Re: [Cfrg] Fwd: New Version Notification for draft-whyte-select-pkc-qsh-00.txt

[Peter Gutmann <[e-mail]>]

Simon Josefsson <[e-mail]> writes:

>I believe we have seen evidence that even the qualifier "for use in IETF
>protocols" is too limiting.  Many crypto libraries cannot know for what
>purpose their APIs will be used for, so limiting the ability to use an
>algorithm for "an IETF protocol" is in practice a non-starter for deployment.

It really depends on what it is.  For example every single IETF standards
group has seen fit to invent their own PRF and no-one uses the one from
standard X in standard Y, so even a far more restrictive qualifier "for use
only in IETF protocol X" wouldn't make any difference (if you want to use a
PRF standalone, just go with HKDF and you're done, you don't need some oddball
protocol-specific PRF).

More generally, there are lots of mechanisms that are really only used with
specific protocols, with there being no demand for using them elsewhere.  For
example no-one's ever come to me and asked to use TLS' (EC)DH -> premaster-
secret -> master-secret mechanism in anything else, nor the SSH equivalent, or
PGP's weird IV-handling mechanism, or S/MIME's key wrapping, or a pile of
other protocol-specific mechanisms.  They want a black box that does TLS (or
PGP, or whatever), not any individual component thereof.

So while I would like to have blanket permission to use X, for a lot of X's
having their use tied to a particular protocol, or IETF standards in general,
has no real consequences because they're not used outside the protocol anyway.

Peter.