Subject: Re: [perpass] Few things the IETF might standardize for secure collaboration

From: Dean Willis <[email-masked]>
Date: Mon, 4 Nov 2013 15:20:01 -0600

One thing you don't elaborate is reduction of the metadata attack surface
by reducing the amount of exposed metadata. In a messaging model, the only
thing that needs to be exposed "to the cloud" is the destination locator,
and possibly a random-ish (perhaps a hash of the content) message tag. See
the Crowcroft SNA idea previously referenced on this list.

Note that one can certainly envision an onion-routing model here that could
further obfuscate peer linkages "within the cloud". Especially with
randomized timing.
 On Oct 20, 2013 5:57 PM, "Cullen Jennings" <[email-masked]> wrote:

>
> I've been thinking about how to build cloud collaborations systems where
> the data is encrypted and the cloud does not have the keys. Very interested
> in hearing others thoughts on how to do this.
>
> Near the end is a list of things that it would be helpful if the IETF
> standardized.
>
> http://www.ietf.org/id/draft-jennings-perpass-secure-rai-cloud-00.pdf
>
> Cullen
>
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass
>

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 5 Nov 2013 09:13:40 -0800

agree - I'd like to get a better list about metadata, what is needed, how to handle it etc … 

On Nov 4, 2013, at 1:20 PM, Dean Willis <[email-masked]> wrote:

> One thing you don't elaborate is reduction of the metadata attack surface by reducing the amount of exposed metadata. In a messaging model, the only thing that needs to be exposed "to the cloud" is the destination locator, and possibly a random-ish (perhaps a hash of the content) message tag. See the Crowcroft SNA idea previously referenced on this list.
> 
> Note that one can certainly envision an onion-routing model here that could further obfuscate peer linkages "within the cloud". Especially with randomized timing.
> I've been thinking about how to build cloud collaborations systems where the data is encrypted and the cloud does not have the keys. Very interested in hearing others thoughts on how to do this.
> 
> Near the end is a list of things that it would be helpful if the IETF standardized.
>