RE: [TLS] Please discuss: draft-housley-evidence-extns-00

[Peter Williams <home_pw@xxxxxxx>]

> Why should we consider digital evidence a hard problem, a crypto protocol
> problem, a TLS problem? One crucial issue was raised by Steven Kent last
> year: the problem of the recording the signer's intent. Just to be clear,
> "signer's intent" problems include not only the challenge of recording
> something intangible, or the possibility that garbage data was signed, but
> also claims that the system that created the digital signature was subverted
> - or used with an intention to defraud. I'm a newcomer to this party, but I
> don't think any previous standard solves this problem (I don't count the NR
> bit as solving the problem). Let us know...

 
You have to be very careful in your crypto claims; NR has semantics limits. Its very 
easy to modulate the record length in TLS's fragmentation process to convey and recover 
certain cleartext signals communicated over the sideband of record lengths. 
 
Record length headers are not encrypted  normally in TLS, unless one has take specific 
precautions to tunnel one session output properly within the record layer of another, whose 
fragmentation engine and message queue handler blinds timing channels. Its  quite easy with 
telnet-s for example to use these covert channels to  signal actual patterns in the users typing 
behavior/errors, which are is characteristic of people (and their state of mind!) as is their use of 
a morse key.
 
And what precisely was the irrefutable intent established using crypto proofs, when
we contrast that with the sideband TLS evidence of their typing behaviour? asks competing 
counsel?
 
Ask a person who had to listen to morse, in their military communications careers. They
could tell what mood the person was in, after a while
 
!

---

Get free, personalized online radio with MSN Radio powered by Pandora. Try it!
_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls