m |
|
| Line 1: |
Line 1: |
| | == Definition == | | == Definition == |
| | | | |
| - | Given one end of a transmission channel, an authentication procedure establishes which principal is probably at the other end.
| + | Authentication is a process of estabilishing which subject created of a given object (an exectuable code, a source code, a document, etc). |
| | | | |
| | == Notes == | | == Notes == |
| | | | |
| - | "Transmission channel" means a channel over which either information or physical objects are moved from one place to another.
| + | Authentication should not be confused with the following two other concepts: |
| - | | + | * identity checking |
| - | Often the transmission channel is implicit. For example, authenticating the originator of a document is covered by the above definition, if we view the document as representing one end of a transmission channel from its originator.
| + | * authorization |
| - | | + | |
| - | "Principal" should be interpreted broadly: a principal is any entity that holds credentials (also called authentication factors) allowing it to be distinguished from other principals that do not hold those credentials.
| + | |
| - | | + | |
| - | Authentication can be used for many purposes, including to enable accountability, or for access control. (In capability systems, authentication is typically used only indirectly for access control, to decide whether to grant a user's login shell its initial permissions.)
| + | |
| - | | + | |
| - | == Controversy over definition ==
| + | |
| - | | + | |
| - | The above definition (proposed by David-Sarah Hopwood in [http://www.eros-os.org/pipermail/cap-talk/2009-July/013050.html]) generated a long thread on the cap-talk mailing list [http://www.eros-os.org/pipermail/cap-talk/2009-September/thread.html#13237], with some participants arguing that it does not cover cases where no channel is involved, or that it is too focussed on identity (however, note that "principal" as defined above is definitely not equivalent to an identity [http://www.eros-os.org/pipermail/cap-talk/2009-September/013339.html]).
| + | |
| - | | + | |
| - | The following alternative definition was proposed by Rob Meijer:
| + | |
| - | | + | |
| - | "Authentication is the validation of a specific property of an object, where this property must either be a source of authority, a source of accountability, or both."
| + | |
| - | | + | |
| - | but some participants found this to be too vague, and the meaning of "source of authority" and "source of accountablity" to be unclear.
| + | |
| - | | + | |
| - | At the time of writing, it seems that a reasonable compromise may be to use "principal authentication" for the first definition above, "validation" for cases of validating a property that are not covered by that definition, and let "authentication" refer to either.
| + | |
| | | | |
| | == Examples == | | == Examples == |
| | | | |
| - | [http://en.wikipedia.org/wiki/Banknote Banknotes], for example, can also be viewed as having been sent by a transmission channel from the central bank. A banknote states that its holder has a certain amount of money. Banknotes are valid, if that statement is claimed by the central bank. Authentication of the banknote reveals whether this is the case.
| + | * Debian packages (object), after they are downloaded, before they are installed are authenticated. The authentication procedure in this case estabilishes that given package (object) was issued by Debian community (subject). |
| - | | + | |
| - | Authentication is a routine process performed everytime a Debian user installs something with the <tt>apt-get</tt> command. The ''principal'', in this case, is a group of Debian developers. Any software whose authentication fails is clearly marked and user has, for obvious reasons, has an option not to install it.
| + | |
Authentication is a process of estabilishing which subject created of a given object (an exectuable code, a source code, a document, etc).
