized no matter who they are.

>    and we're headed off into durable nonsense

It's always good to read and study and understand more.
It's furthermore typically good to help others understand,
given that time is available.  You seem to have enough time
on your hands.

...
Charlie P.

---

From: Michael Thomas <[email-masked]>
Date: Fri, 8 Jun 2001 18:56:12 -0700 (PDT)

Charlie, 

There is no point in arguing with you. I gave you
the benefit of the doubt which was clearly not
justified; this is security 101. There is nothing
here in your rebuttal that shows that you have
even elementary clues. Please take some time to
educate yourself so that you can stop spewing this
uneducated nonsense. As for my supposed free time,
I have better uses for it. Maybe Dan Harkins would
be willing to help you.

	     Mike

---

From: "Charles E. Perkins" <[email-masked]>
Date: Sat, 09 Jun 2001 18:24:19 -0700

Hello folks,

It seems to me that this issue is too important to leave unsettled.
I didn't find anything in the books I looked at to resolve the
issue, but it's true that I don't necessarily know which books
are best to consult.  Help will be appreciated, at least by me.
If this mailing list is considered to be the wrong place for such
information, let me know and I'll not post any more requests.

Roughly speaking, I understand a node to be "authorized"
if it has permission to do something.  I understand the node
to be "authenticated" if its identify has been verified.
If that's wrong, then I'd like to find out why.

If it's right, then I'd like to find out why my discussion in
the message below should be considered uneducated, nonsensical
spew.

If the bottom line is that these concepts are too hard for
people like me to understand, then the relevant charter items
should be moved to a working group where the right kind of
people are able to put in the effort to carry out the work.
I find that very hard to believe, but I'm willing to be
educated.

Thanks for your consideration of my request.

Regards,
Charlie P.