Re: [Cfrg] FIPS or equivalent approvals

[Robert Moskowitz <[e-mail]>]

On 07/29/2014 11:34 AM, Paul Hoffman wrote:
> On Jul 29, 2014, at 8:03 AM, Phillip Hallam-Baker <[e-mail]> wrote:
>
>> Choosing a curve is not all that we are going to need to make ECC crypto happen.
>>
>> If we are going to use the new curves in PKIX (a major part of TLS) we
>> are going to need trustworthy HSMs. Which in turn means that we are
>> going to need some standard for approvals to be audited against and
>> possibly someone to run the process.
> What do you mean by "we" in that paragraph? CFRG does not need HSMs, and CFRG does not ned "some standard" for anything. I suspect you mean "implementers of IETF standards", which is not "we".
>
> CFRG should do research and make recommendations for new cryptography to the IETF regardless of what it might cost for implementers to use what is proposed.

In large measure I agree with Paul, to some definition of cost.

Cloud computing (for example) clouds the whole HSM discussion and really 
scares the bejeepers out of me (based on discussions I have had with 
cloud/nfv/onf people on this subject).

So let's keep our battlefields clearly delineated and not have one 
campaign spill over into another.