Re: [Cfrg] RE: Where's the beef?

Alex Alten  wrote:
>Doing good analysis is hard work.  This is not
>like publishing an analysis of something like WEP or SSL where you
>could get great mileage out of the resulting publicity.  I'm talking
>about doing this sort of work before publishing it.  The closest free
>thing I can think of is the Twofish effort for NIST's AES.  But, again
>there was prestige to be gained by the team for publishing even a runner
>up design.  Here, most likely, a lot of RFCs will be rather obscure,
>tucked away in some reference slot in a Standard RFC.  Are you willing
>to do this heavy lifting, not for just one informational RFC, but say a
>dozen or more?

Yes, it's hard work.  Absolutely.  And not all good cryptographers
will donate their time for free -- but some will.  Some contributors
have been doing this for years.  Look at the IPSec effort, for instance:
that's benefitted from some very serious, detailed analysis on the design
from extremely competent crypto researchers, folks like Hugo Krawczyk
and Bart Preneel and Ran Canetti and Steve Bellovin and Steve Kent and
Cathy Meadows and Phil Rogaway and lots of other folks who I hope I'm not
offending by cutting the list short here.  I mention IPSec only because
it's a standards effort that I'm familiar with, but I think there is a
good chance that CFRG can benefit in a similar way.

You might only be familiar of the spectacular "breaks", because that's
the most visible kind of research result, but there is also a lot of
less visible work on under-the-covers preventative design, where folks
donate their time to help nail down the details to maximize robustness.
_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg