🚀 go-pugleaf

In article <1992Aug20.173003.2367@den.mmc.com> jhull@mercury.NoSubdomain.NoDomain (   Joseph F. Hull) writes:
>John is contradicting himself.  Many systems rely on procedural elements to implement 
>portions of the security policy, i.e., there may be many systems which have e-mail software 
>that allows the user to change mail headers and also have security policies which prohibit
>the transfer outside the organization of specified information.  Any user who uses fields in
>the mail header to transfer such information is violating the system security policy.  And,
>under the definition given above, such use constitutes a covert channel.
>
>The definition John quotes above is also the one I use and is, I suggest, the most 
>appropriate.  Can we agree that, for this thread, this is the one we will use?

The use of a mail header is the use of obfuscation to transport data.

If I use a simple substitution cipher, for example, replace "USSR" with
"the credenza", "nuclear missles" with "the book" and "B-52 bombers"
with "Ms. Cratchet", does the sentence

	"Please have Ms. Cratchet but the book on the credenza"

in the middle of a mail message to your wife constitute the use of a
covert channel (assuming your wife isn't "Secretary of Defense" ;-)
or something else?

Not every "unanticipated use" is a covert channel.  Not every violation of
policy requires that a covert channel be used.
-- 
John F. Haugh II                   | Life's Little Instruction Book:
Ma Bell: (512) 251-2151            | "#138.  Learn Spanish.  In a few years,
UUCP: ...!cs.utexas.edu!rpp386!jfh |  more than 35% of all Americans will speak
Domain: jfh@rpp386.cactus.org      |  it as their first language."