HTTPS

["Jordan, Bret" <bret.jordan@bluecoat.com>]

All,

Currently in the pre-draft document we have the following verbiage.

This specification defines requirements for using HTTPS; this specification does not define requirements for using non-encrypted HTTP. All TAXII compliant communications and interactions in TAXII 2 MUST use HTTPS. 

Question:

Do we need to add anything extra about specific types of HTTPS, TLS version, etc?  

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail