Re: [GNAP] Will GNAP support Zero Trust Architecture?

In the SSI community, we have had more than a year of discussion, often
intense, over the relationship between DIDs (decentralized identifiers),
service endpoints (and their protocols) in DIDs (how many and what do they
point to) and concepts like "herd privacy" that are essential to avoiding
unwanted correlation and traffic analysis. With the recent ascension of DID
core to Candidate Recommendation
https://www.w3.org/TR/2021/CR-did-core-20210318/ We consider some of these
issues settled. Along the way we've created various privacy analyses and
had review by W3C. Section 10 is a great place to start as we consider the
privacy of protocols like GNAP CR-did-core-20210318
<https://www.w3.org/TR/2021/CR-did-core-20210318/#privacy-considerations>.

tl:dr My personal perspective after all of this work, is that mediator
roles are a useful option at the intersection between a data model like DID
and a protocol like GNAP. There were two classes of DID service endpoint
protocols that stood out: messaging and authorization. Either one might be
enhanced by the DID controller introducing a mediator but it doesn't change
the core aspects of the messaging or authorization protocol itself. YMMV

Adrian

On Sun, Mar 21, 2021 at 2:34 PM Fabien Imbault <fabien.imbault@gmail.com>
wrote:

> Hi Ben
>
> Very good question.
>
> The core protocol probably will be able to elude providing an answer,
> focusing on singular requests.
>
> Any extension covering AS-RS relationships will have to handle its socio
> technical impact.
>
> Fabien
>
> Le dim. 21 mars 2021 à 18:18, Benjamin Kaduk <kaduk@mit.edu> a écrit :
>
>> On Sat, Mar 20, 2021 at 01:07:42AM -0400, Adrian Gropper wrote:
>> > @Alan Karp <alanhkarp@gmail.com> shared a talk about the Principle Of
>> Least
>> > Authority (POLA) in a recent comment
>> >
>> https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/145#issuecomment-803099693
>> > I recommend it.
>> >
>> > We might expect a protocol with authorization in the title to use
>> authority
>> > as a core principle. I advocate for a GNAP design that maximizes the
>> power
>> > of the RO, to be seen as a human rights issue when the RO is a human.
>> This
>> > causes me to ask how to combine better security with better human
>> rights in
>> > GNAP.
>> >
>> > Who should have the least authority in the GNAP design?
>> >
>> > The AS derives authority as a delegate of the RO. If we ask the RO to
>> > partition limited authority across dozens of different ASs by domain and
>> > function, then we are not using technology to empower the individual.
>> > Probably the opposite, as we introduce consent fatigue and burden normal
>> > people to partition their lives into non-overlapping domains.
>> >
>> > My experience says we should aim for one AS per persona because that
>> maps
>> > into the way we manage our public and private identities. POLA would
>> then
>> > teach care in keeping ASs and RSs related to work / public separate from
>> > ASs and RSs related to private life so that a policy vulnerability in
>> our
>> > delegation to an AS would have the least likelihood of harm.
>>
>> Thinking about how least authority/least privilege would apply to GNAP
>> seems like a useful exercise.  I do want to point out some potential
>> pitfalls with one-AS-per-persona that we can also be aware of.  If
>> one-AS-per-persona becomes one-persona-per-AS as well, then the AS's
>> identity in effect also serves as a persona identity and there are privacy
>> considerations to that.  If, on the other hand, the
>> multiple-personas-per-AS (presumably corresponding to multiple humans)
>> route is taken, we should consider whether that would lead to various
>> (e.g., market) forces driving consolidation to just a handful of
>> super-popular AS services.  That topic is a current matter of concern to
>> some IETF participants.
>>
>> Thanks,
>>
>> Ben
>>
>> --
>> TXAuth mailing list
>> TXAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/txauth
>>
>