[saag] NCSC Protocol Design Principles

[Andrew S2 <[e-mail]>]

Hi all,



NCSC published its Protocol Design Principles white paper this week: https://www.ncsc.gov.uk/whitepaper/protocol-design-principles<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ncsc.gov.uk%2Fwhitepaper%2Fprotocol-design-principles&data=04%7C01%7Candrew.s2%40ncsc.gov.uk%7C91b7c7673227437aa73408d896c3b33e%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C637425114548153843%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=gi5H2hKaBEcQtjLqFQ4ouqwS4ApPvL4g%2Bm3KBx2NE0Y%3D&reserved=0>. These principles have been written with the primary aim of helping protocol designers consider a range of issues relevant to security, but also to aid deployers and implementers in assessing protocols. The principles put user needs at the heart of the design process.



The paper outlines some of the major changes that have taken place with the internet over recent years, and outlines motivating goals for user security. In the context of these changes, and security goals, the paper defines three main principles:

1.                      Prioritise the use case

2.                      Keep it simple

3.                      Think about the bigger picture

Each of these includes detailed sub-principles that aim to help designers meet the motivating security goals in today's technology landscape.



Our goal of seeing protocols designed securely for the internet naturally has parallels with the IETF's work and, in particular, this white paper could be of interest to the IAB's model-t programme. The key first step in designing a protocol securely is, as we cover in the paper, to define the threat model it operates in.



We believe this paper will be of particular interest to those involved in model-t as well as the security area more widely.



We hope you find these principles useful, and we welcome any feedback, either by email to [e-mail]<mailto:[e-mail]> or via our GitHub page at https://github.com/ukncsc/protocol-design-principles<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fukncsc%2Fprotocol-design-principles&data=04%7C01%7Candrew.s2%40ncsc.gov.uk%7C91b7c7673227437aa73408d896c3b33e%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C637425114548163806%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=sWZZ0lSB0nYjnDQnwjLCxjQSqB5uP4daPNOvPNYFgc4%3D&reserved=0>.



Many thanks,

Andrew









This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [e-mail]. All material is UK Crown Copyright (c)