Updated definition of Digital Credential based on feedback

[dhs-aws]

This definition appears incorrect under the common understanding of what a credential is.

A credential (password, FIDO credential, etc.) is used to authenticate something (e.g. a user) by proving possession of the credential. Once authenticated, the permissions granted to that user or device are used to authorize the actions that may be taken. While a user can be authorized without being authenticated (e.g. an anonymous, unauthenticated user of a web site may be authorized to view the publicly available content), that does not reflect the intent of the use case.

Additionally, there is a misspelling of the work "cryptographic" in the PR.

[ykarandikar]

This definition appears incorrect under the common understanding of what a credential is.

A credential (password, FIDO credential, etc.) is used to authenticate something (e.g. a user) by proving possession of the credential. Once authenticated, the permissions granted to that user or device are used to authorize the actions that may be taken. While a user can be authorized without being authenticated (e.g. an anonymous, unauthenticated user of a web site may be authorized to view the publicly available content), that does not reflect the intent of the use case.

Additionally, there is a misspelling of the work "cryptographic" in the PR.

As DKG had pointed out in an earlier email thread on IETF mailing list, for some credentials there may not be any authentication at the access point.

So this definition tries to take that into account and cover all possible cases.

All credentials are used for authorization with the access point. Some are also used for mutual authentication.

If the language needs to be re-worded, we can certainly look into suggestion. But in terms of content, this definition is definitely accurate.

I'll fix the typo. Thanks!

[dimmyvi]

I tend to agree with Yogesh and DKG - credential doesn't really have a fundamental definition. For the access use case it is rather authorization - that is a "key" that allows to access a resource (e.g. open a door). User authentication may or may not be a part of this. For example, a symmetric key stored on a card / device may allow user an access with an HID reader - and open a gate. Or digital car key stored on a device may be used to authorize user to open a car and start the engine. The car may or may not need the user identity for that.