Subject: Re: [sacm] [draft-ietf-sacm-terminology] We need a set of common security service terms for common usage among all of the documents (#2)

From: Jim Schaad <[email-masked]>
Date: Fri, 21 Aug 2015 20:45:05 -0700

Data Origin
* Question:  implies the task of “verification of identity” Is that intentional and would this be in the scope of SACM?

I believe that this task is in the scope of SACM and is a function of the initial recipient of a piece of data.  The verification of identity can be either based on a cryptographic object or based on the transport protocol.  The question of what a SACM component needs to do if information is published to the system from a component that cannot authenticate itself in some manner is open.  (T-004 is relevant.)

* Question:  differentiation between an “determined endpoint identity” and the “task of identifying an endpoint” - Not sure that this is relevant to what we are discussing here - can you elucidate why you think it is.

* Question:Is Original Source sufficiently self-explaining?  It is to me.

Data Provenance
* Question: Is a “historical record” in this context also out of scope for SACM? 

DM-011 Data Generation appears to state that this is a requirement.  One must be able to publish what was used in order to get to a specific point.

I am not sure what you mean by historical record, but both 'IM-005 Data Lifetime Management' and the fact that an attribute could be published by multiple sources would imply to me that there is to ability in SACM to have some degree of a "historical record".

A different question that might need to be asked is should there be a way to go forward, i.e. from an attribute to a new attribute based on that one as well as backwards.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/2#issuecomment-133632379