Subject: Re: [lamps] HP Issue: Protection Levels

From: Bernie Hoeneisen <[email-masked]>
Date: Wed, 14 Oct 2020 00:29:53 +0200 (CEST)

The latest (not yet published) section regarding protection levels reads 
as follows:

  3.2.  Protection Levels

  3.2.1.  In-Scope

    The following Protection Levels are in scope for this document:

    a) Signature and encryption

    Messages containing a cryptographic signature, which are also
    encrypted.

    b) Signature only

    Messages containing a cryptographic signature, but which are not
    encrypted.

  3.2.2.  Out-of-Scope

    Legacy implementations, implementations not (fully) compliant with
    this document or corner-cases may lead to further Protection Levels
    to pop up at the receiving side, such as (list not exhaustive):

    *  Triple wrap

    *  Encryption only

    *  Encryption before signature

    *  Signature and encryption, but:

       -  Signature fails to validate

       -  Signature validates but the signing certificate revoked

    *  Signature only, but:

       -  with multiple valid signatures, layered atop each other?

    These Protection Levels as well as any further Protection Levels not
    listed in Section 3.2.1 are beyond the scope of this document.

Any objections or suggestions to improve the text?

cheers
  Bernie

--

http://ucom.ch/
Modern Telephony Solutions and Tech Consulting for Internet Technology

On Wed, 30 Sep 2020, Russ Housley wrote:

> This matches my memory of the discussion.
>
> Russ
>
>
>> On Sep 30, 2020, at 4:04 PM, Bernie Hoeneisen <[email-masked]> wrote:
>>
>> Below a summary of the issue on 'Protection Levels'. If anybody wishes to discuss this topic further or does not agree with the conclusion, please speek up within the next 10 days!
>>
>> cheers,
>> Bernie
>>
>>
>> Text from slide:
>>
>> - Specification is targeted for
>>  - Signature and encryption
>>  - Signature only
>>
>> - Variations / corner-cases may pop up at receiving side, e.g.
>>  - Encryption only
>>  - Encryption before signature
>>  - Signature and encryption, but
>>    - Signature fails to validate
>>    - Signature validates but the signing certificate revoked
>>  - Signature only, but
>>    -  with multiple valid signatures, layered atop each other?
>>
>> - Which of those and to what extent do we need to document those?
>>
>>
>> Conclusion at IETF-108 (as I understood):
>>
>> - For the time being only specify cases (for sending and receiving side):
>>  - Signature and encryption
>>  - Signature only
>>
>> - Decide lateron whether or not to include more guiance on how to deal
>>  with (some of the) other cases on the receiving side.
>>
>> _______________________________________________
>> Spasm mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/spasm
>
>