Re: [Cfrg] Requesting removal of CFRG co-chair

[John Viega <[e-mail]>]

It’s clear that, whatever happens to Mr. Igoe, we need to assume that we have untrusted— even malicious participants in the standards process.  It’s recently become clear that the NSA has no scruples on the matter, and I wouldn’t put it past other governments to attempt to subvert the standards process.

If Mr. Igoe is removed, it does not address the problem of how to design secure standards in the face of untrusted actors.  For instance, we can’t imagine that everyone trying to subvert the process will come to the table with ‘NSA’ as their affiliation— we should expect the NSA to work indirectly through other people to encourage standards they want to see adopted.

It doesn’t seem too relevant who the chair is— we should generally assume the chair is an untrusted entity, whether they are willingly attempting to subvert the system or not.

For instance, the other co-chair, David McGrew, is someone I personally trust.  He’s a terrific human being, but he and I both have our names on the GCM mode of operation.  In retrospect, I think there’s a definitely possibility that GCM became a standard so quickly not because of its applicability to high-speed hardware implementations and its lack of IPR restrictions (which is what I firmly believed at the time), but because the NSA had an easy time breaking the message authentication mechanism through side-channel attacks.  I’d say it’s absolutely possible that the NSA worked through us unknowingly to try to subvert the standards process.

In the specific case of GCM, a lot of great work has been done since in constant-time implementations that we think protects against side-channel attacks.  But I have no idea what the NSA’s true capabilities are— and I think that’s even true for many employees of the NSA, which is clearly very compartmentalized.

Until recent revelations, the conventional wisdom seemed to be shifting toward people believing that the NSA didn’t know much about cryptography that the rest of the world didn’t know.  We seemed to think that there were far more smart cryptographers in industry and academia than hidden away in the bowels of government agencies, and that our people probably were making bigger advancements than theirs.

Today, I think we all recognize that’s a dangerous assumption.  It’s important for us, as part of the standardization process, to assume we are living in a world where governments are trying to subvert us, and that their capabilities are far greater than we expect.  Along the lines of a mail Watson Ladd just sent to this list, I think the CFRG should be demanding a *well-vetted* proof of security in the standard model where possible, and a well-vetted proof in the random oracle model when not.

But, going beyond that, I think the CFRG should also require some evidence that any foreseeable side-channel attack is addressed, under the assumption of a large government as an adversary.

As for Mr. Igoe, I think there are a few separate issues here:

1) Does his job as chair put him in a better position to subvert the standardization process, or are there appropriate checks and balances?   This one is not clear cut to me, as a casual lurker.

2) Does the presence of an NSA employee in this particular leadership position undermine public trust in the standards body, whether he is in a special position to abuse that trust or not?  I think the answer to this one is probably YES.

3) Regardless of Mr. Igoe’s employment, has his behavior been inappropriate enough to be grounds for termination?  Here, I think the initial concerns that Trevor Perrin raised about Kevin himself can possibly be chalked up to mistakes that should deserve a second chance.  HOWEVER, I feel that his utter lack of engagement in the discussion is a huge issue.

I believe public perception is important to the effectiveness of the efforts here, and I think Mr. Igoe’s lack of interest in engaging is not acceptable from someone in a leadership position.  I have less of a problem with the strong possibility that he’s a malicious player— the presence of such players is just a fact that the CFRG and the IETF have to be resilient enough to work around.

John

On Dec 23, 2013, at 11:09 AM, Yoav Nir <[e-mail]> wrote:

> 
> On Dec 23, 2013, at 5:21 PM, Tao Effect <[e-mail]>
> wrote:
> 
>> On Dec 23, 2013, at 3:57 AM, Robert Ransom <[e-mail]> wrote:
>> 
>>> I note that none of the few people who are speaking in defense of
>>> Kevin Igoe have even acknowledged the specific acts that Trevor Perrin
>>> listed at the beginning of this thread, much less tried to refute the
>>> charges or defend Mr. Igoe's acts.
>> 
>> Excellent observation! Instead of doing that, the response has been that a "witch hunt" is taking place, and that this is all based on "conspiracy".
>> 
>> And yet, neither of those claims is true.
> 
> It sure seems like it. More than one person on this list has stated that this is nothing personal, but an employee of the NSA (one of tens or hundreds of thousands) is automatically disqualified from chairing a working group.
> 
> The arguments against him are the kind that are leveled against IETF working group chairs on a regular basis - that they see consensus where consensus does not exist. Such arguments are easy to prove or disprove, because the mailing lists are public. I've seen plenty of arguments about whether the two people + author who liked the proposal vs the one person who asked a question and never replied to the list again constitute "consensus". None of those arguments resulted in a petition to remove the chair. I can only conclude that Kevin is getting special treatment because of his organizational affiliation, which IMO sets a very bad precedent. 
> 
> For the sake of argument, I will concede that all the accusations made are true: that (other than Dan) Kevin had the only message to the CFRG list with a favorable opinion of Dragonfly and that he presented that in a private message to the TLS chairs as "CFRG is fine with this algorithm". This could at worst be construed as mismanagement. Yet people present this as a malicious attempt by the USG to subvert the standards process so that people authenticate with a method that leaks timing information?  At the TLS layer or all places. That accusation is baseless and makes no sense for several reasons:
> - Nobody uses passwords at the TLS layer. A PAKE has been defined for years, and it's implemented in the most popular library. Nobody cares (sorry, Dan)
> - If the USG is spending money subverting the standards process to standardize a vulnerable password-in-TLS method, Americans should be worried - it's a monumental waste of their tax dollars.
> - The widespread surveillance that the Snowden documents revealed was all done with no cryptography. It was all done by gaining access to the plaintext or gaining access to keys. The agent trying to sabotage the standards process would not be a cryptographer with an @nsa.gov email. They'd be more surreptitious about it. (yeah, I know - that's what they'd like me to think)
> 
> I don't know Kevin personally, and have never exchanged a word or an email with him, but I believe that he is the target of a witch hunt.
> 
> Yoav
> 
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> http://www.irtf.org/mailman/listinfo/cfrg