<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
@font-face
{font-family:"Helvetica Neue";}
@font-face
{font-family:"Microsoft Sans Serif";
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.xxmsonormal, li.xxmsonormal, div.xxmsonormal
{mso-style-name:x_xmsonormal;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.xxmsolistparagraph, li.xxmsolistparagraph, div.xxmsolistparagraph
{mso-style-name:x_xmsolistparagraph;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1084650579;
mso-list-type:hybrid;
mso-list-template-ids:-1491542410 -2091370234 134807577 134807579 134807567 134807577 134807579 134807567 134807577 134807579;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:59.5pt;
text-indent:-41.5pt;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">For Your Information especially since the SecWG has been interested in developing a secure software document.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Regards<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">howie<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">----------<o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-family:"Franklin Gothic Book",sans-serif"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Franklin Gothic Book",sans-serif">HOWARD WEISS</span></b><b><span style="font-size:9.0pt;font-family:"Franklin Gothic Book",sans-serif">,
</span></b><b><span style="font-size:8.0pt;font-family:"Franklin Gothic Book",sans-serif">CISSP<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Franklin Gothic Book",sans-serif">7110 Samuel Morse Dr, Suite 200<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Franklin Gothic Book",sans-serif">Columbia, MD 21046<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Franklin Gothic Book",sans-serif">howard.weiss@parsons.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Franklin Gothic Book",sans-serif">443-430-8089 (office) / 443-494-9087 (mobile)<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Helvetica Neue";color:#333333"><img width="250" height="55" style="width:2.6041in;height:.5729in" id="Picture_x0020_1" src="cid:image001.png@01D6C88C.58EE7ED0"></span><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> saag <saag-bounces@ietf.org> <b>On Behalf Of </b>
Andrew S2<br>
<b>Sent:</b> Wednesday, December 2, 2020 8:46 AM<br>
<b>To:</b> saag@ietf.org; model-t@iab.org<br>
<b>Subject:</b> [EXTERNAL] Re: [saag] NCSC Protocol Design Principles<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-GB">Apologies for the broken links, the links below should work correctly.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Andrew<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="mso-fareast-language:EN-GB">From:</span></b><span style="mso-fareast-language:EN-GB"> Andrew S2
<br>
<b>Sent:</b> 02 December 2020 13:42<br>
<b>To:</b> <a href="mailto:saag@ietf.org">saag@ietf.org</a>; <a href="mailto:model-t@iab.org">
model-t@iab.org</a><br>
<b>Subject:</b> NCSC Protocol Design Principles<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB">Hi all,<o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB">NCSC published its Protocol Design Principles white paper this week:
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ncsc.gov.uk_whitepaper_protocol-2Ddesign-2Dprinciples&d=DwMFAg&c=Nwf-pp4xtYRe0sCRVM8_LWH54joYF7EKmrYIdfxIq10&r=dT3K0y3n0RD9-56k-UVMPMP98PIQRd2Kzfa-AwqQOww&m=qnUiG-5l-0mOHJb9TgOay850sJlaQOTHdxPjpyJaOnM&s=Q0EJdegklqY_sE9Gu8GX-_MHx9Ymg8m93bVMQaAFGzc&e=">
https://www.ncsc.gov.uk/whitepaper/protocol-design-principles [ncsc.gov.uk]</a>. These principles have been written with the primary aim of helping protocol designers consider a range of issues relevant to security, but also to aid deployers and implementers
in assessing protocols. The principles put user needs at the heart of the design process.<o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB">The paper outlines some of the major changes that have taken place with the internet over recent years, and outlines motivating goals for user security. In the context of these changes, and security goals, the paper
defines three main principles:<o:p></o:p></span></p>
<p class="xxmsonormal" style="margin-left:59.5pt;text-indent:-41.5pt;mso-list:l0 level1 lfo2">
<![if !supportLists]><span lang="EN-GB"><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-GB">Prioritise the use case<o:p></o:p></span></p>
<p class="xxmsolistparagraph" style="margin-left:59.5pt;text-indent:-41.5pt;mso-list:l0 level1 lfo2">
<![if !supportLists]><span lang="EN-GB"><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-GB">Keep it simple<o:p></o:p></span></p>
<p class="xxmsolistparagraph" style="margin-left:59.5pt;text-indent:-41.5pt;mso-list:l0 level1 lfo2">
<![if !supportLists]><span lang="EN-GB"><span style="mso-list:Ignore">3.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-GB">Think about the bigger picture <o:p>
</o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB">Each of these includes detailed sub-principles that aim to help designers meet the motivating security goals in today’s technology landscape.<o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB">Our goal of seeing protocols designed securely for the internet naturally has parallels with the IETF’s work and, in particular, this white paper could be of interest to the IAB’s model-t programme. The key first step
in designing a protocol securely is, as we cover in the paper, to define the threat model it operates in.
<o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB">We believe this paper will be of particular interest to those involved in model-t as well as the security area more widely.<o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB">We hope you find these principles useful, and we welcome any feedback, either by email to
<a href="mailto:pdpfeedback@ncsc.gov.uk">pdpfeedback@ncsc.gov.uk</a> or via our GitHub page at
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_ukncsc_protocol-2Ddesign-2Dprinciples&d=DwMFAg&c=Nwf-pp4xtYRe0sCRVM8_LWH54joYF7EKmrYIdfxIq10&r=dT3K0y3n0RD9-56k-UVMPMP98PIQRd2Kzfa-AwqQOww&m=qnUiG-5l-0mOHJb9TgOay850sJlaQOTHdxPjpyJaOnM&s=hjdvtTcPYS_zgwzvDKfQAkHbE6fXjfuOIm1hEKri8Dc&e=">
https://github.com/ukncsc/protocol-design-principles [github.com]</a>.<o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB">Many thanks,<o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB">Andrew<o:p></o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="xxmsonormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to
<a href="mailto:ncscinfoleg@ncsc.gov.uk">ncscinfoleg@ncsc.gov.uk</a>. All material is UK Crown Copyright ©
<o:p></o:p></span></p>
</div>
<br>
<div style="font-size:10pt; font-family: 'Franklin Gothic Book';">NOTICE: This email message and all attachments transmitted with it may contain privileged and confidential information, and information that is protected by, and proprietary to, Parsons Corporation,
and is intended solely for the use of the addressee for the specific purpose set forth in this communication. If the reader of this message is not the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other
use of this message or its attachments is strictly prohibited, and you should delete this message and all copies and backups thereof. The recipient may not further distribute or use any of the information contained herein without the express written authorization
of the sender. If you have received this message in error, or if you have any questions regarding the use of the proprietary information contained therein, please contact the sender of this message immediately, and the sender will provide you with further
instructions.</div>
</body>
</html>