Re: [GNAP] Will GNAP support Zero Trust Architecture?

[Benjamin Kaduk <[e-mail]>]

On Sat, Mar 20, 2021 at 01:07:42AM -0400, Adrian Gropper wrote:
> @Alan Karp <[e-mail]> shared a talk about the Principle Of Least
> Authority (POLA) in a recent comment
> https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/145#issuecomment-803099693
> I recommend it.
> 
> We might expect a protocol with authorization in the title to use authority
> as a core principle. I advocate for a GNAP design that maximizes the power
> of the RO, to be seen as a human rights issue when the RO is a human. This
> causes me to ask how to combine better security with better human rights in
> GNAP.
> 
> Who should have the least authority in the GNAP design?
> 
> The AS derives authority as a delegate of the RO. If we ask the RO to
> partition limited authority across dozens of different ASs by domain and
> function, then we are not using technology to empower the individual.
> Probably the opposite, as we introduce consent fatigue and burden normal
> people to partition their lives into non-overlapping domains.
> 
> My experience says we should aim for one AS per persona because that maps
> into the way we manage our public and private identities. POLA would then
> teach care in keeping ASs and RSs related to work / public separate from
> ASs and RSs related to private life so that a policy vulnerability in our
> delegation to an AS would have the least likelihood of harm.

Thinking about how least authority/least privilege would apply to GNAP
seems like a useful exercise.  I do want to point out some potential
pitfalls with one-AS-per-persona that we can also be aware of.  If
one-AS-per-persona becomes one-persona-per-AS as well, then the AS's
identity in effect also serves as a persona identity and there are privacy
considerations to that.  If, on the other hand, the
multiple-personas-per-AS (presumably corresponding to multiple humans)
route is taken, we should consider whether that would lead to various
(e.g., market) forces driving consolidation to just a handful of
super-popular AS services.  That topic is a current matter of concern to
some IETF participants.

Thanks,

Ben