Re: [Cfrg] Requesting removal of CFRG co-chair

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

[Cross-posting ceased, in light of Lars' message: he'll read the list.]

On 21/12/2013 08:28, Dan Harkins wrote:

> This request is FUD on top of innuendo.
  [...]
> The added implication of a conspiracy theory should be all the more
>  reason to reject it.

With all due respect, it is simply pointing out an elephant in the room:

• The NSA have been publicly documented, and caught, manipulating and
  subverting cryptographic standards to weaken them.

  - It is a publicly-documented fact being discussed by an oversight
    panel who are recommending that the President stop the NSA doing
    that.

  - That unavoidably logically implies that they're doing it now.

  - Not a conspiracy theory therefore: documented fact.

  - It was specifically discussed at the IETF 88 Technical Plenary.
    If you are unfamiliar with that discussion, and the resulting hums,
    please look it up. <https://youtu.be/oV71hhEpQ20?t=25m9s>

• If a nation state adversary were doing such a thing, they would
  probably target (among others) this group, which is chartered with
  evaluating cryptographic standards for internet protocols.

  - Ideally, they would hold a position of power, being able to guide
    the committees into making decisions that are to their advantage,
    provide bad advice that will be trusted in light of his position,
    or misrepresent consensus that could be interpreted as mere error.

• Well, the co-chair of this group - literally - works for the NSA.

• We're gonna have a problem here.

It is a crystal-clear, indefensible, classic conflict-of-interest -
Kevin M. Igoe literally works for an attacker we are trying to defend
against!

I mean no disrespect to him as a person: please record that. But I'm
sure that if he is being honest, he will understand the concerns, and
gracefully resign his position.

He might be an ethical fellow, and dislikes how their SIGINT appears
to have fatally undermined their COMSEC. Sadly, I don't KNOW that; and
the trouble is, it raises the highly uncomfortable, but sadly
unavoidable, impression that he could instead be employed to undermine
the work of this group.

In light of what we do know about BULLRUN, it is entirely reasonable
for us to be uncertain, and to doubt, whether Kevin is working in the
best interests of the internet.

And it is reasonable for us to fear that instead, he may be working in
the best interests of his employer - which, sadly, appear in light of
IETF 88 and related discussions, to have been in direct conflict.

He has to go. Nothing personal.

> I am extremely sorry that my draft seems to have caused the CFRG 
> chairs to be the target of these accusations.

IETF 88 specifically addressed the importance of public oversight and
scrutiny in the evaluation of cryptographic standards.

So, on the contrary, I am extremely glad that the effect of your draft
was a fresh round of public scrutiny and oversight. Thank you for that.

[Just to clarify: One of the co-chairs, Kevin M. Igoe, openly works for
 the NSA and is the source of raised concern here. I have no cause for
 concern about the other co-chair, David McGrew, who works for Cisco.]

> The protocol in question, dragonfly, does not have any security 
> flaws that would cause it to be inappropriate as a TLS cipher
> suite.

I note that you feel protective, even hotly defensive, of your work.
Others have raised concerns which appear to remain insufficiently
addressed. Beyond that, I won't comment within this discussion.

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJStahTAAoJEOyEjtkWi2t694AQAJvVdhzjVEbZC89smIDShzuG
bybdRXeaXCGU9T5d4bG0kb3fVG+ya/pymPRYQDujT4nDUMD1/9xzZlyesLnv6UNL
P1iLGY70Sn+saTsGez/1s7/hF4plDqqK/L2evNM9RF2Dh0KBvGWJauEGaMTAb9U4
JRJ0zZbS2OFSDX0a7By4Lvn6qOYWl5Vbu5N0mMQ3tcbutbrg3pPhaGxM6lrtLtoA
wg6va87kGSQbRFuiodLrdZx83eDJNpNoA+mHDLVatZdzTfpUbkSwPbMWiBBanMwI
7rKA6ykoB0YTdYuNZS5vfGIDP+i5/4pN3RFfQ5LnCBn4mmyZXuF0CFQN5kb4ucya
KOvvlIhuNJ60YcJM55a074V2ywajG4PJtyGvqa17v9QNTaipO4p7SGi2a2XK6zmf
cH3kycPmUI8/74adp/3SncOVTsrPJBiKee1leh4jeh45YvA/onzxh/HkGJt5z1lL
SQegneFX3dnZ1JOyX29IYTnb5+TlOuk/YkrfNXQSABw8QGFWU8ahRdhcNUmpmITv
wJrxE1yenlJnqXQo15TdqsKLHP6pdtKsFmCjhYXLqy9xZA4+GtZ5GtGK9pEM3dIx
FuahvMR5+s8rUsy0iTh26zVucNVhFBLIzptc8lTOdszGs87iWgHmWi2CYTA+9uPN
rojDo10p8NRrZjXJDftR
=Z/mS
-----END PGP SIGNATURE-----