Re: [TLS] Please discuss: draft-housley-evidence-extns-00<

Benjamin Black wrote:
> 
> section 6.2 doesn't nearly address the problem in the abstract, much
> less give enough information to determine whether a specific
> implementation would or would not be deemed compliant with PCIDSS.  as
> just one specific example, 6.2 gives no guidance whatsoever on access
> control and auditing, both of which would prove especially challenging
> (do you monitor access to byte ranges?  do you index the streams before
> encryption so that semantically meaningful byte ranges are properly
> monitored?  how do you even enforce access policies when someone can
> access one byte range but not another when the whole stream is
> encrypted?  the complexity seems to be going up rapidly...).

This is what I meant with "distributing an egg on every access".

If TLS Evidence is used as described in a multi-level security environment,
the "wire-tap" data will likely have to carry the highest security label
that is permitted to travel the TLS-Endpoint, because of the braindead
raw capture approach that is entirely blind to the meta-data of the
communication contents.  It could re-use the labelling from the peers
certificate (policies), but it might still inflate the amount of data
with high security labelling.  The only positive side-effect might
be some extra jobs for IT tech guys with high security clearance
that are unlikely to be outsourced/off-shored. :-D

-Martin

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls