A covert channel is a channel that

A covert channel exploits mechanisms not intended for communication - such as timing, resource usage, or storage - to transfer information outside of what the security policy permits. Because it operates outside policy controls, it bypasses mandatory access controls and audit mechanisms. NIST and classic security literature define covert channels specifically by their violation of the security policy, not merely by being hidden or encrypted.

A channel that operates within the security policy is a legitimate, authorized communication path, which is the opposite of a covert channel.

This option describes a generic communication path and omits the critical defining characteristic that the channel violates or is outside the security policy.

Encryption alone does not define a covert channel; an encrypted channel can be fully authorized and within policy, while a covert channel may not use encryption at all.