Subject: [seamoby] authorization [was CT problem statement]

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Mon, 11 Jun 2001 14:39:19 -0500

Charlie,

I remember I had this question about  credential for authentication
or authorization when I was reading RFC 2977
" Mobile IP Authentication, Authorization, and Accounting Requirements"
I felt that the word credential was used both for authorization and 
accouting, without specifying what they are, or whether they are different.

Then I went to IETF 50 AAAArch and heard that they were mentioning
the same issue as a research topic. 
I must admit that I have not had time to look into their work
until the CT DoS issue came up. Anyway, since you are doing research
on this, I would appreciate if you share your findings with us.

I guess you have seen the following, since some of these
documents include Mobile IP cases, but anyway I found the following
on authorization, in case anybody have not seen it.

   [1]  Vollbrecht, J., Calhoun, P., Farrell, S., Gommans, L., Gross,
        G., de Bruijn, B., de Laat, D., Holdrege, M. and D. Spence, "AAA
        Authorization Framework", RFC 2904, August 2000.

   [2]  Vollbrecht, J., Calhoun, P., Farrell, S., Gommans, L., Gross,
        G., de Bruijn, B., de Laat, C., Holdrege, M. and D. Spence, "AAA
        Authorization Application Examples", RFC 2905, August 2000.

   [3]  Farrell, S., Vollbrecht, J., Calhoun, P., Gommans, L., Gross,
        G., de Bruijn, B., de Laat, C., Holdrege, M. and D. Spence, "AAA
        Authorization Requirements", RFC 2906, August 2000.

Unfortunately, I have not read them, I was just skimming through and
In RFC 2905 I found the following section on PPP (I only include the
important
parts). 
2.2.  Authorization Requirements

   The following requirements are identified in [9] for authorizing PPP
   dialin service using roaming.

   -  Authorization separate from authentication should be allowed when
      necessary, but the AAA protocol MUST allow for a single message to
      request both authentication and authorization.

   -  The protocol MUST provide the following features (per user
      session):

      1. One Authentication, One Authorization
      2. One Authentication, Multiple Authorization
      3. Multiple Authentication, Multiple Authorization

They do talk about an authorization separate from authentication, but
I did not see anything about  different credentials :(
So maybe Kulwinder is right at least according to what exist in specs
today.

Madjid

-----Original Message-----
From: Charlie Perkins [mailto:[email-masked]]
Sent: Sunday, June 10, 2001 9:15 AM
To: Kulwinder Atwal
Cc: 'seamoby'
Subject: Re: Comments Re: [seamoby] ct problem statement

Hello Kulwinder,

I'm still trying to identify the problem that prevented me from
satisfying <mat@cisco>'s  "security 101" criterion.  Thanks
for your comments.  I have a couple of follow-on questions.

Isn't it possible to have authorization without authentication?

In other words, isn't it possible to grant authorization based
on verification of some credential that doesn't provide any
assurance of identity?

Currency comes to mind, and then electronic cash, but other
credentials are possible and relevant to the discussion.
I realize that such things begin to blur the line between a
credential and a tradable resource.  As you have pointed
out, relying on credential verification itself begins to blur the
line between authentication and authorization.

Maybe an example would help.  Suppose I put something
in a treasure chest, which cannot be opened except with
a key I happen to have.  Then I give you the key and tell
you how to use it to open the treasure chest.

Doesn't your possession of that key mean that you have
authorization to open the treasure chest?  Surely, the
treasure chest isn't going to care about your identity.
To me, this means that authorization does not require
authentication.

It should be clear how to map this example into the [seamoby]
realm of authorizing access to transferable context information,
and very relevant to the eventual discussion we should be
having.

Regards,
Charlie P.

Kulwinder Atwal wrote:

> > -----Original Message-----
> > From: Nakhjiri Madjid-MNAKHJI1 [mailto:[email-masked]]
> > Sent: Friday, June 08, 2001 3:54 PM
> > To: 'Pat Calhoun'; Nakhjiri Madjid-MNAKHJI1
> > Cc: 'Charles E. Perkins'; Gary Kenward; [email-masked]'; 'seamoby'
> > Subject: RE: Comments Re: [seamoby] ct problem statement
> >
> >
> >
> >
> > -----Original Message-----
> > From: Pat Calhoun [mailto:[email-masked]]
> > Sent: Thursday, June 07, 2001 3:41 PM
> > To: Nakhjiri Madjid-MNAKHJI1
> > Cc: 'Charles E. Perkins'; Gary Kenward; [email-masked]'; 'seamoby'
> > Subject: Re: Comments Re: [seamoby] ct problem statement
> >
> >
> > On Thu, Jun 07, 2001 at 03:43:29PM -0500, Nakhjiri
> > Madjid-MNAKHJI1 wrote:
> > > Hi Charlie,
> > >
> > > Correct me if I am wrong,
> > > I have not been very successful in finding specs that
> > > discriminate between authentication and authorization.
> > > So far I have only seen it in AAA Arch.
> > > Otherwise people use authentication credentials
> > > and authorization credentials interchangably.
> > >
> > > So we created a requirement that the CT peers should
> > > mutual authenticate each other prior to CT. Do you think
> > > a separate requirement for authorization is needed?
> >
> >
> >    Authentication
> >       The act of verifying the identity of an entity (subject).
> >
> >    Authorization
> >       The act of determining whether a requesting entity
> > (subject) will
> >       be allowed access to a resource (object).
> >
>
> Hello Kulwinder
>
> Thanks for the answer.  It conforms exactly with my previous
understanding.
>
> If you want to quote this message and answer to the mailing list, that
> would be fine with me, but I didn't see a reason to send my request
> for clarification to the mailing list.
>
> Regards,
> Charlie P.
>
> > MN>> Sure. I get it, but my question is:
> > do we have different credential for authentication and
> > authorization today?
>
> I believe the confusion was started by this statement.
>
> Some definitions:
>
> 1. Credential: A certificate (Indentification Card, Digital Signature)
> issued by a trusted third party.
>
> 2. Authentication: The act of verifying the indentity of an entity by
> checking for a valid credential.
>
> 3. Authorization: The act of determining whether a requesting entity will
be
> allowed access to a resource which may depend on several inputs of which
> authentication one such input. (others: job function/service aggreement)
>
> Consider the following process:
>
> 1. Present Credential to Security Authority.
> 2. Authenticated? Yes.
> 3. Authorized? Yes.
> 4. Grant Access.
>
> Or,
>
> 1. Present Credential to Security Authority.
> 2. Authenticated? No.
> 3. Deny Access.
>
> The Authorization step is moot after failing the Authentication step.
> Therefore, the term "Authorization Credential" has no value, since the
> credential is never presented to the authorization process, but to the
> authentication process.  Without Authentication there can be no
> Authorization.
>
> Present Credential -> Authenticate -> Authorize -> Grant Access.
>
> Read the first few lines of:
> http://www.vsm.com.au:8000/ht_root/doc/htd/htd_1200.html#159
>
> Infact, the term "credential" stands on its own to convey the correct
> meaning. It does not need adjectives like authentication, security, or
> authorization.
>
> - Kulwinder.
>
> >
> > Madjid
> >