HTTPs

["Jordan, Bret" <bret.jordan@bluecoat.com>]

I am going to propose that TAXII 2.x does NOT allow non-encrypted communications and propose that that text be removed form the pre-draft specs..  

We asked for feedback on this issue several weeks ago, and have yet to hear anyone suggest a reason why TAXII 2.x needs to support non-encyprted HTTPs sessions (aka null ciphers)

If you believe TAXII 2.x should support non-encrypted sessions, please speak up and give us your use-cases. 

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail