Subject: Re: [sacm] [sacmwg/draft-ietf-sacm-information-model] Define a Providence/Chain of Custody Information Module (#8)

From: Danny Haynes <[email-masked]>
Date: Thu, 03 Nov 2016 10:47:53 -0700

Hi Jim, 

Do you think the SACM Statement Metadata, Content-Element Metadata, and Event elements support this with the understanding that we still need to pick mandatory-to-implement elements that go in these constructs, but, that an implementer can extend them to support additional elements?

Thanks,

Danny

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/8#issuecomment-258220427

---

From: Danny Haynes <[email-masked]>
Date: Mon, 07 Nov 2016 08:11:02 -0800

Dave, I think you are correct.  However, I would just add that I think the WG does want to provide the information that enables provenance/chain-of-custody extensions/solutions.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/8#issuecomment-258879368

---

From: Jim Schaad <[email-masked]>
Date: Mon, 07 Nov 2016 13:39:46 -0800

I am not sure that I would be worried about the concept of chain-of-custody.  I don't know that it makes a great deal of difference to say that this attribute went from point A to point B to point C.  The exception would be if one was wondering why thing did or did not show up in a reasonable time.

I think that provenance is of much greater importance.  Consider the reporting of a binding between an IP address and a DNS name.  The following people could report it:  The DHCP server that did the assignment, the machine to which the address was reported or somebody who queried the DNS name at some location.  While the first two need to match, the last one does not need to and should not be treated with the same level of correctness depending on where that entity is relative to the subnet that contains the machine with the DNS name (think going through a NAT).  The fact that different people are reporting the same information needs to be clearly attached to the data.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/8#issuecomment-258971296