Subject: [Atoca] Summary of "Requirement for Originator Authentication?" Discussion

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 27 Feb 2011 11:20:54 +0200

Hi all, 

thank you for your feedback on the topic of originator authentication. 

From the responses I see three aspects emerging: 

1) Deployment choice vs. technological capability 

How authorization policies would look like and what specific information is used to determine who is authorized and who isn't is a deployment decision. 

However, there needs to be technology available to actually provide this information. Identity-based authorization was mentioned (as a low hanging fruit) and the technical solution is to offer identity information about the entity that distributes the alert message. 

Other more sophisticated approaches (from a technology point of view) are trait-based authorization mechanisms. 

Your feedback raised the question whether we can re-use these security mechanisms from the underlying communication infrastructure? E.g. for example from SIP and XMPP? 

2)  Hop-by-hop vs. end-to-end authentication 

I got the impression that we need to allow both building blocks to be used rather than to focus on either one of them. 

Btw, CAP payloads are not end-to-end protected with S/MIME but rather with XML DSig. Not that either one of them is simpler but what would be appropriate to use in our context?

3) Identity scheme

If we have an identity based authorization then there is obviously the question about the types of identities one needs to deal with. CAP is very relaxed on this issue and does not provide a lot of constraints. So, I suspect the constraints to rather come from the underlying communication infrastructure. 

In the area of SIP we had lots of discussions around SIP Identity and a discussion of the different identities can be found in http://tools.ietf.org/html/rfc5025#section-3.1.1 (based on the discussions around Common Policy).

Is it too far fetched to assume that the underlying communication infrastructure provides the identities for us?

Ciao
Hannes