Subject: Re: Policy in IETF APIs (was: Standards and APIs)

From: Jeff Hodges <[email-masked]>
Date: Tue, 14 Dec 1999 15:03:28 -0800

Paul Leach wrote:
> What you are saying is that security is to be left to (non-existent) upper
> layers. That means it won't be secure. All experience in this area supports
> that contention. One of the most elementary security rules is that security
> can not be left to applications.

I'm not necessarily challenging this assertion, but I am curious as to whether you have
citations/references handy that support it (esspecially the last sentence). 

thanks,

JeffH

---

From: "Paul Leach (Exchange)" <[email-masked]>
Date: Mon, 20 Dec 1999 18:11:54 -0800

> -----Original Message-----
> From: Jeff Hodges [mailto:[email-masked]]
> Sent: Tuesday, December 14, 1999 3:03 PM
> To: IETF LDAP Extensions WG
> Subject: Re: Policy in IETF APIs (was: Standards and APIs)
> 
> 
> Paul Leach wrote:

How about the Orange Book. It demands that there be an unbypassable
reference monitor that checks all references to make sure that the are
allowed by security policy.

Also, I think papers on security in Multics, by Dennis or Saltzer, from the
late 60's or early 70's; perhaps available in the Organick book on Multics.
They discuss security flaws in systems that preceded Multics that motivated
the Multics design.

Paul