[plasma] PEPs, authentication, and attributes

"Fitch, Scott C" <scott.c.fitch@lmco.com> Tue, 25 October 2011 17:16 UTC

Date: Tue, 25 Oct 2011 17:15:48 +0000
From: "Fitch, Scott C" <scott.c.fitch@lmco.com>
To: "plasma@ietf.org" <plasma@ietf.org>
Message-id: <DFE85D7EFA640D4886E9A9141AEBCD200A097B38@HDXDSP11.us.lmco.com>
MIME-version: 1.0
Content-type: text/plain; charset="us-ascii"
Content-language: en-US
Content-transfer-encoding: 7bit
Thread-Topic: PEPs, authentication, and attributes
Thread-Index: AcyTMNeMJIyckKYkTc+x471Qa9C0Nw==
Accept-Language: en-US
Subject: [plasma] PEPs, authentication, and attributes
Precedence: list

(The first of several threads on the v03 of the requirements document. Overall, I really like what I see.)

       Section 4.3 outlines the steps that the Content Consumption PEP and PDP following to read a plasma-protected email. The sequence doesn't specify an authentication step for the PEP to the PDP. It seems to me that the PDP will want not only attributes about the message recipient, but also evidence that the recipient is actually there at the other end of the wire.
       I see two possibilities here. First option is to have the PEP authenticate to the PDP at first concept in step (C). Or it can authenticate once the PDP asks for more attributes in step (E). I think I favor the first option, but am interested in others' view on this too. A few factors make me lean this direction:
	- This prevents the PDP from having to process any unauthenticated requests
	- If plasma implementations follow the federation model of SAML and WS-Fed, the recipient will have a trust relationship that defines a (baseline) set of attributes that can be sent to the PDP. This (hopefully) will reduce the instances that a PDP needs to ask the PEP to provide more attributes in step (E).
	- Where the PDP will be using a back-end attribute retrieval such as a SAML AttributeQuery, it will need to know something about the subject in order to be able to construct the query and possible to determine which PIP to query in the first place.

	Also related to attribute retrieval, I recommend tweaking the Back end Attribute Exchange definition to explain that this is a *query and retrieval* of attributes initiated by the PDP. The current definition implies that the information is sent from the PIP to the PDP, which from a data flow perspective is accurate, but from a security and implementation perspective doesn't accurately describe the communications.

	-Scott

Scott Fitch
Cyber Architect
Lockheed Martin Corporate Information Security
m: (860) 614-6013
w: (860) 868-9947
scott.c.fitch@lmco.com

[plasma] PEPs, authentication, and attributes Fitch, Scott C