Re: [Cfrg] The Mythical Kevin Igoe

[Watson Ladd <[e-mail]>]

Dear Mr. Igoe (and everyone else),
First off congratulations on your daughter's graduation. I'm sure
everyone here wishes her great success.

That said, I think your email raises more questions than answers, at
least in my head:
(Message numbers are in the CFRG archive)

On 15 October 2012 you asked us to look at dragonfly.

On 4 April 2013 you wrote email msg03264, stating that you wanted to
put out a last call on Dragonfly.
This email received no responses.

On 7 Dec 2013 the TLS Last Call on Dragonfly began. Joseph Salowey
indicated the CFRG had
reviewed the protocol with "satisfactory results".

On 13 Dec 2013 you wrote email msg03258, reiterating the last call and
looking for input. This time you mentioned
that TLS was working on it, which none of your previous emails had.
This sparked a flurry of analysis, culminating in an email by you
acknowledging a 2^{-40} chance
(in a reasonable model) of dragonfly leaking the password due to
failure to find a point. This
was in the version of dragonfly the TLS WG was considering.

The CFRG had not only not found any problems, it hadn't analysed
dragonfly at all. The better answer would be "no one has
analysed it". But of course, there are hundreds of protocols: everyone
only cares about ones that actually get used. When the
group actually looked at dragonfly, problems quickly appeared.

Why was no response taken as indicative of a positive analysis? Given
that this request came from the most important
WG in the security area (the only one with millions of dollars
entrusted to it globally), why was this not indicated as
a high priority?

It's become clear to me that these are symptoms of problems much
deeper than what appears in retrospect to be one chair's inartful
words when describing a lack of results. Despite an initial 2005 burst
of activity, including participation by some of the best
cryptographers
in the world, today's CFRG does not seem to be effective in adding
cryptographic expertise to WGs requesting it.

What do you feel should be done to address this issue?

Lastly, one note about primatives: primatives aren't the problem,
protocols are. I've harped on this point often, but the "party line"
of
the IETF that the CFRG doesn't do protocols is ridiculous. What do you
think cryptographers do when they talk about MPC or key agreement?
Does the IETF have a problem picking ciphers, or doing the right thing
with them?
(Ex officio, do you think we should demand formal proofs of protocols
before us, or should we continue with the "looks good to me"
standard?)
Sincerely,
Watson Ladd