[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [TLS] Please discuss: draft-housley-evidence-extns-00<
On Wed, 10 Jan 2007 21:32:15 +0100 (MET)
Martin Rex <martin.rex@xxxxxxx> wrote:
>
> There is absolutely NONE, ZERO, NIL chance that this can be used
> in customer<->business relationsships in the European Union, because
> it is incompatible with the EU data protection directive in many ways.
>
The Danvers doctrine, RFC 1984, and RFC 2804 cut both ways -- the
IETF's protocols are supposed to be based on technical merit, not
political-layer decisions. It's quite inconsistent to oppose this
because it conflicts with one government-layer policy while not
opposing, say, unescrowed strong crypto because that conflicted with a
different government-layer policy. (Please read my publication list
before accusing me of being a stooge for the NSA...) There are two
questions: does the proposal have technical merit, and is there enough
"market" demand that it's worth the IETF's time. (I think your
specific claim could be argued both ways, but in the spirit of what I
just said I won't address that issue.)
I would have liked a longer -- a much longer -- discussion in the
draft of how this facility might be used. For example, I don't see it
as particularly useful for https unless and until there are html-level
tags that specify when evidence creation should be used. Perhaps the
values being uploaded could be surrounded by <evidence>...</evidence>
tags? Many people on this list have mentioned the issue of the poor
coupling between TLS and application-level semantics; I would like to
see suggestions of how to do it. Without that, it's hard to assess
either the correctness or the need for this protocol.
--Steve Bellovin, http://www.cs.columbia.edu/~smb
_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls