Subject: Security considerations in cap-08

From: Mark Davidson <[email-masked]>
Date: Fri, 05 Jul 2002 17:31:09 +0100

In the security considerations (section 13) of the new draft it says:

'Although service provisioning is a policy matter, at a minimum, all 
implementations must provide the following tuning profiles:'

I think the must in this line should be either a MUST or a SHOULD.

I would prefer if it was a SHOULD as some countries might have problems 
(legally) with specific security technologies.

So could the line be changed to:
'Although service provisioning is a policy matter, at a minimum, all 
implementations SHOULD provide the following tuning profiles:'

Mark Davidson

---

From: Doug Royer <[email-masked]>
Date: Fri, 05 Jul 2002 10:59:56 -0600

> implementations SHOULD provide the following tuning profiles:'

We must have a minimum set of authentication requirements or
we will not have interoperability. So the is section can only
be a MUST.

The correct thing to do is to make sure it is the correct
set of 'MUST'. In the past, Paul Hill took on this responsibility
and he consulted the security experts (for which I call him an
expert), and they concluded that DIGEST-MD5 was the correct
'MUST' to use for authentication. And I seem to recall that
they concluded that triple DES with SHA was also the correct
minimum for TLS and certificates.

Paul? - is this correct?

-Doug