Front cover - IBM Redbooks

216 Lotus Security Handbook
Encryption is important, because of the potential damage that could occur if
Carole was able to get a legible copy of the information being exchanged by
Alice and Bob.
However, it’s important to consider what could happen if Carole could
impersonate Alice or Bob. Carole could both get more information and could also
modify the information to be exchanged. The resulting damage could be far
worse than what could happen with simple eavesdropping.
Authentication is thus the cornerstone of effective security. It is also the
cornerstone of Notes and Domino security, because it permits the system to
differentiate one user from another.
Without authentication, the following problems would occur:
► The system could not verify the identity of anyone using the services provided
by the Domino server.
► Users would have to be treated equally since they would fall under one
category. Therefore, there could be no granularity of access to Notes
databases and services offered by the Domino Server.
Authentication is what permits administrators to permit or deny access to the
resources of the system. Once a person has been granted permission to access
the system, different privileges (commonly called access levels) can be
conferred to that person.
Authentication is thus the key to providing restricted access to Notes and Domino
resources.
The authentication procedure in Notes is generally misunderstood. People
assume that it is a simple user ID/password challenge/response mechanism
when, in reality, it is far more sophisticated than that.
Because the authentication procedure in Notes is dependant on the public key
infrastructure natively built into the client and the server, we are taking the time
now to see how the native PKI is architected and then explain how Notes
authentication works.
Note: The term “Notes authentication” is used because it denotes
authentication of a user using the Notes client against a Domino server. We’ll
refine the term a little bit later on, but using this term helps us differentiate this
type of authentication from the other types of authentication that we discuss
later in this book.