|
Meadhbh, A major use case that's lacking in the standards you mention is support
for security domain separation. In high assurance environments, a crypto device
typically separates two security domains (protected & unprotected),
performing cryptographic operations at the boundary. The existing standards
operate within a single domain-- they enable a crypto device to accept data to
be cryptographically transformed and return the results directly to the caller
who initiated the operation. This type of high assurance use case is common with diplomatic
and military communications and shows opportunity in sensitive commercial
enterprises like banking, as well. Specialized cryptographic hardware designed
specifically for these types of environments is available. So, we're not
talking about tokens or smart cards, although potential solutions (like the one
we've proposed) can accommodate those use cases as well. Nonetheless, you'd
probably be better off using something like Cryptoki for those situations. For an introduction to this problem domain, see section 1.4 in
our Internet-Draft: http://tools.ietf.org/html/draft-lanz-cicm-00#section-1.4 If you're interested, but can't attend the bar BoF, you can
still participate via the mailing list: https://www.ietf.org/mailman/listinfo/cicm Regards, Lev From: Meadhbh Hamrick [mailto:ohmeadhbh@xxxxxxxxx]
It's going to be tough for me to attend, but I
would love to hear why cryptoki, pc/sc or cdsa don't work for your use cases.
Also, are you talking about a specific kind of token? Soft tokens? 4758s?
NCipher boxen? Smart cards? Is there a resource on the web describing the
problem domain, or is this an informal meeting to discuss problems with
existing solutions or new use cases? -cheers
|
_______________________________________________ Ietf mailing list Ietf@xxxxxxxx https://www.ietf.org/mailman/listinfo/ietf