Subject: RE: [Isms] Tmsm#4: persistent session info

From: "David Harrington" <[email-masked]>
Date: Sun, 4 Mar 2007 20:31:44 -0500

Added the following:
"Note that keeping security sensitive information longer then
necessary might introduce potential vulnerabilities to an
implementation."

Is that acceptable?

dbh

> -----Original Message-----
> From: Wes Hardaker [mailto:[email-masked]] 
> Sent: Tuesday, February 27, 2007 1:21 PM
> To: David Harrington
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Isms] Tmsm#4: persistent session info
> 
> >>>>> "DH" == David Harrington <[email-masked]> writes:
> 
> DH> I believe the complaint is that we specified the state 
> was released
> DH> when the session is closed; this should be an 
> implementation decision,
> DH> since all release handling is implementation-specific.
> 
> I'd suggest you word in a way it such that the following happens:
> 
> 1) some state MUST be zeroized and freed immediately for security
>    reasons (keys).
> 2) other state MAY be kept around by the implementation or 
> released immediately.
> 
> -- 
> Wes Hardaker
> Sparta, Inc.
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms