Re: xml schema dateTime vs timestamp -> was -> RE: PIDF - using xml schema

At 02:26 PM 4/22/02 -0400, Derek Atkins wrote:
>Keep in mind that if you allow mixed case then you might have a
>security problem.  First, you may lose the original case of the
>message (thereby invalidating signatures).  Second, the question of
>whether the case is upper or lower could be used as a covert channel
>(albeit a two-bit channel) to leak information.

You only have a possible security (integrity/authentication) problem if 
applications try to diddle with the bits while keeping the same meaning.  I 
usually view signatures as applying to a sequence of bits rather than the 
abstract information thus encoded -- I think that's a pretty good match for 
the way non-digital signatures work:  one signs a paper rendering of a 
contract, not the words.  But I also acknowledge that CPIM has some special 
unusual goals in this respect, so case-consistency is important for CPIM.

I'm not greatly convinced that covert channels are a real problem here -- I 
think there'd be far greater opportunity to hide information in the low 
order seconds digit or fractional seconds digits.

#g

-------------------
Graham Klyne
<[email protected]>



  [reminder: [email protected] for non-technical discussions, please]