Re: [Cfrg] how can CFRG improve cryptography in the Internet?

[David McGrew <[e-mail]>]

Hi Stephen,

On 02/10/2014 03:59 PM, Stephen Farrell wrote:
> I think adding energy and appropriate tasking to CFRG is a fine
> idea, but this bit is a bit of a potential rathole...
>
> On 02/10/2014 07:18 PM, David McGrew wrote:
>> Surely we don't need new crypto mechanisms to solve the problems with
>> RADIUS, but analyzing and documenting security issues and helping to
>> socialize them with the IETF and the user base are all in charter and
>> are worth doing.
> I'm not clear on this. I don't think there are non-obvious
> crypto issues with RADIUS or Diameter that CFRG can tackle
> to be honest. Or maybe I'm not missing something?
>
> I don't think CFRG should be collectively "documenting security
> issues" generally, if those that are not cryptographic. Reason
> being that that'd likely generate more heat than light and would
> overlap with secdir and IETF WGs too much probably.

I was being too vague, sorry.  By "documenting security issues" I had in 
mind those cases in which some sort of cryptanalysis needs to be brought 
to bear in order to show that, yes, there is an actual attack that can 
be performed.   Sometimes some applied cryptanalysis needs to be done to 
make the point that some existing algorithm or parameter choice is no 
longer appropriate (or perhaps was never a good idea).    The 
standards-oriented people in CFRG could probably identify some 
low-hanging fruit that the cryptanalysis-oriented people would enjoy 
breaking.

Definitely we need to avoid the overlap that you mention.

David

>
> I could maybe see re-chartering to include theorem-prover style
> analyses or results in CFRG's charter, but I interpret the above
> differently.
>
> If some CFRG folk are interested in e.g. RADIUS security,
> then they are just as free as anyone to send mail to the
> DIME list.
>
> Cheers,
> S.
>
>
> .
>