Re: [Cfrg] how can CFRG improve cryptography in the Internet?

[David McGrew <[e-mail]>]

Hi Hannes,

On 02/12/2014 12:08 PM, Hannes Tschofenig wrote:
> Hi David,
>
> I believe it is important to move beyond writing specifications to
> improving implementations and deployments. I think we both agree. I have
> been arguing for this for a while now and got pretty much no positive
> feedback. I also tried to convince the IAB that this would be somewhat
> important and completely failed. The response I got was: "This would
> require a completely different skill set." and "ISOC should do it."
>
> I don't have a good story for how to do that even at the level of
> individual work groups. I tried this in the OAuth working group and
> couldn't really find a way how to reach out to the large number of guys
> implementing OAuth libraries let alone those who deploy them.
>
> The CFRG might, unfortunately, not be the right group either. To me it
> seems that the folks in this group are focused on crypto (as the name of
> the group indicates). What we need is guys who understand the broader
> Internet ecosystem and know how to improve security libraries and to
> reach out to the wider Internet (security) community. One does not need
> to start from scratch since some of these communities exist but they
> often have no connection to the IETF or the relationship is very weak.
> As such, you often find a misalignment between the IETF security
> community and various other groups.

I think I know what you mean.   My own thinking in this space is that it 
would be healthy to develop stronger connections with the open source 
community.   For instance, if CFRG were to recommend a particular crypto 
mechanism, and then it turns out that the linux community rejects that 
mechanism (due to patents, performance, code size, complexity, API 
incompatibility, whatever), then there is probably something that we 
need to learn.   Better connections with the open source world could 
address some of that misalignment you mention, I think, though of course 
it is no panacea.

David