RE: [TLS] security levels for TLS

NIST has taken the "build it and they will come" approach to
projecting a multi-dimensional security space down to a few
coarse-granularity levels in
http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf.

There is merit in what W3C is attempting to do, but it's
questionable whether a consensus process with no benevolent
dictator can pull it off.  And the more quantization levels
one attempts to define in a security metric, the more difficult
the problem becomes.  If W3C took the SP800-63 approach and
tried to characterize just 3 or 4 levels (good/better/best,
red/yellow/green, Harvey balls, etc), they would have a chance
at producing something that would be truly useful for policy-driven
access enforcement.  Human enforcement, of course, is a lost
cause - how many people even look at the padlock in the first
place, much less would make distinctions based on its color?

Dave

-----Original Message-----
From: Paul Hoffman [mailto:paul.hoffman@vpnc.org] 
Sent: Tuesday, October 09, 2007 6:30 PM
To: Nikos Mavrogiannopoulos; tls@lists.ietf.org
Subject: Re: [TLS] security levels for TLS

Ekr's right: this is not a tractable problem. We could certainly come 
up with some numbers, but they would be meaningless (and therefore 
dangerous) with so much context that we might as well have just given 
the context by itself.

The fact that the W3C wants to wade into this swamp should not lead 
us there, other than to maybe offer them a rope back to the shore 
where they started.

--Paul Hoffman, Director
--VPN Consortium

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls