Ask HN: Crypto's Role in Auth vs. Authorization?
What are the key cryptographic mechanisms used in distinguishing authentication from authorization, and how do they contribute to the security of digital systems?
I have spent great effort writing a new software system that has no servers and no third parties yet still solves for authentication. It really matters less who a person is than whether you are willing to trust that person irrespective of who they are, because trust describes the relationship not the person at the terminal end of that relationship.
As for traditional systems, the rest of the world, you access a system with either a certificate or a username/password. The certificate is created by the server often based upon a key pair. In the case of a username/password the server stores a hash sequence of your password and compares that stored hash against the hashed output of a password you enter to login.
Once access is granted there are actions you are allowed to perform and actions you are denied. This is authorization.
Authz > nothing in real systems. There’s research in attribute based encryption (ABE) that leads to attribute based access control, but I’ve never seen any actual system using cryptography for authz.
On the topic of digital signatures there’s many new stuff including but not limited to threshold signatures (eg FROST), aggregate signatures (eg BLS as used in ETH consensus), batch signatures (typically verification).