Re: [GNAP] Will GNAP support Zero Trust Architecture?

Hi Ben

Very good question.

The core protocol probably will be able to elude providing an answer,
focusing on singular requests.

Any extension covering AS-RS relationships will have to handle its socio
technical impact.

Fabien

Le dim. 21 mars 2021 à 18:18, Benjamin Kaduk <kaduk@mit.edu> a écrit :

> On Sat, Mar 20, 2021 at 01:07:42AM -0400, Adrian Gropper wrote:
> > @Alan Karp <alanhkarp@gmail.com> shared a talk about the Principle Of
> Least
> > Authority (POLA) in a recent comment
> >
> https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/145#issuecomment-803099693
> > I recommend it.
> >
> > We might expect a protocol with authorization in the title to use
> authority
> > as a core principle. I advocate for a GNAP design that maximizes the
> power
> > of the RO, to be seen as a human rights issue when the RO is a human.
> This
> > causes me to ask how to combine better security with better human rights
> in
> > GNAP.
> >
> > Who should have the least authority in the GNAP design?
> >
> > The AS derives authority as a delegate of the RO. If we ask the RO to
> > partition limited authority across dozens of different ASs by domain and
> > function, then we are not using technology to empower the individual.
> > Probably the opposite, as we introduce consent fatigue and burden normal
> > people to partition their lives into non-overlapping domains.
> >
> > My experience says we should aim for one AS per persona because that maps
> > into the way we manage our public and private identities. POLA would then
> > teach care in keeping ASs and RSs related to work / public separate from
> > ASs and RSs related to private life so that a policy vulnerability in our
> > delegation to an AS would have the least likelihood of harm.
>
> Thinking about how least authority/least privilege would apply to GNAP
> seems like a useful exercise.  I do want to point out some potential
> pitfalls with one-AS-per-persona that we can also be aware of.  If
> one-AS-per-persona becomes one-persona-per-AS as well, then the AS's
> identity in effect also serves as a persona identity and there are privacy
> considerations to that.  If, on the other hand, the
> multiple-personas-per-AS (presumably corresponding to multiple humans)
> route is taken, we should consider whether that would lead to various
> (e.g., market) forces driving consolidation to just a handful of
> super-popular AS services.  That topic is a current matter of concern to
> some IETF participants.
>
> Thanks,
>
> Ben
>
> --
> TXAuth mailing list
> TXAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/txauth
>