RE: [TLS] Please discuss: draft-housley-evidence-extns-00<

[Stefan Santesson <stefans@xxxxxxxxxxxxx>]

I think we can clearly separate the issue of information sharing from an ID authentication technology from this draft dealing with capturing and signing information shared between two parties.

The relevant issue your raise is if the capturing of data from lower communication layers and storing them as part of a signed audit record can be problematic from a user integrity perspective. I think you have made strong arguments that it can.

I'm still trying to figure out exactly how big of a problem this is but this might very well be the reason why this proposal is a bad idea.

Stefan Santesson
Senior Program Manager
Windows Security, Standards


> -----Original Message-----
> From: home_pw@xxxxxxx [mailto:home_pw@xxxxxxx]
> Sent: den 11 januari 2007 16:10
> To: Stefan Santesson; martin.rex@xxxxxxx
> Cc: tls@xxxxxxxx
> Subject: Re: [TLS] Please discuss: draft-housley-evidence-extns-00<
>
> Stefan:
>
> http://europa.eu/rapid/pressReleasesAction.do?reference=IP/03/151&forma
> t=HTML&aged=0&language=EN&guiLanguage=en
>
>
> ----- Original Message -----
> From: "Stefan Santesson" <stefans@xxxxxxxxxxxxx>
> To: <martin.rex@xxxxxxx>
> Cc: <tls@xxxxxxxx>
> Sent: Thursday, January 11, 2007 2:54 PM
> Subject: RE: [TLS] Please discuss:
> draft-housley-evidence-extns-00<
>
> Martin,
>
> Thank you for your elaborate answer and references.
> It would not surprise me though if Germany in this area is
> more radical than other EU countries, but that does not make
> your argument invalid.
>
>
> Stefan Santesson
> Senior Program Manager
> Windows Security, Standards
>
>


_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls