[CFRG] Re: Progressing NTRUPrime/Classic McEliece drafts

[Eric Rescorla <[e-mail]>]

On Sat, Feb 1, 2025 at 1:49 PM D. J. Bernstein <[e-mail]> wrote:

> Eric Rescorla writes:
> > Simon Josefsson [...] wrote:
> > > Defering authority on crypto primitives to NIST is implied by many
> > > suggestions made IETF-wide right now.
> > i haven't seen anyone suggest that CFRG should not publish its own
> > specifications regardless of what NIST does.
>
> Some quotes in 2024 from IETF security-area directors:
>
>     * "CFRG does not analyse or evaluate cryptography itself"
>       (
> https://datatracker.ietf.org/meeting/120/materials/slides-120-saag-cryptography-at-the-ietf
> )
>

This statement just seems factually wrong as written, as AFAICT the
CFRG does in fact do some analysis prior to publication (though as noted
separately, it relies on existing analysis to a great extent). Perhaps what
is trying
to say that the CFRG relies on the research community for much of its
analysis? In any case, I don't think it's relevant to the question of
whether
CFRG should publish its own specifications.


    * "SEC AD Proposal: Limit publication of crypto RFCs"
>       (
> https://datatracker.ietf.org/meeting/120/materials/slides-120-saag-cryptography-at-the-ietf
> )
>
>     * "the cryptographic research communities are focusing on NIST
>       candidates"
>       (
> https://mailarchive.ietf.org/arch/msg/saag/9e1QheO1L6SVBX3a8mFSij9AgHw/)
>
>     * "Should the IETF really recommend a dropped candidate at this
>       stage? I do not think so"
>       (
> https://mailarchive.ietf.org/arch/msg/saag/9e1QheO1L6SVBX3a8mFSij9AgHw/)
>
> The details of the "limit publication" proposal weren't clearly stated,
> but included an "outside the IETF" criterion that sounded like it would
> eliminate IETF (in the broad sense, including IRTF) as an independent
> source of cryptographic standards---presumably rubber-stamping NIST's
> decisions instead, as one sees in the last link.
>

Well, I'll let Paul speak for himself, but I don't think any of these
amounts
to a general statement that CFRG shouldn't publish its own algorithm
specifications. Given that the IRTF has published quite a few such
documents (FROST, ristretto, VOPRF, RSA blind signatures ..)
during Paul's tenure without IESG objection, I don't think this is the
best reading of the above links.

-Ekr