Profile

Completely the right decision. Fully support this proposal. Thanks, Adam On Monday, 26 September 2016, Trey Darley wrote: Hi, everybody - Given that there was overwhelming consensus with the proposal that was presented during last week's TC calls to merge CybOX into STIX, the next step is to open a ...

Signed not encrypted. It's integrity that I'm talking about not confidentiality. As for developers - just don't sign in dev. I've been doing this in SAML dev for years without issue. On 22 February 2016 at 12:48, John Anderson wrote: Signed messages + enforced encryption? That's even more load on development. ...

As a further thought on the data integrity theme - HTTPS / TSL is arguably not strong enough anyway and we should also consider cryptographically signing messages negating as well as protecting the transport layer. On 22 February 2016 at 09:13, Adam Cooper wrote: Hi all, I have to agree with Brett ...

Hi all, I have to agree with Brett that data integrity must be a major concern and should be catered for in the spec. To avoid naming specifics like HTTPS, TLS version, algorithms etc, we could consider an outcome based description of the requirement for data integrity allowing. As an alternative we ...

Which is exactly why I said: "TLS 1.2 or higher". The standard sets the baseline not the limit. I would also say that nothing should ever be expected to last forever. With that in mind we set the best available baseline now ie TLS 1.2. On Wednesday, 16 December 2015, Jason Keirstead wrote: Just want ...