Subject: [plasma] Plasma and File protection Question

From: Trevor Freeman <[email-masked]>
Date: Tue, 19 Apr 2011 21:19:07 +0000

Having agreed that files and are the conceptually the same as email from a policy access control perspective, there is one important distinction.

Email has a standard mechanism to define multiple parts of a message to represent different aspects of the message i.e. MIME.

We don't have that for files so we don't have a simple generic way to attach the extra metadata to a file.

Some standard file formats have specific extension mechanisms we can use e.g. OOXML which would allow you to define a way to attach the plasma metadata to the file type in question.

Alternatively there exist generic file container standards what can hold any combination of files and data e.g. OPC which would provide a generic solution for any file type.

If we were to expand files for consideration with Plasma, which would be the best first step, a specific solution like OOXML or a generic solution such as OPC?

Dr Trevor Freeman  Senior Security Strategist
End to End Trust Team<http://www.microsoft.com/mscorp/twc/endtoendtrust/default.mspx>
Microsoft Trustworthy Computing <http://www.microsoft.com/mscorp/twc/default.mspx>

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 19 Apr 2011 22:39:55 +0100

I've no idea what OPC is but I'd have thought that OOXML
would likely be controversial - or have all the word
processing types made up since the OOXML/ODF kerfuffle [1]
of a few years ago?

S.

[1] http://en.wikipedia.org/wiki/Office_Open_XML#Standardization_process

On 19/04/11 22:19, Trevor Freeman wrote:
> Having agreed that files and are the conceptually the same as email from
> a policy access control perspective, there is one important distinction.
> 
>  
> 
> Email has a standard mechanism to define multiple parts of a message to
> represent different aspects of the message i.e. MIME.
> 
>  
> 
> We don’t have that for files so we don’t have a simple generic way to
> attach the extra metadata to a file.
> 
>  
> 
> Some standard file formats have specific extension mechanisms we can use
> e.g. OOXML which would allow you to define a way to attach the plasma
> metadata to the file type in question.
> 
>  
> 
> Alternatively there exist generic file container standards what can hold
> any combination of files and data e.g. OPC which would provide a generic
> solution for any file type.
> 
>  
> 
> If we were to expand files for consideration with Plasma, which would be
> the best first step, a specific solution like OOXML or a generic
> solution such as OPC?
> 
>  
> 
> *Dr Trevor Freeman*  Senior Security Strategist
> 
> *End to End Trust Team
> <http://www.microsoft.com/mscorp/twc/endtoendtrust/default.mspx>*
> 
> *Microsoft Trustworthy
> Computing<http://www.microsoft.com/mscorp/twc/default.mspx>* 
> 
>  
> 
> 
> 
> _______________________________________________
> plasma mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/plasma

---

From: Trevor Freeman <[email-masked]>
Date: Tue, 19 Apr 2011 23:13:31 +0000

OPC = Open Packaging Convention; it's the official standard name for zip files.

The attraction of an OPC solution is you can protect anything just as you can zip anything so it would generate a universal solution.

Both OOXML and ODF are widely used standards with multi-vendor support.   The reason to cited them as examples is that they have a documented file format with extension points we could use to build a solution.

I doubt the OOXML\ODF thing will go away just like pkix has cmc and cmp:)

Would you consider OPC a more neutral solution?

-----Original Message-----
From: Stephen Farrell [mailto:[email-masked]]
Sent: Tuesday, April 19, 2011 2:40 PM
To: Trevor Freeman
Cc: [email-masked]
Subject: Re: [plasma] Plasma and File protection Question

I've no idea what OPC is but I'd have thought that OOXML would likely be controversial - or have all the word processing types made up since the OOXML/ODF kerfuffle [1] of a few years ago?

S.

On 19/04/11 22:19, Trevor Freeman wrote:

> Having agreed that files and are the conceptually the same as email

> from a policy access control perspective, there is one important distinction.

> Email has a standard mechanism to define multiple parts of a message

> to represent different aspects of the message i.e. MIME.

> We don't have that for files so we don't have a simple generic way to

> Some standard file formats have specific extension mechanisms we can

> use e.g. OOXML which would allow you to define a way to attach the

> plasma metadata to the file type in question.

> Alternatively there exist generic file container standards what can

> hold any combination of files and data e.g. OPC which would provide a

> generic solution for any file type.

> If we were to expand files for consideration with Plasma, which would

> be the best first step, a specific solution like OOXML or a generic

> [email-masked]<mailto:[email-masked]>

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 20 Apr 2011 00:29:25 +0100

Hi Trevor,

I don't have a real preference/opinion myself except that
a credible proposal here should have real support from
various sources, optimally including the open-source
community.

S.

On 20/04/11 00:13, Trevor Freeman wrote:
> OPC = Open Packaging Convention; it’s the official standard name for zip
> files.
> 
> The attraction of an OPC solution is you can protect anything just as
> you can zip anything so it would generate a universal solution.
> 
> Both OOXML and ODF are widely used standards with multi-vendor support.
>   The reason to cited them as examples is that they have a documented
> file format with extension points we could use to build a solution.
> 
> I doubt the OOXML\ODF thing will go away just like pkix has cmc and cmpJ
> 
> I've no idea what OPC is but I'd have thought that OOXML would likely be
> controversial - or have all the word processing types made up since the
> OOXML/ODF kerfuffle [1] of a few years ago?
> 
>  
> 
> S.
> 
>  
> 
>> [email-masked] <mailto:[email-masked]>
>

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 19 Apr 2011 20:14:24 -0400

OPC sounds like an appropriate container then.

On Tue, Apr 19, 2011 at 7:13 PM, Trevor Freeman <
[email-masked]> wrote:

> The attraction of an OPC solution is you can protect anything just as you
> can zip anything so it would generate a universal solution.
>
>
>
>   The reason to cited them as examples is that they have a documented file
> format with extension points we could use to build a solution.
>
>
>

-- 
Website: http://hallambaker.com/