Re: [kitten] PKCROSS and philosophical tangents...

[Nico Williams <[e-mail]>]

On Wed, Jan 29, 2014 at 07:01:31PM +0000, Nordgren, Bryce L -FS wrote:
> I hope this isn't out of line. I spend quite a lot of time thinking
> about this, as much of my job involves trying to collaborate with
> others.

It's not only not out of line, it's very welcomed.

> Tangent #1: What is "authentication"?

That's a long topic.  For the sake of brevity, and to answer your more
concrete questions/proposals, I'll not go down this tangent :)

> PKCROSS introduces a paradigm where entire foreign domains are
> authenticated by a certificate authority, to varying degrees of rigor.

A "varying degree of rigor" (I like the phrase) is exactly it.

It's already the case in pretty much all distributed authentication
systems, including Kerberos w/o PKCROSS, including PKIX, and so on.

Grow your world of actual and potential peers large enough and any
assumption that "can authenticate" == "someone I can trust" evaporates.

> [...]

> I would like to propose a third type of authentication: a "Sponsored
> external user". This paradigm assumes a home-user-driven need to
> [...]

This smells to me more like authorization than authentication, but it
can be seen either way, and it really depends on what operational
details you'd like to have involved.  If "sponsorship" means that the
sponsor has to provide a KDC-/CA-/IdP-like infrastructure for sponsees,
then it's really authentication, but also a pain.  If what you have in
mind is more like writing down somewhere that a sponsee [whose identity
must be possible to establish in roughly the same way every time,
perhaps every time after the first] can do this or that, then it's more
like authorization, and much easier to manage.

Treating this as authorization is much easier, but it does require that
you be able to demand repeatability from authentication of the sponsee.

You may not care who a peer's IdP/CA/KDC is, as long as it stays the
same and the trust path for authenticating the IdP/CA/KDC stays the
same.  If you can see to this then it's easier to view this as
authorization.

> 4] human trust anchor aggregation: if several sponsors affirm several
> identities from the same foreign realm, confidence in that realm's
> identity should be high;

You still get this if you treat this as delegated authorization, again,
provided that you have a way to authenticate the "several identities'"
[presumably] common credential issuer reliably.

Nico
--