Subject: [Ace] authenticated authorization

From: "Hannes Tschofenig" <[email-masked]>
Date: Tue, 28 Jan 2014 12:37:38 +0100 (CET)

Hi all,

I have seen these discussions about the term 'authenticated authorization' coming up again.

I don't quite understand why some of you are so exciting about the term.

The challenge is the following: We are talking about a multi-party protocol here. We have at least the following parties

a) client seeking access to some resource/service

b) authorization server/trusted third party/key distribution server, and

c) server / resource server

Obviously, there are various authentications taking place in such a multi-party protocol. For example, the client will authenticate to the authorization server and vice versa.

The authorization server will have some relationship with the resource server, which might require the resource server to authenticate information provided by the authorization server.

Then, you finally have the client talking to the resource server. There you might have some authentication taking place or maybe only key confirmation.

Covering that complex interaction with a single term is a bit challenging.

The point of the charter is not to cover everything that may happen in the working group. The charter is marketing material to get others interested. When they read through the charter they should have a rough idea about what is going on.

When you look around different working groups then you will see that even hitting that bar is already a big obstacle for many.

Ciao

Hannes

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 28 Jan 2014 13:08:24 +0100

> I don't quite understand why some of you are so exciting about the term. 

It is a pretty good umbrella term for what ACE is doing.

It is not supplying all those details (and it is not intended to).
Trying to “define” it (beyond what it obviously means) is unlikely to be a useful exercise.

Re the precision we can achieve:

I haven’t spent time to examine how security area charters look like; I do believe we generally need to supply some guide rails for the WG and the tasks it is supposed to do.
(The other objectives you mention for the charter are also important.)

Re doing our homework:

Yes, please.

However, the one item I don’t want to have in the charter is a multi-year effort to generate a consensus document examining all other protocols out there and convincingly making a case why they all never can be used for IoT.
The ROLL working group was forced to do that, and it was a gigantic waste of time (didn’t even make it to RFC).
We need to watch out that people who want to quash IETF work in this space (for whatever reason) don’t manage to get in such a requirement.  That would be worse than not getting chartered.

Grüße, Carsten

---

From: Ludwig Seitz <[email-masked]>
Date: Tue, 28 Jan 2014 13:13:16 +0100

> I don't quite understand why some of you are so exciting about the term.
[snip]
>The charter is marketing material to get others
> interested. When they read through the charter they should have a rough
> idea about what is going on.

This is exactly the reason why I reacted to that term (though calling 
that getting excited would be a stretch). It is not a term commonly used 
by IAM practitioners and thus it doesn't give a rough idea about what is 
going on.

I can't really understand why we don't just spend a few more words to 
clarify this up front instead of using a term that can easily be 
misunderstood.

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 28 Jan 2014 13:37:11 +0100

On 28 Jan 2014, at 13:13, Ludwig Seitz <[email-masked]> wrote:

> It is not a term commonly used by IAM practitioners

That may also be an advantage.

Not having pre-conceived notions attached to a term is a good reason to use it.

Grüße, Carsten

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Tue, 28 Jan 2014 14:48:25 +0100 (CET)

Hi Carsten,

Gesendet: Dienstag, 28. Januar 2014 um 12:08 Uhr

Von: "Carsten Bormann" <[email-masked]>

An: "Hannes Tschofenig" <[email-masked]>

Cc: "[email-masked]" <[email-masked]>

Betreff: Re: [Ace] authenticated authorization

[hannes] You may ask yourself the following question: Why do we need a new term for a problem that has been worked on for about 20 years? What is so special with IoT that nobody else had thought about this before?

Re doing our homework:

Yes, please.

[hannes] I also want to avoid a multi-year effort but I see various documents that pretty much re-invent what others had done before already. I have a hard time to complain about other efforts that re-invent the entire Internet from scratch when the folks around me do exactly the same.

[hannes] The ROLL working group is an interesting case here and it would be interesting to hear about the deployment success. My impression (with my limited experience with ROLL) is that it aimed to solve a use case most people just don't care about. Hence, it does not really matter how long it took them to work on their documents.

Ciao

Hannes

Grüße, Carsten