Re: [cti-stix] STIX 2.1 discussion

Picking up on this thread late, of course, but this sort of argument applies to everything and nothing.

Whenever STIX data is transmitted from one entity to another, it is always between authenticated entities, on a cryptographically secure link providing both authentication, integrity, and confidentiality - one hopes.

While a mis-trusted peer entity could supply you with bogus confidence objects, it can also suppress actual confidence in existing information, too - which can be just as disruptive, if not more so. It can strip out the information itself, of course. And in both cases, this can be a valid thing to do.

So digital signatures add, at best, a mechanism for assuring information that the peer has already decided to pass onto you.

One valid reason for stripping the signature (and perhaps re-signing) is to protect the identities involved. Repeatedly, we've found that assured anonymity is a vital part of ensuring that a community's confidence in sharing information safely remains high.

While all this is not to say that digital signatures aren't a worthwhile goal, I do repeat - they're far from a panacea, and introduce issues of their own.

(On a more pragmatic nature, digital signatures are easy - JOSE and done - the tricky part is key distribution and authentication without introducing a second secured path).

On 22 Aug 2016 17:54, "Jordan, Bret" <bret.jordan@bluecoat.com> wrote:

Confidence does not really make sense before we have digital signatures, neither does the opinion object.. Without digital signatures first, there is no "real" confidence or opinion as everything could be faked.

Thanks,

Bret

Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

On Aug 22, 2016, at 01:34, Trey Darley <trey@kingfisherops.com> wrote:

On 20.08.2016 08:22:15, Terry MacDonald wrote:
My wish list for 2.1:

+1 for Terry's list of STIX 2.1/2.2 priorities

--
Cheers,
Trey
++--------------------------------------------------------------------------++
Kingfisher Operations, sprl
gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4 5B9B B30D DD6E 62C8 6C1D
++--------------------------------------------------------------------------++
--
"All systems, regardless of composition, do one of three things: blow
up, oscillate, or stay about the same." --anonymous

cti-stix message