RE: [TLS] Please discuss: draft-housley-evidence-extns-00 (resend)

Be that as it may, the question in my mind remains: why?

The first three times I read the SBIR proposal and its references to "a
router that can

securely enable granular cross-domain messaging" I interpreted "router"
in its IETF

sense - a layer 3 device that routes IP packets.  But such a device
would have no

access to information protected at layer 3 (IPSec), layer 4 (TLS), or
above, and thus

would provide no motivation for TLS Authorizations within data plane
(RSS producer

to RSS consumer) sessions.  The abstract also does not appear to discuss

management plane (management station to router) traffic, so the only
possibility left

is control plane (router to router) traffic for which the routers act as
TLS endpoints.

But a combined IP router / RSS proxy-cross-domain-guard makes about as
much

sense as a combined IP router / message transfer agent (MTA) for SMTP,
so it

becomes apparent that the "router" is not a layer 3 device, it must be
an

application-layer process that routes RSS messages, and thus does not
control the

flow of IP packets to effect TNI-style network partitioning.

Before accepting the SBIR proposal as justification for a new TLS work
item (which

may well be justified for different reasons), it would be helpful to
understand what a MILS

platform with TLS Evidence brings to the table that couldn't be more
easily accomplished

using the same MILS platform with unmodified TLS: passing RSS summaries
signed with

CMS or xml-dsig through a standard TLS or TCP-only data stream.

Dave

  _____  

From: Peter Williams [mailto:home_pw@msn.com] 

Marc's research is, in Peter's analysis, founded on NCSC Red Book
doctrine ...

<...>

-----Original Message-----
From: Mark Brown [mailto:mark@redphonesecurity.com] 

> I am working on a router project

> that uses TLS Evidence and Authorizations at the TLS level only:

> 

> http://www.navysbir.com/06_1/215.htm