Re: [Cfrg] Requesting removal of CFRG co-chair

[Adam Back <[e-mail]>]

Sorry but no.  His employer has been exposed as spending $250m/year to
sabotage amongst other things standards.  Including paying RSA (with its
influence as defacto industry standards author (PKCS# series)) $10m to
include EC_DBRG as a random number generator.  And influencing NIST to
publish the same.  We do not know what other overt or soft-sabotage has been
going on where.  Note the disclosed information included mention of more
plausibly deniable soft-sabotage - eg architectural decisions pushing
towards less decentralization (concentrated tap points), fragility, and
'accidental' biases that leak keys (like the original DSA flaw that
Bleichenbacker found), and seeming organizational inability to deploy MUST
forward-secrecy ciphersuites throughout IETF protcools.  

Kevin is free to resign from his employment or not now he knows these facts. 
He surely must have some view on it whether he thinks its a good thing and
was actively working on it, or a bad thing, but unable to comment.

Regardless I do not think it remotely acceptable in the circumstances that
current NSA employees are in any position of administrative control within
any public standardization processes period.  Positions of administrative
control are weak points of public policy processes.  Often individuals have
insufficient energy to take on the administrative work-load, so they are
relatively easy to fill.  I have seen in the distant past UK MoD (presumably
GCHQ) people popping up in unlikely positions (eg national health medical
record security standards).

Cleary, and perhaps where your sympathies come from, this could be emotively
misread as a slight to Kevin personally.  Its not, its completely impartial. 
But its just a thats the risk you take when you work for government and
government is exposed to have committed outrageous, well funded and
persistent societal interest sabotage.  Society hardly needs to defend its
actions in reacting.  We are the egregiously wronged party.

How also should the US industry players feel, knowing how many $ billions
they are losing to european competitors as a result of this bad faith on the
part of NSA via NIST and abuse or collusion of commercial vendors.  Think
USG or NSA is going to write them a check to compensate?  They were all
used.

What do we have to do to finalize the process of removing?

Adam

On Sat, Dec 21, 2013 at 03:55:13PM -0800, Paul Lambert wrote:
>
>
>This debate started as a discussion of the ³Dragonfly² protocol.  The core
>cryptographic mechanism has been reviewed in multiple forums for two years
>and is incorporated into IEEE standards.  It is not an optimal mechanism,
>but was constructed for it¹s IPR considerations to serve a specific
>purpose.  It is useable and secure for the intended use cases and the
>protocol should progress forward.  The discussions on the CFRG list for
>time were productive and contributed to improvements in the protocol.
>
>The CFRG co-chair¹s support of advancing the protocol has unfairly been
>turned into a witch hunt.  The collateral damage is the stopping a
>potentially useful protocol mechanism.
>
>It is embarrassing to me to see the technical debate in the IETF lowered
>to the point that we are removing and rejecting people by their
>affiliation.  The whole point of standards is to bring into a room a group
>of competitors and work through a process to create technical solutions in
>a productive manner.  A continued debate on individuals open affiliations
>is not productive.  We should not proceed with a witch hunt to remove
>Government employees from the IETF.
>
>Anyone with experience in standards activities should already be wary of
>motives that drive each of the contributions.  I¹d rather have my
>competitor (or in this case the NSA) in the room to get whatever reading I
>can on their positions on our technical work.  We will always have to
>second guess the motives of individuals bringing work into our open forums.
>
>Paul
>
>Paul A. Lambert
>
>
>
>On 12/21/13, 3:29 PM, "Tao Effect" <[e-mail]> wrote:
>
>>On Dec 21, 2013, at 6:17 PM, Tao Effect <[e-mail]> wrote:
>>> Should not the choice of an employer reflect on a person's competence?
>>
>>Sorry, thinking a bit more about that question, I think the answer is
>>"no, not necessarily, but maybe in some circumstances."
>>
>>
>>--
>>Please do not email me anything that you are not comfortable also sharing
>>with the NSA.
>>
>>>
>>>
>>> On Dec 21, 2013, at 5:37 PM, Hilarie Orman <[e-mail]> wrote:
>>>
>>>> Take it as a challenge, is the IETF smarter than NSA or any other
>>>> organization with ulterior motives?  Can the IETF make sound technical
>>>> judgments based on written documents?
>>>
>>> Speaking for myself only, an organization's ability to make sound
>>>ethical choices impacts my ability to take it seriously.
>>>
>>> What sort of people does the IETF/CFRG place in positions of authority?
>>>
>>> Those types of decisions play a significant role in defining what an
>>>organization is, and what it does.
>>>
>>>> and choose leaders based on their competence and not on their
>>>>employment.
>>>
>>> Should not the choice of an employer reflect on a person's competence?
>>>
>>> Careful now, we're deadly close to reaching Godwin's Law. ;-P
>>>
>>> - Greg
>>>
>>> --
>>> Please do not email me anything that you are not comfortable also
>>>sharing with the NSA.
>>>
>>> On Dec 21, 2013, at 5:37 PM, Hilarie Orman <[e-mail]> wrote:
>>>
>>>> Is the CFRG co-chair the only person in the CFRG who has associations,
>>>> proclaimed or covert, with an organization intent on undermining the
>>>> standards process?  I seriously doubt it.  Then why trust anything
>>>> from any part of the IETF?  Because it is an open process with input
>>>> from a worldwide community.  That open process provides the resilience
>>>> against attack.
>>>>
>>>> Take it as a challenge, is the IETF smarter than NSA or any other
>>>> organization with ulterior motives?  Can the IETF make sound technical
>>>> judgments based on written documents?  If you don't believe this is
>>>> possible, then by all means, start the purges.  Otherwise, step up to
>>>> the plate, be part of the evaluation-on-the-merits process, and choose
>>>> leaders based on their competence and not on their employment.
>>>>
>>>> Hilarie
>>>>
>>>> _______________________________________________
>>>> Cfrg mailing list
>>>> [e-mail]
>>>> http://www.irtf.org/mailman/listinfo/cfrg
>>>
>>> _______________________________________________
>>> Cfrg mailing list
>>> [e-mail]
>>> http://www.irtf.org/mailman/listinfo/cfrg
>>
>
>_______________________________________________
>Cfrg mailing list
>[e-mail]
>http://www.irtf.org/mailman/listinfo/cfrg