3

When joining an authenticated network, I have seen the terms "Enrollment" and "Registration" used to describe the process of initially setting up your credentials on the network. "Authentication" itself then is a periodic activity where these credentials are validated.

I am wondering if these terms are synonymous, or if there is a subtle distinction. Perhaps it is the case that registration refers to a manual process (sign up on a web-page; confirm email address; etc) or enrollment is more of an automatic, and transparent process perhaps assisted by hardware/OS features, such as certificate provisioning.

Are there well recognised definitions for "Enrollment" vs "Registration" such as there are for "Authorization" vs "Authentication"?

1

Doing some quick research into this myself (by which I mean typing in the words as a part of various web-search queries), I discovered some subtle distinctions in the use of these terms. Firstly of course registration is itself a far more general term which can apply in various different scenarios. Enrollment however is typically used in the domains of certificate-based authentication (in particular with relation to a device, rather than a personal identity) and in biometrics, where it refers to the capturing of biometric information to be used for later authentication purposes.

So how do these two terms relate to one another? Well in the biometrics case I would presume that the person enrolling has previously registered somewhere before being presented to the enrollment mechanism.

In the case of certificate-based authentication it seems that registration is also the prerequisite activity, before a device is enrolled with a certificate authority.

I consulted two infosec glossaries investigating this. The first was the NIST "Glossary of Key Information Security Terms" where the only reference to enrollment is:

Enrollment Manager – The management role that is responsible for assigning user identities to management and non-management roles. SOURCE: CNSSI-4009

which isn't much help. But registration is covered here:

Registration – The process through which a party applies to become a subscriber of a Credentials Service Provider (CSP) and a Registration Authority validates the identity of that party on behalf of the CSP. SOURCE: CNSSI-4009 The process through which an Applicant applies to become a Subscriber of a CSP and an RA validates the identity of the Applicant on behalf of the CSP. SOURCE: SP 800-63

which is fairly clear. The other source I discovered was "Javvin Network Dictionary" which defines registration thus:

Registration in network security means the administrative act or process whereby an entities names or other attributes are established for the first time at a Certificate Authority (CA), prior to the CA issuing a digital certificate that has the entity's name as the subject.

Again "enrollment" is a little more vague:

Certificate Enrollment Protocol (CEP) is a certificate management protocol ... CEP specifies how a device communicates with a CA, including how to retrieve the public key of the CA, how to enroll a device with the CA, and how to retrieve a Certificate Revocation List (CRL).

The actual documentation for CEP doesn't define the term, but a related RFC "Certificate Management over CMS (CMC)" describes the term as follows:

Enrollment or certification request refers to the process of a client requesting a certificate. A certification request is a subset of the PKI Requests.

Still not completely clear, but looking at another related RFC for "Enrollment over Secure Transport":

After authenticating an EST server and verifying that it is authorized to provide services to the client, an EST client can acquire a certificate for itself by submitting an enrollment request to that server.

So, basically authentication is a prerequisite to enrollment, and if you're authenticating you must surely have already been registered.

This understanding ties in with the Biometrics case, and also my own experiences where I enrol to register my device on a network where my identity is already known. In a more general "non Infosec" sense this lines up too; you register with a university and then upon enrollment you provide your personal details and select your classes!

  • It's possible there is a distinction in the biometrics sub-genre of infosec, in which case you'd have to find someone SUPER specialized in that area. You'd probably be best just searching through linked-in and calling some people with good resumes. Barring that, it looks a bit like you're just splitting hairs. What it really comes down to is your target audience. I've sat through MANY tech meetings on whether to (fictional example) title a button 'start' or 'begin'. After several hours one is chosen... and the actual end users don't care. They just want the product to work. – Rick Chatham Aug 17 '15 at 20:39
  • Thanks again. The Wikipedia page on the subject (en.wikipedia.org/wiki/Biometrics#Biometric_functionality) carries a satisfactory enough definition for me. My target audience is infosec professionals for whom these distinctions do matter, hence why I posted on the infosec SE ... nevertheless your opinions on the subject are welcome and appreciated. – robert Aug 18 '15 at 8:50
0

There is no useful distinction between the two in this context. (You can check the English SE for differences but they only seem pertinent as relates to college sign-ups.) Most likely you are just seeing different uses of synonyms by the site maintainers. Part of my job involves editing web copy, and I can tell you that most of what is out there was written by people for whom grammar is neither a concern nor interest. You should feel free to use whichever word sounds best to you.

  • Thanks for the answer, but I was hoping for an answer more informed by a general understanding of the terms in the infosec domain. I might take a look at your linked English SE answer and update that now too :o) – robert Aug 16 '15 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.