Re: [CFRG] Escalation: time commitment to fix *production* security bugs for BLS RFC v4?

[Paul Hoffman <[e-mail]>]

On a tangential note, but one that is relevant to your complaint:

- Internet Drafts are absolutely not RFCs. RFCs always have been more 
reviewed than Internet Drafts. That is, even the "final" draft that is 
given to the RFC Editor has additional reviews that sometime surface 
technical bugs that must be fixed before the RFC is published. As others 
have pointed out, implementing from an Internet Draft comes with 
significant risks.

- The CFRG does not create standards. All RFCs from the CFRG have a 
status of "informational", not "standard". They might be treated as 
standards by implementers, but they are not in fact standards. In the 
IETF, standards have more reviews than CFRG RFCs.

(I note that https://github.com/cfrg/draft-irtf-cfrg-bls-signature 
incorrectly uses the word "standard" at the top of the repo. Maybe the 
CFRG chairs could review all of the repos in https://github.com/cfrg to 
make sure that their wording is accurate.)

--Paul Hoffman