Arnaud Saint-Martin

David Aubin

Charlotte Bigg

Jérôme Lamy

Fabien Locher

1

Keywords: astrophysics, observatory, voyage

published or not. The documents may come   L'archive ouverte pluridisciplinaire

the world scientific stage-for instance, via the International Research Council. 7 According to Mary Jo Nye, German, English, and French scientists "now compared their situations unfavourably with that of the United States, envying the youthfulness and energy of the large nation to the west." 8 The French system state-observatory proved to be non-operational (on the levels of instrumental resources and mode of patronage), in comparison to the kind of organization incarnated by the MWO or the Lick Observatory. Institutionalised in the 1880s, the system was simply inappropriate for the kind of astronomical research which was actually conducted. 9 This was, in substance, the opinion of the Commission pour le relèvement de l'astronomie française formed in 1920. For its members, the référence obligée to the MWO was a means to pass judgment on this state of affairs and to start a reform of the French system.

This paper studies the French understanding of American astrophysics (and culture) circa 1900-1920. How did the French astronomical community react to this apparent rise? To fully understand, it is necessary to explain the formation of the MWO modèle. I use the word "model" for two main reasons. First, the actors actually use it to portray the MWO. That is why one can treat it as an "emic" concept. The first thing to do here is to historicise its emergence as a category, a symbolic resource for action, and a nationally based "repertoire of evaluation." 10 Who were the MWO admirers? Why did they share an unambiguous attraction to this way of doing astrophysics? Second, the study of the MWO model is a good opportunity to think about the process of comparison, the importation of exemplary ways of organizing the scientific research, and finally the process of community formation in science at the turn of the century. In order to do so, I will focus on the Fourth meeting of the International Union for Co-operation in Solar Research, which took place at the MWO in the summer of 1910. It was a crucial event in the making of the model. A group of astrophysicists came from France and discovered in vivo the management of the American observatories. The voyage in America was an enlightening experience for all of them. MWO, they thought, was the only place in the world where astrophysics could really develop: a new 7 BRIGITTE SCHROEDER-GUDEHUS, Les scientifiques et la paix: la communauté scientifique internationale au cours des années 20 (Montréal: Presses de l'Université de Montréal, 1978). 8 MARY JO NYE, "Scientific Decline: Is Quantitative Evaluation Enough?" Isis, 1984, 4:697-708, p. 708. See also, on the rhetoric of decline, HARRY W. PAUL, "The Issue of Decline in Nineteenth-Century French Science," French Historical Studies, 1972, 3:416-450. 9 For an overview of the institutional regime of the French state-observatories, see JÉRÔME LAMY, L'Observatoire de Toulouse aux XVIII e et XIX e siècles. Archéologie d'un espace savant (Rennes: Presses Universitaires de Rennes, 2007); LAETITIA MAISON, Histoire de la fondation et des premiers travaux de l'Observatoire astronomique de Bordeaux (1870-1906), Thèse de doctorat, Université de Bordeaux I, 2004; ARNAUD SAINT-MARTIN, L'office et le télescope. Une sociohistoire de l'astronomie française, 1900-1940, Thèse de doctorat, Université Paris-Sorbonne, to be defended in spring 2008; ID., « Une constitution pour l'astronomie française au tournant du siècle. Socio-genèse d'un champ scientifique », Cahiers d'histoire. Revue d'histoire critique, forthcoming. 10 For an analysis of the cross-national cultural differences, see MICHÈLE LAMONT, LAURENT THÉVENOT (eds.), Rethinking Comparative Cultural Sociology: Repertoires of Evaluation in France and the United States (Cambridge: Cambridge University Press, 2000).

"astronomical Eldorado" (as Greenwich, Pulkovo and Italian observatories 11 had been before). Back home, they sought to import the U.S. research system to transform the French astronomical community as a whole.

The paper is constructed as follows: first I examine what was at stake on the French side in the preparation of the Californian meeting. The quasiofficial delegation aggregated several scientists with different interests and motivations. The second part deals with the voyage in America and the discovery of the MWO. The model came into being in this context. The last part examines some reports written after the 1910 conference. These documents explain the success of American science in general, and astronomy in particular, and the best way to import and imitate it in France.

A KEY RENDEZVOUS: THE FRENCH DELEGATION AT THE SOLAR UNION MEETING

In the 1900s, American science was of great interest. The French astrophysicists were concerned by the recent developments of the emergent discipline in the U.S. Around 1904, Henri Deslandres wrote to Hale to announce that he was planning to build a scientific station in the South of France. 12 He knew that the director of the Yerkes Observatory was searching for a suitable site to establish a new solar observatory in Southern California, "le pays du Soleil": the Frenchman was anxious to beat his rival in the field they both monopolised. 13 But Hale got ahead. The MWO was soon founded with the financial support of the Carnegie Institution of Washington. 14 Prior to 1910, the 60-inch telescope designed by Ritchey, the Snow telescope, the Solar tower telescopes and the optimal geographical location of the observatory contributed to its reputation. But the construction of this material and symbolic capital has not been smooth. Because he wanted to attract scientists and dollars, Hale strategically created an ideal image of the private establishment, as he had done before when he had launched the Yerkes Observatory. 15 Thanks to Hale's discoveries and political ability, MWO 11 On the Italian paradigm, see LAETITIA MAISON, "Les observatoires italiens en 1875: Un exemple pour le renouveau de l'astronomie française?" Nuncius, 2003, 28:577-602.

12 Henri Deslandres to George E. Hale (13 April 1904). Hale papers, California Institute of Technology Archives. 13 A priority dispute on the spectroheliograph opposed Deslandres to Hale since 1894. 14 The story of the beginnings of Californian observatory is well-known because it was considered as a model in the years following its creation. became one of the leading American scientific institutions. 16 America was now a part of the "Big Four," which included Great Britain, Germany, and France. 17 In this context, the Fourth conference of the Solar Union represented a challenge for Hale and the American astrophysicists in general. Hale was eager to show that the MWO deserved its world-class status and that California was the best place on Earth to observe the heavens.

Seven months before the meeting, Benjamin Baillaud, the director of the Observatoire de Paris, urged the Ministre de l'Instruction Publique to finance a mission. 18 Three years after the last meeting of the Observatoire d'astrophysique de Meudon, Baillaud realized that solar studies had become one of the most important research areas in astronomy, and that French astronomers should participate in the field. Their involvement was guided by scientific and institutional motives. The international co-operation which was planned by the Committee may challenge the pre-eminence of the "Carte du Ciel," the French-centred international program. 19 Since the Californian conference would catch the attention of many astronomers from Europe, Baillaud wanted to send a significant number of fonctionnaires, so the French community would appear as influential as possible. The director combined the scientific stakes of the meeting with very general geopolitical considerations. He was aware that the Ministère de l'Instruction Publique -and the Third Republic in general-attached importance to the propagation of the influence française overseas. And Astronomers thought that they had a role to play in this cultural expansionism. 20 Therefore Baillaud emphasized that the high-ranking astronomers who would be sent to America needed to "faire prévaloir non seulement leurs idées scientifiques, mais les vues conformes à l'intérêt de leur pays." 21 The director had an agenda in mind ; he stressed that "les observatoires des États-Unis d'Amérique, notamment ceux de Washington, de Harvard Collège, du Mont Hamilton, du Mont Wilson et l'observatoire Yerkes sont, dans 16 JEFFREY CRELINSTEN, Einstein's Jury: The Race to Test Relativity (Princeton, Princeton University Press, 2006). 17 John Lankford has compared the relative strength of these leading national astronomical communities in terms of observatories and personnel. In 1907, the US and the United Kingdom possessed more observatories (respectively 102 and 119) than did Germany (45) and France (43). There were a lot more people in the American observatories (294) than in the European ones (161 in the UK, 152 in Germany, and 150 in France). This kind of classification was known by the astronomers at the time. While scientific communities were being "nationalized," this information was of crucial importance for both the leading astronomers and the governments that supported their researches. JOHN l'astronomie mondiale, par les moyens exceptionnels dont ils disposent, aux tout premiers rangs." 22 From 1910, Baillaud recognized that a technological gap was forming between American and European observatories-and not only the French ones. So the "missionnaires" -a sort of official spies-were supposed to look at the "valeur réelle des instruments dont [les Américains] disposent" in situ. 23 It was a test-experience: the study should help define the measures to be taken to catch up with the astronomical establishments of America.

California was already a mythical place in France before the French astronomy delegation reached it in the summer of 1910. About 1830, French migrants started to settle there. 24 After the Gold Rush of 1849, the French exodus was quantitatively more significant. The migrants went there to find better life conditions and the freedom they had lost during the Second Empire. In the 1870s, French colonies were well established in the San Francisco area and in the North of California where they worked as traders, winegrowers, farmers, and storekeepers. As early as 1900, California fascinated many people in France. Many experts in the fields of instruction, human sciences, arts, and science travelled through America to understand these new ways of life. Most of them were sponsored by the French state: they were official "missionnaires". 25 Their job consisted in bringing back useful information about what they saw over there. The trip the astronomers made in 1910 was quite the same thing.

Baillaud chose two astronomers of the Observatoire de Paris to represent the Ministère de l'Instruction Publique. Maurice Hamy, a member of the Académie des Sciences de Paris, was chief of the Laboratoire de spectroscopie stellaire of the Observatoire. Pierre Puiseux, the other missionnaire, taught "physique céleste" at the Sorbonne, and he was used to attending scientific conferences. They both spoke (a little) English; it was a sufficient reason to choose them. Baillaud told them that they ought to inspect a predefined list of observatories and discuss with American leaders the opportunity to participate in the Carte du Ciel. They went to the New World with the Count Aymar de La Baume Pluvinel, an aristocratic amateur who had been trained by Jules Janssen in the "âge héroïque de la physique solaire" 26 during the 1880s. La Baume regularly organized the solar eclipse expeditions supported by the Ministère (and that is why he was a member of the Solar 22 Benjamin Baillaud to the Ministre de l'Instruction Publique (18 February 1910), in Archive (cit. note 17). 23 Ibid. 24 ANNICK FOUCRIER, Le rêve californien. Migrants français sur la côte Pacifique (XVIII e -XX e siècles) (Paris : Belin, 1999). 25 JEAN-CHRISTOPHE BOURQUIN, "National Influences on International Scientific Activity: The Case of the French Missions Littéraires in Europe, 1842-1914," in CHRISTOPHE CHARLE, JÜRGEN SCHRIEWER, PETER WAGNER (eds.), Transnational Intellectual Networks. Forms of Academic Knowledge and the Search for Cultural Identities (Frankfurt: Campus Verlag, 2004), p. 451-471. 26 FERNAND BALDET, Notice sur les travaux scientifiques d'Aymar de la Baume Pluvinel (1860-1938) (Orléans : Société Astronomique de France, 1938). On Janssen's astrophysical expeditions, see DAVID AUBIN, "Orchestrating Observatory, Laboratory, and Field: Jules Janssen, the Spectroscope, and Travel," Nuncius, 2002, 27:615-633.

Union eclipse committee). Also, the physicist had the advantage of knowing Northern America very well.

Hamy, Puiseux, and La Baume were the authorized savants of the République. Six other Frenchmen were invited as well by the Solar Union. They received no grant for their trip. Even though they were not formal members of a state-sponsored delegation, these people were seen as the official représentants of France by their foreign colleagues and the local press. However, each of them had very different motivations and interests. The director of the Observatoire de Paris had no real influence on the way they would lead their trip to the U.S. Henri Deslandres, as I mentioned earlier, was a solar physics pioneer. He was suspicious of Hale's strategy, so his decision to come to California clearly expressed what was at stake, that is to say a struggle for epistemic authority in the field of astrophysics-and there were many potential competitors. Deslandres needed company, so he supported the travel expenses of two regular staff members of the Observatoire de Meudon. Jean Bosler, a solar physicist too, and Pierre Idrac, a young "travailleur volontaire," assisted Deslandres in his tour. Among the French astrophysicists, Bosler would be the best committed to extol the qualities of the American astrophysics and the magnitude of the MWO model. Charles Fabry, the Professor of industrial physics at the Université de Marseille, also moved to America. With Alfred Perot, he was a renowned metrologist, an interferometry expert, and a valued instrument-designer who took an active part in the shaping of the sub-discipline of astrophysics. 27 As a spectroscopy specialist, Aimé Cotton, a Professor at the École Normale Supérieure, was the last member of this semi-official group. The little cortège would join Henri Chrétien (a member of the Observatoire de Nice) at the MWO. He was already there since the beginning of the year 1910, doing a "stage," in order to learn the American astronomers' methods of research. Chrétien served as an intermediary between the Frenchmen and the Americans.

EXPLORATION NARRATIVES: THE NEW ASTRONOMICAL ELDORADO

Thus, this micro-community crossed the Atlantic in the summer of 1910. The voyageurs did not keep for themselves the memory of California: they all communicated their thoughts and visions during or after the trip. They wrote letters to their families or committed to diaries the things they saw during the tour. And some of them drew up official or quasi-official reports on their experience of America. Hereinafter, I will use mainly Puiseux's personal correspondence with his wife and family. 28 One may place these precious documents to the literary genre of the travel narrative. [START_REF] See | Le discours du voyageur. Le récit de voyage en France du Moyen Age au XVIII e siècle[END_REF] Like a writer, Puiseux expressed with words what he observed. With his colleagues, he not only visited scientific establishments and contributed to a professional meeting; he also discovered an ecosystem made of human beings, local folklore, material cultures, and natural environment. [START_REF]That is why the Puiseux's correspondence is a "lay" ethnography[END_REF] The French understanding of American astronomy was full of these different elements. The Frenchmen were strangers in an unfamiliar world; they tried to understand with their own cultural background the essence of a distant cultural model. [START_REF] Schütz | L'étranger[END_REF] They contributed to the (French) invention of the West mythology and the image of the American nation as a whole. [START_REF] See | La Conquête de l'Ouest. Le récit français de la nation américaine au XIX e siècle[END_REF] When they got home, they appreciated their own national and cultural identity in a new and different way. The practice of scientific travel spread in the context of the internationalisation of science and the expansion of the industry of tourism at the turn of the century. The culture du voyage was a component of the practice of the fin de siècle international scientific congresses. [START_REF] Rasmussen | L'internationale scientifique[END_REF] The new astronomical Eldorado merged from the astronomers/tourists' experiences. This way, I argue, the very act of travelling shaped their perception of America.

July 30, Puiseux and La Baume boarded the boat Bretagne at Le Havre. As a solar eclipse hunter, "voyageur devant l'Éternel," La Baume felt comfortable on this "maison flottante" [START_REF] Puiseux | [END_REF] . Although he was an inexperienced traveller, Puiseux wanted to discover the New World. The transatlantic cruise was an experience in itself. The everyday life on the ship was quite solitary, and Puiseux and La Baume socialized with "Yankees" who were going back home after their tour of Europe, a Mexican army officer, and compatriots from the First class: a micro-society was forming. In a dîner mondain, Puiseux was proud to introduce himself as "un invité de M. Carnegie." 35 The astronomer tried to occupy his time: He took some photographs on the deck; he read astronomy books, like the 1909 Annual Report of the Mount Wilson Observatory, and "un dictionnaire publié en Belgique, qui a la pretention de faire connaître tous les astronomes du monde avec l'occupation de chacun d'eux." [START_REF] Puiseux | Puiseux referred to the book edited by the Brussels astronomer PAUL STROOBANT, Les observatoires astronomiques et les astronomes[END_REF] As a mathematician and a son of a mathematician, Puiseux had to enquire about the recent advancements in solar physics.

Eight days after the departure, the Bretagne finally reached New York. The first look at the skyline of the city was a disappointing experience: the monuments and the docks, "immenses constructions en planches peintes de couleurs noirâtres et sans frontières", "[lui] font, avec leur forme généralement cubique, une impression marquée d'uniformité et de laideur." 37 Having arrived a few days before, Hamy's first impression was on the contrary quite "favorable." He wrote to his son that "[les hautes maisons] ne sont pas artistiques, il est vrai, mais elles donnent une idée nette de la puissante énergie de ce pays et de sa richesse." [START_REF] Hamy | Private archives of Michel Hamy[END_REF] The voyageurs confirmed their preconceived opinion. The sea gate to America incarnated the emergence of an advanced technological nation.

The organization and the constraints of the tour terrified Puiseux; but happily for him, La Baume took the lead. And so the long trip by transcontinental railways could really start. After staying in Montreal for only one day, they crossed then the Canadian territory during the second week of August. Both a scientist and a businessman, La Baume stopped in Winnipeg "pour visiter une des exploitations agricoles où il [avait] des intérêts." [START_REF] Puiseux | [END_REF] Puiseux continued alone for a while. From the train, he contemplated the vast plains; he visited some national parks (e.g., Barnff) and discovered the landscapes of the Canadian Rockies. About the same time, Hamy and Bosler were exploring Yellowstone Park. Glacier House was a revelation for Puiseux, a kind of Eden "aussi joli que n'importe quelle vallée Suisse, mais différent." 40 This land was full with natural resources. Puiseux observed as well "les types variés des Américains de l'Est et de l'Ouest, ceux-ci plus animés, plus sociables et se rapprochant de nos méridionaux." Although he enjoyed the excursion, Puiseux thought that the Autochthons' customs were vulgar and prosaic, lacking the kind of dignity which made the miracle of French civil culture; for him, Yankee saloon sociality was the exact opposite of the French salon civility. Thus, Puiseux portrayed bluntly the way of life in the New World. Since La Baume left him at Winnipeg, Puiseux could not share his views with other people. And the Americans "[n'avaient] pas la patience d'insister quand ils voyaient qu '[il] ne comprenait pas". 41 The solitude finally ended when he found La Baume again on the road to the Pacific Ocean. On August 20, they arrived in Vancouver. For Puiseux, the city looked like "toutes les villes américaines, riche en hautes bâtisses carrées, en lignes de tramways tapageurs, en réclames voyantes." 42 Since the arrival, he and his friends saw the uniform and massive architecture of the cities as the metonymic figuration of America. Fortunately, Victoria gave a nicer image of British Columbia. It was the first place where Puiseux felt signs of "sympathie." Hugging the Pacific coast, they finally arrived in California, on August 24. Puiseux marvelled at the atmosphere in the town of San Francisco; he admired as well the way Americans had managed to rebuild the city on the ruins of the 1906 earthquake-another proof of the industrial superiority of America. The next day, they met with the President of the University of Berkeley and the astronomy Professor Leuschner; "ces messieurs se rappellent bien avoir vu MM. Picard, Gard, Poincaré et les distractions de ce dernier semblent être demeurées légendaires chez eux." 43 They all very much enjoyed socializing with several American colleagues, but they knew that their real mission was only beginning.

William Campbell, the director of the Lick Observatory, invited the French group for a two-day visit. From San Francisco, they took the train to get to the busy San Jose. Hamy (back from a trip in Alaska), Idrac, and a Russian astronomer were already waiting for them there. The twenty-five kilometre road to Mount Hamilton Peak was a hellish experience, but they finally arrived at the top of the mountain. Europeans could then really see this place they could only imagine before that by reading the formal reports of the Observatory. 44 Far from industrial cities, the culture and community life of the Lick was undisturbed. The Campbell family was very pleasant with their guests, even if no one could speak French; the music played by Miss Campbell's phonograph and the luncheons engaged communication. 45 Campbell guided the French men in the facilities of the observatory. The nightuse of the lunette, the Crossley refractor, the Mills spectrograph, and the equatorial confirms Puiseux's expectations: La pureté du ciel est en effet fort au-dessus de ce que nous avons ordinairement à Paris; les instruments sont plus puissants et remarquablement bien agencées. […] Les dépenses qu'il a fallu faire pour organiser là-haut des réservoirs d'eau alimentés par des pompes, de puissantes machines électriques, ont été formidables, mais la Californie est riche et il s'y fait encore tous les jours de grandes fortunes […]. La tranquillité dont jouissent les observateurs sur le sommet, dont l'accès est plutôt long et dispendieux, est aussi favorable au travail. 46 Campbell showed the entire logistics of the site. And his French hosts were very much impressed. Deslandres, also invited at Lick, will later compliment Campbell for the "qualities si desirables de son observatoire modèle" which he could "observer de ses propres yeux". 47 The organization was more "traditionnelle" than was the one of the MWO, according to La Baume, 48 but the "petite compagnie" of the Lick was exemplary in demonstrating discipline and involvement in the collective work.

On August 28, in Pasadena, the French group got bigger, with the arrival of Bosler, Chrétien, Cotton, Deslandres, and Fabry. The four-day Congress would soon start. The whole community of British, Dutch, German, Italian, and Russian delegates formed a "Tour de Babel"49 . The American astronomers came in very large numbers, followed by the French and German delegations. [START_REF]The Mount Wilson Conference of the Solar Union[END_REF] The meeting caught the attention of the local newspapers and various astronomical periodicals. [START_REF] For Instance | The Mount Wilson Conference of the Solar Union[END_REF] The reports published in these journals presented the official and visible version of the event. Puiseux's correspondence provides a more intimate account. The Parisian astronomer started by visiting the MWO Laboratory at Pasadena. Puiseux thought that the visit was a kind of demonstration of force: On a dépensé ici des millions et fort intelligemment, à tel point qu'on ne craint plus guère les concurrences. Aussi étale-t-on sans réticence sous les yeux, ce que ne font pas les constructeurs français. On trouve là les machines les plus perfectionnées pour tourner ou creuser le métal. Ces machines sont en action sur de vrais instruments, car l'Observatoire du Mont Wilson qui a déjà le télescope le plus puissant du monde est en train de s'en donner un encore trois fois plus grand [Puiseux points here to the Hooker telescope]. 52 The exhibition of the many instruments in the MWO ecological environment increased the symbolic value of the establishment as a model. After having contemplated the laboratory, the assembly could then ascend the mountain on foot, by horse, or car. There, the congressists could discover again other new instruments. The 150-foot Tower telescope was the most unusual instrument-it confirmed, again, the shrewdness of the American instrumentalists. [START_REF] Wilson | The Fourth Conference of the International Union for Co-operation in Solar Research[END_REF] Hale wanted to stimulate personal contacts and informal discussions. [START_REF] Chant | The Mount Wilson Conference of the Solar Union[END_REF] It was a very unusual modus operandi for the Frenchmen who were familiar with the formal conferences organized at the Observatoire. English was the main language. Puiseux was designated translator and secretary by Schuster. However, it was hard for him to intervene in the debates, since his English was too rudimentary ("on doit souvent trouver que je responds à côté"). For instance, he could not exchange with Pickering, Backlund, Dyson, Kapteyn, or Turner during the stellar magnitudes session. And Puiseux was not the only savant lost in translation. Deslandres failed to convince the experts of the spectroheliographic research session to create a new "Committee on the Study of the Solar Motions." [START_REF] Wilson | The Fourth Conference of the International Union for Co-operation in Solar Research[END_REF] His irrepressible monolingualism did not help, nor his tendency to celebrate his own researches. Puiseux noted ironically that Deslandres "fait une communication longue, précipitée, où il reprend l'histoire de ses travaux depuis 17 ans, dans un anglais que les Américains comprennent peu ou pas du tout. Il est écouté avec une impatience assez peu dissimulée et plusieurs déploient des journaux." [START_REF] Puiseux | [END_REF] Behind the peaceful scientific discussion, Deslandres was very harsh with Hale's institutional strategy and scientific works. He confided later to Campbell some thoughts about the "comédie humaine des congrès," which reveals how much he was irritated by Hale's "syndicat."

Hale est décidément un struggle for life de premier ordre ; il emploie tous les moyens. Il est extrêmement habile, ayant les qualités d'un homme politique et d'un savant, mais surtout les qualités d'un homme politique. Sur le terrain scientifique, il a fait de grandes découvertes mais, en général, il les interprète mal ; et tous ses appareils sont fort compliqués. Il a organisé très habilement le congrès solaire, avec un petit groupe compact de la Société astronomique de Londres, avec des intérêts communs, mais qui lui sont inférieurs, ce qui lui assure la suprématie. [START_REF] Deslandres | Mary Leane Archives of the Lick Observatory[END_REF] The struggle for institutional authority was quite intense. Deslandres was not in St. Louis when the "Committee on Solar Research" was founded in 1904. Since he could not take part in the Exposition there, [START_REF] Deslandres | Hale papers[END_REF] Deslandres had difficulty laying down his requests. Because he could not speak English, he could not serve as a "chairman." [START_REF] Deslandres | Mary Leane Archives of the Lick Observatory. 60 BIGG, Behind the Lines[END_REF] This linguistic obstacle was crucial while the emergent field of astrophysics was being structured by the English-written periodical Astrophysical Journal. Nonetheless, other Frenchmen seemed more successful. Fabry defended the "French interests" more efficiently by setting up spectroscopic standards. 60 Finally, one of the most important results of the Conference was the extension of the researches to the entire astrophysical field, which would integrate solar physics, the spectral classification and the investigation of the stars. At the end, Turner suggested that the Solar Union and Astrographic Chart should join. 61 Baillaud's worries appeared wellfounded: the Californian meeting had led to a new definition of astrophysics as a unified discipline. And this epistemological change occurred in the most ultimate astronomical place in the world.

After the Conference, the French finally separated. It was clear that the visit of the MWO was the main episode of the mission. Some took the train to New York City after having discovered the countryside outside Los Angeles, while others went to Arizona to see the Grand Canyon. La Baume had not yet left Pasadena and already sent a brief report to Baillaud. 62 He underlined the creation of the new spectral classification committee of which Hamy was a member. "L'Europe a été bien représentée," according to La Baume. His description of the "l'hôtel du Mont Wilson" and its scientific equipment was very precise. For him, there was no obvious difference between the quality of the images taken in California and at the Observatoire de Meudon. However, La Baume admitted that the MWO had the "Soleil avec lui." And Ritchey's photographs were amazing to him: "le jour où M. Ritchey abordera la photographie des planètes, il résoudra bien des problems. Aussi je considère que ce serait peine perdue que de faire des travaux de ce genre en France."

Puiseux and Hamy planned a visit to the Yerkes Observatory, in Wisconsin. When they approached Flagstaff, Arizona, they recognized the Lowell Observatory on the Mars hills but, according to Puiseux, the private observatory did not deserve a halt. 63 Anyway, they had already seen the Eldorado. Before leaving America, Puiseux wrote to Campbell, in the name of the French and European astronomers, that he would "remporte[r] en Europe beaucoup d'excellents souvenirs, mais ceux de l'Observatoire Lick brillent, si j'ose le dire d'un éclat tout particulier." 64 In the same tone, La Baume expressed "l'admiration la plus profonde pour le bel établissement que vous [Campbell] dirigez." 65 These compliments sur le vif synthesized a collective attitude. When they got home, the explorers put together the things they saw and made a post hoc modèle. It was then time to draw conclusions from their experience of America.

THE AMERICAN MODEL AS A PRETEXT FOR CULTURAL REFLEXIVITY AND

LOBBYING

The in situ observation of the American observatories has been a crucial event in the making of the MWO myth. After nearly a week at the MWO, the 61 C. A. CHANT, "The Mount Wilson Conference of the Solar Union" (cit. note 49), p. 368. 62 Aymar de La Baume Pluvinel to Benjamin Baillaud (7 septembre 1910), in Archive (cit. note 47). 63 Frenchmen had a clear idea of what the model observatory should be like. What did the French bring back from their stay in California? In this part, I will focus on the writings of Bosler and La Baume. They became the advocates of the Americanization of the French system of state-observatory in the 1920s.

As an immediate result of his tour in the U.S., Bosler, an astronome physicien of the Observatoire de Meudon, published a long paper on "Les récents progrès des méthodes astrophysiques aux États-Unis." [START_REF] Jean Bosler | Les récents progrès des méthodes astrophysiques aux États-Unis[END_REF] The image he gave of the organization of the American observatories that he had visited (Harvard, Lick, Yerkes, Lowell, and MWO) was very positive. These establishments looked like factories managed by what Edward Pickering, the director of the Harvard College Observatory, called "eminently practical men." [START_REF] Pickering | The Future of Astronomy[END_REF] "Un de leurs traits communs, Bosler stressed, est l'extrême perfection des moyens mécaniques, l'ingéniosité toujours en éveil et l'absence de tout esprit de routine dont les constructeurs ont à tout instant fait preuve." [START_REF] Bosler | Les récents progrès des méthodes astrophysiques aux États-Unis[END_REF] The physicist was fascinated by the way the "méthodes industrielles" were applied in the science of astrophysics. It showed "le génie d'un peuple si bien doué à la fois pour les grandes affaires et pour tout ce qui touche à la mécanique." 69 The model observatories illustrated the valuable interaction between industry and science, since they were situated close to industrial cities that provided them with raw materials and technological equipments. Although the giant telescopes and the mechanical equipments did not possess the aesthetic sophistication of the French instrumentation, these technologies were more efficient. The 150-foot Tower telescope illustrated the creativity and the absence of "esprit de routine" that characterized the American "constructeurs." The Laboratory of the MWO was the state of the art in terms of the rational organization of scientific work. 70 It was the kind of méthodologie the French observatories has to import to be more modern. Why was astrophysics research developing so quickly in America? For Bosler, the "générosité royale" and "l'influence positive" of the "riches industriels Américains" was a key to understanding that. 71 Science was of great interest and concern for people like Andrew Carnegie or John Hooker. Bosler lamented that the French patrons kept their money to themselves, when "leurs largesses pourraient être, ne serait-ce qu'en partie, plus judicieusement distribuées, dans l'intérêt du prestige moral du pays, en dons à des institutions scientifiques qui luttent péniblement pour soutenir un passé glorieux." 72 By pointing that out, Bosler targeted in some way the system of state-observatory. The apology of the private American astronomy economy served a political purpose; the physicien showed that the French savants could escape from the bureaucratic organization of the establishments like the Observatoire de Paris.

He mentioned also the positive spur of the spirit of entrepreneurship in astronomy : "chercher des fonds est pour leurs savants [de l'Amérique] une occupation toute naturelle, presque un plaisir ; les employer à construire de nouveaux instruments en est un autre." 73 Pickering was the perfect example of this attitude, since he naturally managed to a raise lot of money for the Harvard College Observatory from philanthropic donors. [START_REF] See | Edward C. Pickering and the Endowment of Scientific Research in America, 1877-1918[END_REF] On the contrary, the French were reluctant to this activity. They were just waiting for the money "to fall down from the (governmental) sky." Bosler underlined the effects of the ethos of his "nés fonctionnaires" colleagues. For him, the main origin of the rise of the American astronomy was cultural. The pragmatism and the inventiveness of the American culture were a good incentive to science. The French simply had to recognize that in some ways, people outside France may have found better methods to organize the sciences. Bosler finished his paper by a plea for humility.

The year after the Congress, La Baume Pluvinel told the story of his tour in the U.S. to the public of amateur astronomy. [START_REF] Pluvinel | Une visite aux observatoires des États-Unis[END_REF] The astronomer reviewed all the establishments that he visited, chronologically, from coast to coast, focusing on both the instruments and the organization. First he began with an idea which was now common: these "observatoires sont, ainsi que vous le savez, les mieux outillés du monde." In comparison to other observatories, [START_REF] Allegheny | La Baume presents[END_REF] the MWO clearly appeared as the most important one. After all, wrote La Baume, the establishment was the "but de notre voyage." [START_REF] Baume Pluvinel | Une visite aux observatoires des États-Unis[END_REF] The rhetoric was hyperbolic. The MWO had "le plus puissant réfracteur qui existe. Le miroir a été travaillé par Ritchey et est une merveille d'optique." 78 In France, there were no instruments like that-the grande lunette was an exception. Why was American astronomy so successful? With Bosler, La Baume emphasized the "rôle considérable que joue l'initiative privée en Amérique" : "si l'on excepte l'observatoire de Washington, qui appartient à l'État, tous les autres établissements astronomiques américains ont été fondés par de généreux donateurs qui se sont cotisés pour réunir les fonds nécessaires à leur création." 79 This was an important difference with the French system. The intervention of the state in the organization of the scientific professions in France was structural. [START_REF] See | Science, the University, and the State in Nineteenth-Century France[END_REF] As an amateur, La Baume insisted that another system was possible. However, his point of view on the American pragmatism applied to the organization of the sciences was ambivalent. In those lectures he gave at the Société Astronomique de France, he interpreted the cultural and axiological conditions of the private foundation system. The discourse was ironical: the aristocrat caricatured the American patrons of science and scientists' standards of behaviour. Why did they give substantial funds to astronomy? Here is the very suggestive explanation of La Baume: Mais on peut se demander pourquoi les Américains, gens essentiellement pratiques, s'intéressent à une science aussi éminemment spéculative que l'astronomie. Au fond, à part de rares exceptions, les Mécènes qui donnent si largement pour l'astronomie sont absolument ignorants des choses du ciel. Ainsi, M. Lick n'avait jamais regardé un astre dans une lunette lorsqu'il fonda son observatoire […]. En réalité, si les Américains donnent si largement pour l'astronomie, c'est qu'ils savent que le vieux monde leur reproche d'être trop pratiques et trop intéressés ; aussi sont-ils heureux de pouvoir montrer, à l'occasion, qu'ils sont accessibles au culte de l'art et de la science. Voici comment la vanité n'est peut-être pas tout à fait étrangère au développement de la science astronomique aux États-Unis. [START_REF] Baume Pluvinel | Une visite aux observatoires des États-Unis[END_REF] This striking assertion helps to understand the stereotypic representation of the American culture among French scientists. La Baume suggests that the patrons of science were in the habit of warding off their moral state by some generous gifts to science. The desire for recognition and vanity were "en réalité" the impure origin of the philanthropic politics of knowledge. La Baume affirmed here the moral superiority of the Old World over the "New" one. Even though La Baume noticed the productiveness of the Californian observatories, he believed that morally the ulterior motive of the system of patronage was futile. In a very long paper published in December 1911 about the MWO, the physicist Louis Houllevigue used the same argument. In a tocquevillian fashion, he stated that "l'esprit profondément religieux des Yankees s'intéresse aux merveilles du Ciel 'qui disent la gloire du Créateur' et leur caractère pratique dérive cet enthousiasme vers les recherches scientifiques." [START_REF] Houllevigue | L'Observatoire du Mont Wilson[END_REF] So the growth of the American science was just a question of money: "c'est à coups de millions que Hale a gagné ses victoires sur l'inconnu; je sais plus d'un laboratoire français où les études solaires seraient poussées plus vigoureusement si les ressources ne lui étaient pas mesurées avec parcimonie ; c'est ainsi que la patrie de Laplace et Le Verrier […] est en train de perdre une prééminence qu'elle devait au génie de ses fils de naissance." 83 The interpretation is meaningful. According to John Servos, the very empiricist "Baconian character of American scientific work" was constitutive of the epistemology of American physics before the 1930s. [START_REF] Servos | Mathematics and the Physical Sciences in America, 1880-1930[END_REF] Because the Americans were "des hommes éminemment pratiques" (Bosler), astrophysics was a technical activity for them. Although they excelled in observational astronomy and laboratory experiments, they could not develop theoretical programs. Americans had to attract foreign theorists like the Dutch astronomer Jacobus Kapteyn. [START_REF] Devorkin | Internationalism, Kapteyn and the Dutch pipeline[END_REF] The logical inference of this idea is that if the French astronomers had the money, they would surpass the Americans. And it was a sort of challenge for the French, since they alleged that the Yankees were trying to dominate the world of science. An attitude that Hale personified: "la vie de Hale est vraiment représentatif du monde américain, qui porte autant d'audace à conquérir la science qu'à imposer à l'univers les produits de son industrie." [START_REF] Houllevigue | L'Observatoire du Mont Wilson[END_REF] The MWO model was highly idealized. One may stress some facts which eventually help to picture this history in a more balanced way. In reality, the erratic construction of the mirror of the 100-inch telescope showed the problems the staff of the establishment had to face before 1917. [START_REF] Osterbrock | Eye on the Sky[END_REF] But Hale managed to hide these technical hitches. On the other hand, was MWO really a paradise for solar physicists?, a place where astronomers performed full-time research? As David DeVorkin has demonstrated, Hale's relative failure in attracting physicists or laboratory spectroscopists prior to 1922 is instructive. [START_REF] Devorkin | Quantum Physics and the Stars (V): Physicists at Mount Wilson Prior to 1922[END_REF] As an "applied science," the astrophysics of the MWO was at odds with the American physics community. More generally, and contrary to Bosler's opinion, the life conditions on the top of the mountain were not so idyllic; the routine, the monastic isolation and the single life were a kind a torture for the staff of the MWO with the bustling Los Angeles as a neighbour not far away. The endowment of the astronomical research was not as easy as Bosler and his friends imagined. Pickering's relative failure to stimulate a national endowment and a cohesive support program for the American astronomy revealed the limits of the private funding system. The moral economy of donation implied a dependency between the donator and the receiver. The "individualistic prewar style of science patronage" 89 could have negative effects. For instance, the "politics of knowledge" 90 of the Carnegie Institution fashioned the advancement of science. The scientists had to compose with that. On a more individualistic level, generous donors' personal desires could disturb the organization of the observatories. At the MWO, for example, the rich Los Angeles industrialist Hooker was very anxious to tell everybody that his 100inch telescope was finally ready. The Americans were not so satisfied with these arrangements. Whereas the French desperately sought to entice the mécènes, the Americans wanted the federal government to intervene and cooperate more in their affairs. However, Bosler, La Baume and the other French astronomers could not see it. They accentuated only elements they wanted to see.

The French thought highly of American astronomy. But this attraction was not one-sided. The Americans were also concerned with the advancement of French astronomy. For example, the construction of the 60-inch telescope of the Yerkes Observatory was partly motivated by the establishment of the big lunette of the Exposition universelle de Paris. In 1899, Hale informed Harper, the President of the University of Chicago, that the patron of science Charles Yerkes "believed the Paris telescope will overshadow ours [the 40-inch telescope of the Yerkes Observatory], and would be only too glad of a chance to outdo it." [START_REF] Hale | [END_REF] Even if the French instrument was "designed for popular amusement," the physicist could not think about this progress without making it obvious. One should also consider the importance of the technological and commercial exchanges between the American astronomers and the French instrument makers. The MWO-St. Gobain contract was an example among others. In the 1900s, the American observatories used to acquire equipments and devices made by constructeurs like Gautier, Prin, Secrétan, etc., or the photographic plates manufactured by the renowned Lyon Lumières Company.

After World War I, the foundation of the International Research Council facilitated the solidarity between the Allies. The developments of a new form of "internationalism", which notably excluded the Germans and then created two "hostile camps," institutionalised the pre-eminent position of American science. [START_REF] Forman | Scientific Internationalism and the Weimar Physicists: The Ideology and Its Manipulation in Germany after World War I[END_REF] In this context, a process of Americanization had great effects on the Inter-Allies' self-perception and interior policy. [START_REF] See | Why the American Century?[END_REF] The positive reference to America (science and society in general) among the French scientific community became a commonplace. And the Californian sociotechnological Eldorado [START_REF] Heilbron | Lawrence and his Laboratory: A History of the Lawrence Berkley Laboratory[END_REF] was the trendiest component of this fascinating stereotype. Again, the making of the model was progressive. The 1910 voyage was, as I have argued, a decisive moment in the making of it, at least in the French scientific community. The model emerged because cultures were in contact; French could watch in situ the American astronomy community they could only imagine before. This model integrated a set of basic assumptions and principles on the MWO. The souvenir of the establishment became fuzzy only years after the original experience. The original essence of the MWO was then filtered by the individual and collective memory: the geographically distant site transformed into a legendary form. By definition, a model is a simplification of reality; the model makers accentuate the positive details and occult the negative ones. When they invented the new astronomical Eldorado, the astronomers took several elements. The French understanding of American astrophysics was to some extent fantasized: the macro-social entity "American astronomy" they had observed was a mixture of moral judgments and commonly held representations about places, people customs, and folk culture. From the French point of view, the rise of American astrophysics results from the complex interaction of self-confidence, industrial methods, pragmatism, patrons' vanity, great climatologic conditions, an ability to expanse money, and faith in God. The MWO model was indeed the concrete abstraction of America.

The construction of the MWO model had also pragmatic ends. The positive reference to Eldorado had to be useful. When the Académies des Sciences urged the government to revive astronomy in the country, in 1920, the MWO and the kind of organization it symbolized became the common topos of the debates among the French astronomers. Deslandres, then Président of the Académie, made the first move by writing a long diagnostic report on the socalled "crisis" of French astronomy. What was the best method to adopt? For Deslandres, the MWO was the best "model" to "imitate" (sic). 95 In the same mood, Baillaud believed, too, that "tout travail fait en Amérique devrait pouvoir être fait en France." 96 He wanted to build a new Observatoire de Paris in the image of the MWO. About 1923, an independent and private committee helped to plan the foundation of the "biggest observatory in the world." The appointment of Ritchey in 1924 by the mécène Dina for the construction of the mirror was a first decision that would lead in theory to a French version of the MWO. But the French astronomers were not on time. While they were looking for an appropriate place in the South of France to establish the hypothetical observatory, the astronomers of the MWO were already planning the construction of the 200-inch telescope (endowed by the Rockefeller Foundation), which would be later installed at the Mount Palomar Observatory-again, a "newer" astrophysical Eldorado.

  See, for examples of quasi-official accounts of it, RONALD S. BRASHEAR, "Observatories of Carnegie Institution of Washington," in JOHN LANKFORD (ed.), History of Astronomy. An Encyclopedia (New York & London: Garland, 1997) p. 119-121; KEVIN KRISCIUNAS, Astronomical Centres of the World (Cambridge: Cambridge University Press, 1988), chap. 6; ALLAN SANDAGE, Centennial History of the Carnegie Institution of Washington. Vol. 1: The Mount Wilson Observatory (Cambridge: Cambridge University Press, 2004).

15

DONALD E. OSTERBROCK, Pauper and Prince. Ritchey, Hale, and Big Telescopes (Tucson: The University of Arizona Press, 1993).

  43 Pierre Puiseux to Béatrice Bouvet (24 August 1910), ibid.44 In a letter sent to Campbell from Montreal, La Baume mentions "le splendide observatoire au sujet duquel il a tellement entendu parlé." Aymar de La Baume Pluvinel to William Campbell (11 August 1910). Mary Leane Archives of the Lick Observatory. 45 For descriptions of the Lick Observatory "culture" and moral economy (and the important role played by Mrs. Campbell), see ALEX SOOJUNG-KIM PANG, "Gender, Culture, and Astrophysical Fieldwork: Elizabeth Campbell and the Lick Observatory-Crocker Eclipse Expeditions", Osiris, 1996, 11:17-43; DONALD E. OSTERBROCK, JOHN R. GUSTAFSON, W. J. SHILOH UNRUH, Eye on the Sky: Lick Observatory's First Century (Berkley: University of California Press, 1988), chap. 8. 46 Pierre Puiseux to Béatrice Bouvet (25 August 1910), in Archive (cit. note 27). 47 Henri Deslandres to William Campbell (21 September 1910). Mary Leane Archives of the Lick Observatory.

48

Aymar de La Baume Pluvinel to Benjamin Baillaud (7 septembre 1910). Archives de l'Observatoire de Paris, MS 1060, V-B-1.

  Pierre Puiseux to Béatrice Bouvet (8 September 1910), in Archive (cit. note 27). 64 Pierre Puiseux to William Campbell (22 September 1910). Mary Leane Archives of the Lick Observatory. 65 Aymar de La Baume Pluvinel to William Campbell (7 September 1910). Mary Leane Archives of the Lick Observatory.

CHARLOTTE BIGG, Behind the Lines: Spectroscopic Enterprises in Early Twentieth Century, unpublished Doctoral Dissertation, University of Cambridge, 2002, Part 2.

These private archives are kept by the Association des descendants et amis d'Henri Wallon, and conserved at the Archives du Jura. Permission to use these archive materials was granted by the Association.

Pierre Puiseux to Béatrice Bouvet (7 August 1910), in Archive (cit. note 27).

Pierre Puiseux to Béatrice Bouvet (28 August 1910), in Archive (cit. note 27).

HENRI DESLANDRES, Sur l'amélioration des études astronomiques en France (Orléans: Imprimerie Henri Tessier, 1926). See ARNAUD SAINT-MARTIN, "La phase critique de la Carte du Ciel à Paris, 1920-1940," in La Carte du Ciel, edited by Jérôme Lamy (forthcoming).

Eleventh session, 12 July 1920, report of the "commission des observatoires", Archives Nationales de France, F 17 13572.


Audun Jøsang
email: josang@mn.uio.no

Kent A Varmedal
email: kentav@ifi.uio.no

Christophe Rosenberger
email: christophe.rosenberger@ensicaen.fr

Rajendra Kumar
email: rajendra@negp.gov.in

Service Provider Authentication Assurance ♯

The concept of authentication assurance traditionally refers to the robustness of methods and mechanisms for user authentication, including the robustness of initial registration and provisioning of user credentials, as well as the robustness of mechanisms that enforce user authentication during operation. However, the user is not the only party that needs to be authenticated to ensure security of online transactions. In fact, online service provision always involves two parties, typically the user on the client side and the service provider on the server side, so that mutual authentication between the two sides is required. In contrast to the unilateral focus on user authentication by industry and academia, it is in fact equally important for the user to correctly authenticate the service provider. Unfortunately, little attention is paid to the problem of correctly authentication the service provider. This paper proposes a framework for server and service provider authentication assurance, similarly to frameworks for user authentication assurance that have already been specified, or are currently under development by many national governments.

I. INTRODUCTION

Entity authentication is considered to be a fundamental security primitive for Internet mediated interaction. Wrong authentication, where an attacker is able to take on the identity of another entity, is a serious security threat that can have significant negative consequences. Authentication assurance expresses the certainty and reliability with which correct authentication is enforced in a system or domain.

There are different forms of entity authentication that serve different purposes. This paper focuses on requirements for server and SP (Service Provider) authentication, and proposes a framework for server authentication assurance. Identity management has traditionally only focused on user authentication, for which there are well established principles for obtaining authentication assurance. Server authentication is often overlooked in the literature, so we believe it is timely to focus on requirements for server authentication assurance.

Standards for network security such as X.800 [START_REF]Recommendation X.800, Security Architecture for Open Systems Interconnection for CCITT Applications[END_REF] typically distinguish between the following two types of authentication:

• Data Origin Authentication:

The corroboration that the source of data received is as claimed.

• Peer Entity Authentication:

The corroboration that a peer entity in an association is the one claimed.

The X.800 standard (called "Security Architecture for Open Systems Interconnection") assumes that authentication takes place between atomic entities, either as originators of data, or as peer entities in a session. In this paper we are primarily concerned with peer entity authentication, not with data origin authentication. A peer entity can be more complex that what is often assumed, as explained below.

The terms client and server are typically used to denote the peer entities in a communication session. In reality, client and server systems are only agents for legal and/or cognitive entities such persons or organisations. The human user and the SP organisation are legal entities as well as cognitive entities. A person is assumed to be a cognitive entity because is possesses its own non-deterministic free will, in contrast to system entities that are considered to be deterministic without a free will. A legal organisation can also be considered to be cognitive in the sense that its actions are governed and executed by persons who legally represent the organisation.

By taking into account the distinction between system entity (client or server) and legal/cognitive entity (person or organisation) there are in fact two entities on each side of a communication session, as illustrated in Fig. 1. This analysis shows that the implicit assumption of atomic entities made by the X.800 standard is a simplification and abstraction which thereby hides important aspects of entity authentication.

SP Organisation Human User Client System

Server System The distinction between the human user and the client system on user side, as well as between the SP organisation and the server system on the SP side illustrated in Fig. 1 leads to 8 different forms of peer entity authentication between the two sides, where each side can be authenticated in 4 different ways as explained below.

SP Side User Side

The four types of user side entity authentication are: U1) Human user authentication by the SP organisation U2) Human user authentication by the server system (commonly called user authentication) U3) Client system authentication by SP organisation U4) Client system authentication by the server system The four types of SP side authentication are: S1) SP organisation by the human user S2) SP organisation by the client system S3) Server system authentication by the human user (which can be called Cognitive Server Authentication) S4) Server system authentication by the client system Some of the entity authentication types in Fig. 1 are relatively impractical, such as U3 and S2, but they illustrate the generality of entity authentication when assuming non-atomic user and SP sides. U1 is practiced e.g. for authenticating customers over the phone, e.g. by asking questions about address, date of birth, customer number as well as credentials such as PIN codes. The X.800 standard focuses on entity authentication types U4 and S4. However, in Internet and Web services applications the entity authentication types U2 and S3 in Fig. 1 are the most important. The importance of entity authentication types U2 and S3 in particular emerges from the requirement of end-to-end security in web service applications. In the typical case where a human user accesses an online service, semantic end-to-end communication takes place between the human user and the server system. It is therefore pragmatic to require mutual authentication between those two entities, as illustrated in Fig. 2. The syntactic communication between the server and client systems typically provides communication confidentiality by encryption, but can not provide authentication in a meaningful way.

SP Organisation Human User

Client System

Server System

SP Side User Side

U2 S3

Fig. 2. Pragmatic end-to-end authentication Authentication type U2 in Figs.1&2, commonly known as user authentication, is an essential component of Internet security and identity management. User authentication is extensively studied in the literature, with a multitude of solutions in practical use, such as passwords, OTP (one-time password) devices and biometrics. Note that user authentication also can take place locally between the client system and the human user within the user domain, as well as between the server system and a human representative of the SP organisation within the SP domain.

Entity authentication type S3 in Figs.1&2 has largely been ignored by researchers and the industry. Authentication type S3, which we call cognitive server authentication, focuses how a human user can verify that the correct and intended system is at the other end of an Internet connection. The lack of robust practical solutions for cognitive server authentication is a serious vulnerability which causes exposure to various types of attacks. This paper proposes a framework for server authentication with focus on cognitive (S3) as well as noncognitive (S4) methods.

The TLS security protocol [START_REF] Dierks | RFC 5246 -The Transport Layer Security (TLS) Protocol Version 1[END_REF] mainly provide server authentication type S4 because the authenticity of server certificates, and thereby of the server, are validated by the client system, not by the human user. Additional elements that must be combined with e.g. TLS are are needed to enable server authentication type S3, i.e. to enable the human user to authenticate the server system in a reliable fashion. Other security protocols that can provide server authentication of type S4 are e.g. IPSec [START_REF] Kent | RFC 4301 -Security Architecture for the Internet Protocol[END_REF] and SSH [START_REF] Ylonen | RFC 4251 -The Secure Shell (SSH) Protocol Architecture[END_REF].

The concept of authentication assurance expresses the estimated reliability of authentication. Several governments have articulated and published frameworks for user authentication assurance, with specific assurance levels defined as a function of factors such as identity registration assurance and authentication mechanism strength. Unfortunately, no similar frameworks have been articulated for server authentication.

This paper proposes a general framework for server authentication assurance, where each specific authentication assurance level is determined as a function of a set of factors. The existing frameworks for user authentication assurance are briefly described next, in order to provide the background and a basis for comparison with our proposed framework for server authentication assurance.

II. AUTHENTICATION FRAMEWORKS FOR USER AUTHENTICATION

The risk level of a specific service reflects the potential negative impact in case of wrong authentication. The required authentication assurance level shall balance that risk, meaning that as the risk of wrong authentication gets higher, the required authentication assurance level must be higher too. Authentication frameworks typically specify authentication assurance levels according to this principle.

There exists several frameworks for user authentication in public sector online service provision. These frameworks typically specify four or five UAALs (User Authentication Assurance Levels), i.e. from UAAL-1 (or UAAL-0) to UAAL-4, where a high number indicates a high assurance level, and AAL-0 indicates "No authentication". The requirements for each AAL is roughly harmonized across the various national or regional frameworks although there can be minor differences in terminology interpretation.

We briefly review the national/regional frameworks from USA, EU, Norway, Australia and India for user authentication. Although the authentication frameworks are specified for, and aimed at online service provision in the public sector, they are also suitable for the private and commercial sector.

• US NIST SP800-63. Title: Electronic Authentication Guideline [START_REF] Burr | Electronic Authentication Guideline -NIST Special Publication[END_REF]. This framework describes technical requirements for user authentication assurance levels that are specified in the E-Authentication Guidance for U.S. Federal Agencies [START_REF] Bolten | E-Authentication Guidance for Federal Agencies -Memorandum to the Heads of All Departments and Agencies (M-04-04)[END_REF]. . This framework is well structured and quite comprehensive. NeAF adopts the authentication assurance levels of Queensland Government Authentication Framework (QGAF) [START_REF]Queensland Government Authentication Framework (QGAF)[END_REF] which explicitly includes UAAL-0 aimed at anonymous access as well as pseudonymous user authentication. • Indian NeAF. Title: National e-Authentication Framework [START_REF]National e-Authentication Framework (NeAF)[END_REF]. This framework by the Indian Government is currently published as a draft. It represents an important companion for the Indian UID (Unique Identity) project and the biometric authentication program [START_REF] Bhavan | Biometrics Design Standards For UID Applications[END_REF]. It includes UAAL-0 similarly to the earlier Australian NeAF.

The assurance level alignment of the above referenced authentication frameworks is illustrated in Table I below. It can be seen that there is a general consensus regarding the levels, although some of the frameworks use specific terms differently, such as "High", "Very High" and "Substantial". For example, the assurance level USA-NIST "Very High" is equal to Australia-NeAF "High", and "Substantial" has a different meaning in EU-IDABC and India-NeAF. This might be a source of confusion, so that practitioners who need to map the authentication assurance levels of systems between e.g. USA and Australia, or between EU and India should be aware of the meaning behind the terms used in the respective frameworks. In order to minimize confusion it is advised to simply specify the user authentication levels by their number, e.g. use UAAL-4 instead of e.g Very High (USA-NIST) or High (Australia-NeAF).

The user authentication frameworks listed in Table I describe various factors that contribute to the robustness of the overall user authentication solution, as illustrated in Fig. 3 below, where the rounded rectangles represent basic factors and the sharp rectangles represent derived factors. The terms used to describe each factor are generic for the purpose of this

Authentication Framework User Authentication Assurance Levels

NIST (USA) 2006

Little or no assurance

Very High ( 4)

IDABC (EU) 2007

Minimal

FANR (Norway) 2008

Little or no assurance

High ( 4)

NeAF (Australia) 2009

None (

NeAF (India) 2011 The basic authentication factors indicated as rounded rectangles in Fig. 3 are briefly described below.

None (0) Minimal (1) Minor (2) Significant (3) Substantial (4)
• User Authentication Method Strength (UAMS) refers to the intrinsic robustness of the specific solution used for authentication, such as password based, token based or biometrics based authentication, as well as any combination of these to form 2-factor solutions.

• User Credential Management Assurance (UCMA)

refers to the the estimated reliability and security of creation, distribution, usage and storage of the authentication credentials such as passwords, tokens and biometric profiles.

• User Identity Registration Assurance (UIRA) refers to the thoroughness of the process for enrolling new entities that are to be authenticated by the system. In case an entity is to be registered with identity attributes from other identity domains, such as name and postal address, then the registration strength will depend on the correctness of these attributes when they are imported.

Fig. 3 illustrates a general set of authentication factors and their relationships. Some of the frameworks of Table I above only cover a subset of these authentication factors. This is the case for the Norwegian FANR where user identity registration assurance (UIRA) is ignored because the correct registration of citizens is assumed as a prerequisite, in which case UAAL = UAMA.

The derived properties indicated as straight rectangles in Fig. 3 User Authentication frameworks typically define scheme for determining the UAAL as a function of the basic authentication assurance factors. For example, Fig. 4 illustrates a look-up matrix for deriving User Authentication Method Assurance (UAMA) as a function User Authentication Method Strength (UAMS) and User Credential Management Assurance (UCMA).

Low (2)

Moderate

(3) High ( 4) Similarly, For example, Fig. 5 illustrates a look-up matrix for deriving the final User Authentication Assurance Level (UAAL) as a function User Authentication Method Assurance (UAMA) and User Identity Registration Assurance (UIRA).

High (4) Low (2) Moderate (3) Moderate (3) High (4) Low (2) Low (2) Moderate (3) Moderate (3) Minimal (1) Low (2) Low (2) Low (2

III. MOTIVATION FOR SERVICE PROVIDER AUTHENTICATION ASSURANCE

TLS [START_REF] Dierks | RFC 5246 -The Transport Layer Security (TLS) Protocol Version 1[END_REF] provides cryptographically strong server authenticated in a technical sense. Unfortunately, typical implementations of TLS do not provide semantic server authentication because they only support server system authentication by the client system, and not by the user. In order to provide meaningful server authentication a method that explicitly allows the user to authenticate the server system or the SP organisation is needed. The difference between server authentication by the client and server authentication by the user, which can be seen in Fig. 1, might seem subtle and insignificant, but is nevertheless absolutely crucial. The problem is not due to weak cryptographic authentication mechanisms, but to poor usability of the typical TLS implementation [START_REF] Jøsang | Security Usability Principles for Vulnerability Analysis and Risk Assessment[END_REF], [START_REF] Jøsang | Trust Extortion on the Internet[END_REF]. By analysing the security solution of TLS from a security usability perspective it can easily be seen that there are serious usability vulnerabilities that can easily be exploited by phishing attacks [START_REF] Jøsang | Web Security: The Emperors New Armour[END_REF], [START_REF] Jøsang | Security Usability Principles for Vulnerability Analysis and Risk Assessment[END_REF]. This is briefly explained below.

The standard implementation of TLS in web browsers provides various information elements to the user. Unfortunately this information is often sufficient to make an informed conclusion about the identity of the web server.

The closed padlock in the corner of a typical browser represents one form of security information elements indicating that the web session is protected with TLS. However, the fact that it does not say anything about the identity of the server is a security usability vulnerability.

Additional security information is contained in the server certificate that can be inspected e.g. by double-clicking on the padlock. The mental load of analysing the content of a server certificate is intolerable for most people, which represents a security usability vulnerability. The following analysis will make this evident.

For example, even the definition of peer entity authentication according to X.800 [START_REF]Recommendation X.800, Security Architecture for Open Systems Interconnection for CCITT Applications[END_REF] is inadequate in the case of phishing attacks, where the attackers actually claims its own identity in the formalism of TLS, and the TLS client (the browser) simply verifies the correctness of that claim. However, the claimed identity expressed in the certificate does not necessarily correspond to the identity that the user assumes. Thus, the problem has to do with human cognition of identity, for which cryptography provides no solution.

The identity of a SP organisation assumed by the user can be different from the identity validated through TLS. From the user's perspective, the ordinary name and graphical logo of the SP organisation constitutes a significant part of the SP identity. From the client browser's perspective, this identity cannot be used by TLS because normal names can be ambiguous and graphical logos can not be interpreted by TLS.

Certificates, which must be unambiguous, require globally unique names in order to allow efficient automated processing. Domain names mostly satisfy this requirement and have therefore been chosen to represent the identity of the bank in server certificates. Having different identities for the same entity can obviously cause problems. A simple way of solving this problem could be by requiring that users learn to identify online SP organisations by their domain names. Unfortunately this will not work because online banks often use multiple domain names depending on the service being offered.

Many companies' secure web sites have domain names with non-obvious domain names that do not correspond to the domain names of their main web sites. Another vulnerability is the fact that distinct domain names can appear very similar, for example differing only by a single letter, or looking very similar, so that a false domain name may pass undetected. How easy is it for example to distinguish between the following domain names? www.pepes.com/ www.pepespizza.com/ www.pepesnypizza.com/ www.pepespizzeria.com/.

The fundamental problem is that, although domain names are designed to be readable by humans, they provide poor usability for identifying organisations in the real world. Ordinary names such as "Pepe's Pizza", when expressed in a local semantic context, are suitable for dealing with organisations in the real world, but not for global online identification and authentication. The consequence of this mismatch between names used in the online world and in the real world is that users do not know which unique domain name to expect when accessing online services. Without knowing which domain name to expect, authentication becomes meaningless. In other words, the users do not know what security conclusion to draw.

Another problem with the current implementation of TLS is its dependence on the browser PKI that has a relatively large number of CAs (Certificate Authorities), that in fact create a "weakest link" situation. Several authors describe the problems with the browser PKI [START_REF] Hayes | The problem with multiple roots in web browserscertificate masquerading[END_REF], [START_REF] Jøsang | Server Certificates based on DNSSEC[END_REF], [START_REF] Soghoian | Certified lies: Detecting and defeating government interception attacks against ssl (short paper)[END_REF]. The specific problem is that any CA can sign any certificate they want. For instance two different CAs can sign a certificate for example.com, and as long as both CAs has their root certificate in the web browsers they will be evaluated as valid. This is problematic when a CAs private key is falling into wrong hands or a CA is issuing a certificate to someone that do not have the right to it. There have been examples of both; [START_REF] Keizer | Computerworld: DigiNotar dies from certificate hack caper[END_REF] and [START_REF]Erroneous VeriSign-Issued Digital Certificates Pose Spoofing Hazard[END_REF]. The problem is mostly how the SSL PKI is built up, and not with the technology itself.

In summary, our analysis of current server authentication has exposed serious vulnerabilities that continue to be exploited by criminals to mount successful phishing attacks. A framework for server authentication assurance is needed to address these vulnerabilities.

IV. PROPOSED FRAMEWORK FOR SERVER AUTHENTICATION

The existing authentication frameworks listed in Table I do not specifically focus on how users can make sure that an accessed online service actually is hosted by the correct and intended SP organisation. The draft Indian NeAF describes a method based on a"watermarks" [START_REF]National e-Authentication Framework (NeAF)[END_REF], whereby the user selects an image and/or text during registration to a SP. When the user accesses the SP with their use name the next time, then the server of the SP shows the image and text (if it exists), which gives the user a way to confirm that this is the previously accessed SP before the user enters their password.

Research into the usability of such a system has shown that most users do not react if the "watermark" is replaced with a text describing that the service is undergoing an upgrade, and will enter their password anyway [START_REF] Schechter | The emperor's new security indicators[END_REF]. With todays web capabilities it is not a far stretch to imagine this image to be extracted by some kind of proxy server, and delivered to the user by a malicious website.

The US NIST SP800-63 also have similar examples of personalization measures to be implemented by the services. They also mention that there is no foolproof way to prevent the user (Claimant) from revealing any sensitive information to which he or she has access [START_REF] Burr | Electronic Authentication Guideline -NIST Special Publication[END_REF].

Because these documents focus on server side solutions, they are missing important points, which are the authentication of the server by the user. The frameworks propose applying simple methods for the user to authenticate the server and try to highlight some "best practices", at the same time pushing the technology for the user authentication to its limit. However, a specif framework for server authentication assurance would have to specify a more complete set of methods and principles for server authentication.

A. Technologies in Support of Server Authentication

DNSSEC is a solution to ensure that the domain name given by the domain name system (DNS) is not modified to send a user to another place then originally intended by the owner of the domain name. DNSSEC builds on asymmetric cryptographic signing of DNS records in the name servers [START_REF] Ateniese | A new approach to dns security (dnssec)[END_REF]. This is a strong hierarchical public key infrastructure, where the root-key is managed by The Internet Corporation For Assigned Names and Numbers (ICANN) [START_REF] Abley | DNSSEC Trust Anchor Publication for the Root Zone[END_REF]. ICANN also manage the root-servers for all top level domain names. DNSSEC (if checked by the user or its client) makes it hard for an attacker to make false DNS records and misleading a client system to a wrong server [START_REF] Arends | RFC 4033 -DNS Security Introduction and Requirements[END_REF]. If there had been a requirement to use DNSSEC then all the major browsers would have supported DNSSEC much faster.

A petname system is a set of personalized nicknames for the services the user is using. [START_REF] Sadek Ferdous | Security Usability of Petname Systems[END_REF] describes The Petname Model as a naming system that can implement all three properties of Zooko's triangle; Global, Memorable and Unique. The service nickname (e.g. the domain name system) is global and memorable, and the petname is memorable and unique. This is a user centric system, managed fully by the user.

The TrustBar [START_REF] Herzberg | Protecting (even Naïve) Web Users from Spoofing and Phishing Attacks[END_REF] for the Mozilla and Firefox browsers seems to represent a promising approach to the problem by making authentication semantically meaningful. The TrustBar solution consists of personalising every server certificate that the user wants to recognise by defining a personal petname for it [START_REF] Sadek Ferdous | Security Usability of Petname Systems[END_REF]. The petname can e.g. consist of an image or a audible tune that the user can easily recognise. Unfortunately solutions like the TrustBar are not widely used.

B. Factors for Server Authentication Assurance

It is important to involve the user when he or she registers to a new service, both to check if the place is correct and to show the user what to expect the next time. As most of the technical authentication processing is transparent, the users are easily deceived. It is therefore important to have solutions that allow users to understand the processes taking place during the authentication. As [START_REF] Schechter | The emperor's new security indicators[END_REF] pointed out, all 63 subjects who participated in an experiment entered user name and password even when TLS was not used, because they did not know the difference between the browser using TLS (as indicated by https) and not using TLS (as indicated by http).

Users have to understand how the security mechanisms work, not in detail, but have a general overview, and need to know and understand the required security actions and security conclusions [START_REF] Jøsang | Security Usability Principles for Vulnerability Analysis and Risk Assessment[END_REF]. The higher the authentication risk level, the more this understanding is required.

The three basic factors for user authentication assurance, as indicated in Fig. 3 does not cover the concept of identity cognition, because the authentication is executed by a system which simply applies syntactic identity recognition. However, for server authentication by humans it is necessary to introduce the basic factor ICA (Identity Cognition Assurance). Identity cognition by the human user consists of paying attention to the presented server identity, understanding its nature, and making a decision whether it is the expected or desired identity for the specific communication session. Similarly to the case of user authentication frameworks, for server authentication frameworks the basic factors SAMS (Server Authentication Method Strength), SCMA (Server Credential Management Assurance) and SIRA (Server Identity Registration Assurance) are also included, as indicated in Fig. 6 where where the rounded rectangles represent basic factors and the sharp rectangles represent derived factors.

The combination of the input factors SIRA and ICA result in the derived factor SIUA (Server Identity Usage Assurance), which when combined with SAMA results in the overall SAAL. The interpretation of the derived SIUA factor in in Fig. 6 is that the usage of the server identity in business processes is safe because the identity has been properly registered and because human operators clearly understand what it represents. The effect of introducing the basic ICA factor in Fig. 6 is to explicitly require that the human user take a conscious choice after having recognised the specific server identity with its unique name. High ICA is not needed in case of low SAAL. It is acceptable to have a low SAAL when it would have little consequence that the user misunderstands the server identity and accesses the wrong server without knowing it. However, the SAAL must be higher when the consequence of accessing the wrong server is more severe. This also forces the ICA to be higher, which puts stronger requirements on the authentication methods and their usability, so that that human users can be certain that they access the intended server.

The security of a service extends beyond the server system and SP domain, and should include all users enrolled into it. This is difficult to achieve when serving millions of users. The responsibility to educate the users on how to use the services with adequate identity cognition assurance lies with the SP, as the SP can not expect all their users to have this knowledge prior to enrollment. When planning a service there is always a trade-off between cost and security level, where ensuring ICA and educating users might be seen as a significant cost, but it may be worth the effort when the risk of wrong server authentication is high.

Instead of using a look-up matrix to combine the SAMA and SIUA, similarly to Fig. 4 and Fig. 5 we find it more appropriate to simply apply the principle of the weakest link, i.e. that for a specific required SAAL, all the input factors (SAMS, SCMA, SIRA, ICA) must have at least the same level as the SAAL. Another way to express the same principle is that the SAAL is dictated by the minimum level of SAMS, SCMA, SIRA and ICA as illustrated in Fig. 7.

C. Requirements for Server Authentication Assurance Levels

We believe that it would require a major study to specify in detail requirements for the four factors of server authentication assurance levels according to Fig. 6. The requirements we provide below must therefore be seen as indicative. First, the server authentication assurance levels with their corresponding relative risk levels are indicated.

Server Authentication Assurance Levels (SAAL)

• SAAL-1. Minimal server authentication assurance is required when wrong server authentication would have minimal or no negative impact for services in this level, and attackers have little incentive to spoof the server, e.g. because the user does not provide sensitive information to the SP. • SAAL-2. Low server authentication assurance is required when wrong server authentication would have some negative impact for services in this level, and attackers could have some incentive to spoof the server to mislead or steal user credentials or user information. • SAAL-3. Moderate server authentication assurance is required when wrong server authentication would have significant negative impact, and attackers could have strong financial or political incentive to spoof the server to mislead or steal user credentials or user information. • SAAL-4. High server authentication assurance is required when wrong server authentication would have severe negative impact for services in this level, and attackers could have strong financial or political incentive to spoof the server to mislead or steal user credentials or user information.

At this point in time there exist several different server authentication methods that can be used for the different assurance levels, some are not widely deployed although theoretical and implemented solutions exist. The list below is indicative for possible server authentication method strengths.

Requirements for Server Authentication Method Strength (SAMS)

1) SAMS-1. The server is identified by its domain name or IP address. Otherwise there are no specific requirements. 2) SAMS-2. It is sufficient to have a SSL/TLS connection with a valid SSL certificate. It must be possible to check if the certificate is valid, and to inspect the unique domain name of the SP. 3) SAMS-3. Server certificates based in DNSSEC is required in order to avoid the weakest link vulnerability of the browser PKI. DNSEC also ensures that results returned by DNS are authentic. Currently, DNSSEC is not widely implemented, and is not supported by all web browsers. 4) SAMS-4. The same requirements as for SAMS-3 above.

In addition, a petname system is required to support identity cognition for the SP identity and name.

The management of server authentication credentials is quite different from that of user authentication credentials. The list below is indicative for possible server credentials management assurance.

Requirements for Server Credentials Management Assurance (SCMA)

1) SCMA-1. No specific requirements.

2) SCMA-2. Online installation on the client systems of PKI root public keys used for server certificate validation. Private server keys can be stored in server memory with adequate protection. 3) SCMA-3. Online installation on the client system of the the DNSSEC PKI root public key used for server certificate validation. Private DNSSEC server keys can be stored in server memory with adequate protection. 4) SCMA-4. The same requirements as for SCMA-3 above, but the PKI root public key must be installed manually on client systems, and private server keys must be installed, stored and processed in trusted hardware. The registration of server identities is quite different from that of user identities. The list below is indicative for possible methods for achieving server identity registration assurance.

Requirements for Server Identity Registration Assurance (SIRA)

1) SIRA-1. No specific requirements. 2) SIRA-2. Representatives from SP organisations can obtain server certificates online by providing evidence of legally representing the specific SP organisation. 3) SIRA-3. Server certificates must be part of the DNSSEC PKI hierarchy, so that server certificates can be obtained from the DNS registrar only. Requirements for obtaining server certificates are the same as for obtaining a domain name. 4) SIRA-4. The same requirements as for SIRA-3 above, but representatives of SP organisation must present in person at DNS registrar. Proposed requirements for identity cognition assurance are given below. Requirements for Identity Cognition Assurance (ICA)

• ICA-1. No specific requirements.

• ICA-2. It is required that the authentication system enables to inspect the unique name of the authenticated server.

• ICA-3. It is required that the unique name of the server be mapped to a local petname specified by user. The petname must be unique within the local domain.

• ICA-4. Same requirements as for ICA-3 above. In addition it is required that the user explicitly specifies the server identity, either directly with the globally unique server name, or indirectly through the local server petname, in order to indicate the exact server identity that is expected in the communication.

V. C ONCLUDING REMARKS

The lack of focus on service provider authentication by the user is a blind spot in the academic and information industry security communities. The intention of this paper is to put the focus on the importance of ensuring adequate server authentication. We believe that it is timely to establish frameworks for server authentication in order to reflect and balance the existing frameworks for user authentication assurance.

An important question to ask is whether different user authentication and server authentication assurance levels will have consequences for the overall security in a session between a user and a server system. For example, assume that a user is required to use strong user authentication when accessing a network server, while at the same time being unable to authenticate the server identity. An obvious attack in this situation would be to trick the user to access a server controlled by the attacker, which could enable the attacker to collect user credentials which in turn could be used to masquerade as the user. It therefore seems reasonable to have a balance between UAAL and SAAL on online applications. Frameworks for user authentication and server authentication should therefore be considered in conjunctions, and we encourage national governments with programs for online service provision to consider frameworks for both user authentication as well as server authentication, and to consider their relationship and interdependencies.

Fig. 1 .

 1 Fig. 1. General entity authentication types

Fig. 3 .

 3 Fig. 3. Factors for user authentication assurance

Fig. 4 .

 4 Fig. 4.Look-up matrix for determining User Authentication Method Assurance (UAMA)

Fig. 5 .

 5 Fig. 5. Look-up matrix for determining User Authentication Assurance Level (UAAL)

Fig. 7 .

 7 Fig. 7. Determining Server Authentication Assurance Level (SAAL)

TABLE I CORRESPONDENCE

 I BETWEEN USER AUTHENTICATION ASSURANCE LEVELS IN AUTHENTICATION FRAMEWORKS study. Other specific terms are often used in the frameworks listed in TableI, but their interpretation is the same as that of the terms of Fig.3.

	User Authentication		User Credential
	Method Strength	+	Management Assurance
	(UAMS)			(UCMA)
	User Authentication	User Identity
	Method Assurance	+	Registration Assurance
		(UAMA)	(UIRA)
			User Authentication
			Assurance Level
				(UAAL)

  are briefly described below. User Authentication Assurance Level refers to the overall robustness of the user authentication solution. The UAAL results from the combination of User Authentication Method Assurance and User Identity Registration Assurance. In case it can be assumed that all users have been properly registered, the UAAL is equal to the User Authentication Mechanism Strength. For example, the Norwegian ANRF ignores identity registration of citizens, because it assumes that every citizen is properly registered in the national person register.

	• User Authentication Method Assurance (UAMA)
	refers to the combination of User Authentication Method
	Strength and User Credential Management Assurance.

•