SOI QUESTIONS: 2.6 Formal proofs of security

["Theodore Ts'o" <tytso@mit.edu>]

Please discuss and answer this question.....  

2.6 Formal proofs of security

2.6.)  Does SOI need to provide a formal proof of security?  (Is this
a "must have" or a "nice to have"?  What are we willing to trade-off
for having a formal proof of security?)

Implications from the Scenarios:

[none]