RE: draft-turner-caclearanceconstraints-01.txt

["Santosh Chokhani" <[e-mail]>]

Differences in various policies are articulated using the security
policy OID in the clearance structure that has been accepted by the
Internet Standards Community.

In addition, clearance is a well defined mathematical concept and
formalized using lattice structure.  Within a security policy, Clearance
consists of a hierarchical sensitivity level and non-hierarchical
category set.  Two clearances within a security can be ordered or can be
incomparable based on simple and well-defines mathematical rules.

People in other parts of IETF are using these concepts to label the data
and make information flow decisions.

Some pioneering work has been done in the technical community (albeit
not exposed to the IETF) in the area of comparing clearances of two
security policies.

-----Original Message-----
From: [e-mail] [mailto:[e-mail]]
On Behalf Of Timothy J. Miller
Sent: Monday, October 13, 2008 10:03 AM
To: Carl Wallace
Cc: [e-mail]
Subject: Re: draft-turner-caclearanceconstraints-01.txt

Carl Wallace wrote:
> I vote yes to adopting this as a PKIX work item.  Specification
details 
> can be resolved after the draft is accepted as a working group draft.

Can we even say for certain that clearance is a consistent enough 
concept within and across jurisdictions to enable a single logic for 
constraint processing?  I'd argue not.

E.g., RFC3281 talks about "the" basic clearance hierarchy, which doesn't

even exist.  What's the relationship between NATO CONFIDENTIAL and US 
UNCLASSIFIED CONTROLLED INFORMATION?  How about US UCI and US FOR 
OFFICIAL USE ONLY?  US SECRET/NOFOREIGN?  US TS/SCI and TS/SAP?  And 
that's without even getting into the obscure corners of the US alone.

What I'm trying to say is that classification is *not* a strict 
hierarchy.  It's semi-structured.  We have trouble enough figuring this 
stuff out in the real world without having to write code for it.  :)

Presuming I have a vote, I vote no.

-- Tim