Authentication - Revision history

Kosik: /* Examples */

2009-09-08T09:02:41Z

Examples

New page

== Definition ==

Given one end of a transmission channel, an authentication procedure establishes which principal is probably at the other end.

== Notes ==

"Transmission channel" means a channel over which either information or physical objects are moved from one place to another.

Often the transmission channel is implicit. For example, authenticating the originator of a document is covered by the above definition, if we view the document as representing one end of a transmission channel from its originator.

"Principal" should be interpreted broadly: a principal is any entity that holds credentials (also called authentication factors) allowing it to be distinguished from other principals that do not hold those credentials.

Authentication can be used for many purposes, including to enable accountability, or for access control. (In capability systems, authentication is typically used only indirectly for access control, to decide whether to grant a user's login shell its initial permissions.)

== Controversy over definition ==

The above definition (proposed by David-Sarah Hopwood in [http://www.eros-os.org/pipermail/cap-talk/2009-July/013050.html]) generated a long thread on the cap-talk mailing list [http://www.eros-os.org/pipermail/cap-talk/2009-September/thread.html#13237], with some participants arguing that it does not cover cases where no channel is involved, or that it is too focussed on identity (however, note that "principal" as defined above is definitely not equivalent to an identity [http://www.eros-os.org/pipermail/cap-talk/2009-September/013339.html]).

The following alternative definition was proposed by Rob Meijer:

"Authentication is the validation of a specific property of an object, where this property must either be a source of authority, a source of accountability, or both."

but some participants found this to be too vague, and the meaning of "source of authority" and "source of accountablity" to be unclear.

At the time of writing, it seems that a reasonable compromise may be to use "principal authentication" for the first definition above, "validation" for cases of validating a property that are not covered by that definition, and let "authentication" refer to either.

== Examples ==

[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as having been sent by a transmission channel from the central bank. A banknote states that its holder has a certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.

Authentication is a routine process performed everytime a Debian user installs something with the <tt>apt-get</tt> command. The ''principal'', in this case, is a group of Debian developers. Any software whose authentication fails is clearly marked and user has, for obvious reasons, has an option not to install it.

Kosik: /* Examples */

2009-09-08T09:01:36Z

Examples

←Older revision		Revision as of 09:01, 8 September 2009
Line 29:		Line 29:
	[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as having been sent by a transmission channel from the central bank. A banknote states that its holder has a certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.		[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as having been sent by a transmission channel from the central bank. A banknote states that its holder has a certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.

-	Authentication is routine process performed everytime a Debian user installs something with the <tt>apt-get</tt> command. The ''principal'', in this case, is a group of Debian developers. Any software whose authentication fails is clearly marked and user has, for obvious reasons, has ~~a default~~ option not to install it.	+	Authentication is routine process performed everytime a Debian user installs something with the <tt>apt-get</tt> command. The ''principal'', in this case, is a group of Debian developers. Any software whose authentication fails is clearly marked and user has, for obvious reasons, has an option not to install it.

78.99.154.173: /* Examples */

2009-09-08T08:59:47Z

Examples

←Older revision		Revision as of 08:59, 8 September 2009
Line 28:		Line 28:

	[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as having been sent by a transmission channel from the central bank. A banknote states that its holder has a certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.		[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as having been sent by a transmission channel from the central bank. A banknote states that its holder has a certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.
		+
		+	Authentication is routine process performed everytime a Debian user installs something with the <tt>apt-get</tt> command. The ''principal'', in this case, is a group of Debian developers. Any software whose authentication fails is clearly marked and user has, for obvious reasons, has a default option not to install it.

90.201.194.104: /* Notes */ [David-Sarah]

2009-09-08T04:59:26Z

Notes: [David-Sarah]

←Older revision		Revision as of 04:59, 8 September 2009
Line 11:		Line 11:
	"Principal" should be interpreted broadly: a principal is any entity that holds credentials (also called authentication factors) allowing it to be distinguished from other principals that do not hold those credentials.		"Principal" should be interpreted broadly: a principal is any entity that holds credentials (also called authentication factors) allowing it to be distinguished from other principals that do not hold those credentials.

-	Authentication can be used for many purposes, including to enable accountability, or for access control. (In capability systems, authentication is typically used only indirectly for access control, to grant a user's login shell its initial permissions.)	+	Authentication can be used for many purposes, including to enable accountability, or for access control. (In capability systems, authentication is typically used only indirectly for access control, to decide whether to grant a user's login shell its initial permissions.)

	== Controversy over definition ==		== Controversy over definition ==

90.201.194.104: /* Notes */ clarify use of authentication in capability systems [David-Sarah]

2009-09-08T04:56:04Z

Notes: clarify use of authentication in capability systems [David-Sarah]

←Older revision		Revision as of 04:56, 8 September 2009
Line 11:		Line 11:
	"Principal" should be interpreted broadly: a principal is any entity that holds credentials (also called authentication factors) allowing it to be distinguished from other principals that do not hold those credentials.		"Principal" should be interpreted broadly: a principal is any entity that holds credentials (also called authentication factors) allowing it to be distinguished from other principals that do not hold those credentials.

-	Authentication can be used for many purposes, including to enable accountability, or for access control (~~although the latter is generally frowned on in~~ capability systems).	+	Authentication can be used for many purposes, including to enable accountability, or for access control. (In capability systems, authentication is typically used only indirectly for access control, to grant a user's login shell its initial permissions.)

	== Controversy over definition ==		== Controversy over definition ==

90.201.194.104: communication channel -> transmission channel, note controversy about definition [David-Sarah]

2009-09-08T04:53:38Z

communication channel -> transmission channel, note controversy about definition [David-Sarah]

←Older revision		Revision as of 04:53, 8 September 2009
Line 1:		Line 1:
	== Definition ==		== Definition ==

-	Given one end of a ~~communication~~ channel, an authentication procedure establishes which principal is probably at the other end.	+	Given one end of a transmission channel, an authentication procedure establishes which principal is probably at the other end.

	== Notes ==		== Notes ==

-	~~Often the communication~~ channel ~~is implicit. For example, authenticating the originator of~~ a ~~document is covered by the above definition, if we view the document as representing one end of a communication~~ channel from ~~its originator~~.	+	"Transmission channel" means a channel over which either information or physical objects are moved from one place to another.

-	The ~~ability~~ to ~~perform authentication enables~~ accountability.	+	Often the transmission channel is implicit. For example, authenticating the originator of a document is covered by the above definition, if we view the document as representing one end of a transmission channel from its originator.
		+
		+	"Principal" should be interpreted broadly: a principal is any entity that holds credentials (also called authentication factors) allowing it to be distinguished from other principals that do not hold those credentials.
		+
		+	Authentication can be used for many purposes, including to enable accountability, or for access control (although the latter is generally frowned on in capability systems).
		+
		+	== Controversy over definition ==
		+
		+	The above definition (proposed by David-Sarah Hopwood in [http://www.eros-os.org/pipermail/cap-talk/2009-July/013050.html]) generated a long thread on the cap-talk mailing list [http://www.eros-os.org/pipermail/cap-talk/2009-September/thread.html#13237], with some participants arguing that it does not cover cases where no channel is involved, or that it is too focussed on identity (however, note that "principal" as defined above is definitely not equivalent to an identity [http://www.eros-os.org/pipermail/cap-talk/2009-September/013339.html]).
		+
		+	The following alternative definition was proposed by Rob Meijer:
		+
		+	"Authentication is the validation of a specific property of an object, where this property must either be a source of authority, a source of accountability, or both."
		+
		+	but some participants found this to be too vague, and the meaning of "source of authority" and "source of accountablity" to be unclear.
		+
		+	At the time of writing, it seems that a reasonable compromise may be to use "principal authentication" for the first definition above, "validation" for cases of validating a property that are not covered by that definition, and let "authentication" refer to either.

	== Examples ==		== Examples ==

-	[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as ~~"one end of~~ a ~~communcation~~ channel". ~~Banknote~~ states that its holder has certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.	+	[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as having been sent by a transmission channel from the central bank. A banknote states that its holder has a certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.

Kosik at 06:05, 30 July 2009

2009-07-30T06:05:23Z

←Older revision		Revision as of 06:05, 30 July 2009
Line 2:		Line 2:

	Given one end of a communication channel, an authentication procedure establishes which principal is probably at the other end.		Given one end of a communication channel, an authentication procedure establishes which principal is probably at the other end.
		+
		+	== Notes ==

	Often the communication channel is implicit. For example, authenticating the originator of a document is covered by the above definition, if we view the document as representing one end of a communication channel from its originator.		Often the communication channel is implicit. For example, authenticating the originator of a document is covered by the above definition, if we view the document as representing one end of a communication channel from its originator.
		+
		+	The ability to perform authentication enables accountability.

	== Examples ==		== Examples ==

	[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as "one end of a communcation channel". Banknote states that its holder has certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.		[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as "one end of a communcation channel". Banknote states that its holder has certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.

90.199.15.117: /* Definition */

2009-07-26T13:40:39Z

Definition

←Older revision		Revision as of 13:40, 26 July 2009
Line 1:		Line 1:
	== Definition ==		== Definition ==

-	Given one end of a communication channel, authentication procedure establishes which principal	+	Given one end of a communication channel, an authentication procedure establishes which principal is probably at the other end.
-	is probably at the other end.	+
		+	Often the communication channel is implicit. For example, authenticating the originator of a document is covered by the above definition, if we view the document as representing one end of a communication channel from its originator.

	== Examples ==		== Examples ==

	[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as "one end of a communcation channel". Banknote states that its holder has certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.		[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as "one end of a communcation channel". Banknote states that its holder has certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.

Kosik at 09:59, 26 July 2009

2009-07-26T09:59:18Z

←Older revision		Revision as of 09:59, 26 July 2009
Line 6:		Line 6:
	== Examples ==		== Examples ==

-	[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as "one end of a communcation channel". ~~One end is in the central bank. The other one is held by some person. Through this channel, someone~~ states that ~~the~~ holder ~~of a given banknote~~ has a certain amount of money. ~~The authentication procedure here is important because it reveals whether this~~ statement is claimed by the central bank.	+	[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as "one end of a communcation channel". Banknote states that its holder has certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.

Kosik at 09:54, 26 July 2009

2009-07-26T09:54:45Z

←Older revision		Revision as of 09:54, 26 July 2009
Line 6:		Line 6:
	== Examples ==		== Examples ==

-	* Authentication is important in connection with [http://en.wikipedia.org/wiki/Banknote ~~banknotes~~]~~. Paper money is useful only if it is not easily forgeable. Ideally~~, ~~it should~~ be ~~issued by~~ a ~~single trusted principal~~. ~~The authentication can determine that this~~ is the ~~case~~. ~~Electronic currency has to have a similar property~~.	+	[http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as "one end of a communcation channel". One end is in the central bank. The other one is held by some person. Through this channel, someone states that the holder of a given banknote has a certain amount of money. The authentication procedure here is important because it reveals whether this statement is claimed by the central bank.
-	* Authentication enables us to determine that a given ~~principal probably issued~~ a ~~given document~~.	+
-	* Authentication enables us to determine that a given principal probably published a given program.	+