Part 1: General - Computer Security Resource Center - National ...

March, 2007
3.4 Authorization
Authorization is concerned with providing an official sanction or permission to perform a
security function or activity. Normally, authorization is granted following a process of
authentication. A non-cryptographic analog of the interaction between authentication and
authorization is the examination of an individual’s credentials to establish their identity
(authentication); upon proving identity, the individual is then provided with the key or password
that will allow access to some resource, such as a locked room (authorization). Authentication
can be used to authorize a role rather than to identify an individual. Once authenticated to a role,
an entity is authorized for all the privileges associated with the role.
3.5 Non-repudiation
Non-repudiation is a service that is used to provide assurance of the integrity and origin of data
in such a way that the integrity and origin can be verified by a third party. This service prevents
an entity from successfully denying involvement in a previous action. Non-repudiation is
supported cryptographically by the use of a digital signature that is calculated by a private key
known only by the entity that computes the digital signature.
3.6 Support Services
Cryptographic security services often require supporting services. For example, cryptographic
services often require the use of key establishment and random number generation services.
3.7 Combining Services
In many applications, a combination of cryptographic services (confidentiality, data integrity,
authentication, authorization, and non-repudiation) is desired. Designers of secure systems often
begin by considering which security services are needed to protect the information contained
within and processed by the system. After these services have been determined, the designer then
considers what mechanisms will best provide these services. Not all mechanisms are
cryptographic in nature. For example, physical security may be used to protect the confidentiality
of certain types of data, and identification badges or biometric identification devices may be used
for entity authentication. However, cryptographic mechanisms consisting of algorithms, keys,
and other keying material often provide the most cost-effective means of protecting the security
of information. This is particularly true in applications where the information would otherwise be
exposed to unauthorized entities.
When properly implemented, some cryptographic algorithms provide multiple services. The
following examples illustrate this case:
1. A message authentication code (Section 4.2.3) can provide authentication as well as data
integrity if the symmetric keys are unique to each pair of users.
2. A digital signature algorithm (Section 4.2.4) can provide authentication and data
integrity, as well as non-repudiation.
3. Certain modes of encryption can provide confidentiality, data integrity, and
authentication when properly implemented. These modes should be specifically designed
to provide these services.
31