Re: [Cfrg] NSA sabotaging crypto standards

["Eggert, Lars" <[e-mail]>]

Hi,

I want to respond to a few of your points. I won't get into a prolonged debate here.

On 2014-2-6, at 16:00, Manger, James <[e-mail]> wrote:
>> The CFRG is not a standards group. It does not produce standards.
> 
> These look and smell like standards to me, and this is where they are worked on.

<snip>

but they aren't. By definition, the IRTF does not produce standards, and the first sentence of the boilerplate of any IRTF RFC says

   This document is not an Internet Standards Track specification; it is
   published for examination, experimental implementation, and
   evaluation.

and then goes on to state even more caveats. That's about as clear as we can be.

>> As an individual, I am fully in favor of making widespread wiretapping
>> as difficult and costly as possible, and I am very supportive of
>> anything the IETF and IRTF can do here.
> 
> NSA have been sabotaging crypto standards. This is separate from widespread wiretapping.

Fair point.

I would also be in favor of any action that would make it more difficult for anyone to subvert the work we do. I still do not believe that replacing Kevin as chair would actually serve that purpose.

> Removing Kevin Igoe will be a concrete statement that we find the NSA sabotage of crypto standards unacceptable.

No, it wouldn't. It would be a demonstration that we believe in guilt by association. We'd make Kevin the scapegoat, irrespective of the fact that his personal actions do not warrant such a removal.

If the CFRG wants to make a statement about the actions of the NSA, then it can certainly do exactly that, i.e., folks can craft text to that effect and then the group can see if it has consensus to publish that statement. (The IETF did make such a statement via the Vancouver plenary poll.)

>> Eliminating groups of people from participating
>> because of their current or past employment status, or based on whom
>> they consulted for or took research grants from weakens that open
>> process.
> 
> We are not eliminating groups, we are saying we strongly object to one organization's actual behaviour.
> My understanding is that Kevin Igoe is a current employee of the NSA, paid (at least in part) to work on crypto standards.
> 
>> past employment status
>> consulted for
>> took research grants
> 
> No one is suggesting anything about those categories.
> Listing them feels like an attempt to invoke an imaginary slippery slope as an excuse not to act.


You are arguing to remove Kevin based on his affiliation. I'm therefore guessing you have similar concerns about other current NSA employees. And possibly the other groups I listed above, since their financial relationship with the NSA could be argued to influence their participation. The slippery slope is not an excuse - where do you draw the line?

All that said, I fully understand people's anger at the action's of the NSA, and I do share it. I also understand the impulse to want to do something. But I don't consider punishing an individual contributor to the group for the actions of his employer an appropriate action. I also do not believe that the solution lies in preventing individuals from contributing solely based on their affiliation.

Lars