RE: draft-turner-caclearanceconstraints-01.txt

["Santosh Chokhani" <[e-mail]>]

Tim,

An example of ANY is Algorithm Identifier which appears in Signature,
SIGNED MACRO, and SPKI.

So, there is a precedence for it.

I was hoping to define 2-3 specific structures: An existing one in use;
one we all agree on if this I-D is adopted as work item; and an optional
one that may be useful to what folks ate doing for NFS.  2 and 3 could
be combined. 

For deprecation approaches, see my post from Thursday October 23 from a
strand on this thread.

-----Original Message-----
From: Timothy J. Miller [mailto:[e-mail]] 
Sent: Friday, October 24, 2008 11:11 AM
To: Santosh Chokhani
Cc: [e-mail]
Subject: Re: draft-turner-caclearanceconstraints-01.txt

Santosh Chokhani wrote:

> As stated in other strands of this thread, this will be handled by
> enhancing the I-D for a specific set of syntaxes of security
categories
> or by deprecating the security categories from the clearance
> constraints.  The latter can obviate the need for taking the
> intersection of security categories.

IMHO, picking a couple of examples for category intersection doesn't 
solve the problem for coders, and might well be taken as implying that 
the examples are the only possibilities.

If these are the two options then I'd vote for going beyond deprecation 
and define clearance constraints *only* for sensitivity.  The constraint

algorithm then becomes the much simpler task of finding the minimum 
value of classList in the chain.

-- Tim