On Access Control, Capabilities, Their Equivalence, and Confused Deputy Attacks

[Alan Karp]

https://ieeexplore.ieee.org/document/7536373

I've only skimmed the paper, but I understand that the authors claim capabilities don't prevent all confused deputy attacks.  I don't agree.

A confused deputy vulnerability is when the deputy uses its permissions on a resource designated by someone else.  If I understand correctly, this paper says there's another form where the deputy uses its permissions to write data provided by somebody else.

First of all, that's not usually a vulnerability; you do it every time you log the requests you receive.  Even when it is a vulnerability, I wouldn't call it the confused deputy as Norm defined it.

--------------
Alan Karp

[Matt Rice]

First thing I'm not certain in the paper about is the following:

The paper Alan linked:
>> It has been claimed in the past that in the presence of Miller et al.’ s property A, Cs prevent CDAs

This references both Norm's original confused deputy paper, capability
myths demolished, and another paper.
I don't see anywhere in Norm's paper where he actually claims that
they are prevented. The closest I could find to that
in Norm's description of the confused deputy problem is the following...

Norm (The confused deputy problem)
>> If you try to solve this problem without capabilities, remember that the file (SYSX)STAT must also be protected.)
>> The capability solution would endow the compiler with a direct capability to the statistics file.

He seems to merely point out that there exists a solution with
capabilities which does not require knowledge and encoding of all the
security properties
and states. Making even providing a solution outside of capabilities
relatively intractable. At least that is what I always took from it.

Capability myths demolished:
>> capabilities provide much better support for least-privilege operation and for avoiding confused deputy problems.

Then later this gem...

>> Eliminating ambient authority helps make it possible to avoid confused deputies, but doesn’t guarantee that
>> deputies will never be confused.

And this:
>> Even if one can distinguish the keys, deciding to try all available keys puts one at risk of becoming a confused deputy.

I don't see anywhere these two papers purport to prevent confused
deputy attacks?

[Alan Karp]

On Fri, Oct 2, 2026 at 3:25 PM John Carlson <yott...@gmail.com> wrote:

I am wondering how capabilities as keys are unforgeable, but that’s a whole another question, and probably involves encryption.

In that case, you trade unforgeability for unguessability. 

Are bearer tokens stored in encrypted databases?  How does one store bearer tokens for reuse?

I'm not an expert on the specs, but I don't recall any of them even mentioning storing them.  That means they're leaving it up to the application to protect its tokens.

--------------
Alan Karp

[Matt Rice]

Sorry, In this one myths demolished is talking about property D, while
the other paper is talking about property A. mea culpa.