Re: [Cfrg] draft-atkins-suit-cose-walnutdsa on the Independent Stream

["Martin Thomson" <[e-mail]>]

As a matter of formality, publication on the Independent Submissions Stream wouldn't constitute a blessing by the CFRG, the IETF, or anyone aside.  The only blessing comes from from maybe the ISE within the bounds of that stream.

Let's say that this is "bad crypto" in the sense that it isn't demonstrably good.  It is the purpose of the Independent Submissions Stream to occasionally publish dissenting views where the ISE believes that there is sufficient benefit from doing so.  So the question we might ask is: is there any benefit to having this particular mechanism documented?

If this were widely-deployed not-good crypto, that might change the situation, but the potential for harm in terms of misunderstanding the status of the mechanism seems significant enough to argue for not publishing even then.  In my view.  But, as ISE, that is Adrian's choice and Adrian's choice alone.

I don't particularly like this situation, but that is the price the IETF community previously decided to pay in return for having an outlet for dissenting opinions on its proceedings and outputs.  It's also a very divisive issue where there is not universal agreement about either the value of the outlet or the constraints under which it operates.

On Mon, Jan 20, 2020, at 09:25, Paterson  Kenneth wrote:
> Hi Adrian,
> 
> I'm no longer a CFRG chair so I can say exactly what I think now :-)
> 
> I don't think CFRG should "bless" any draft concerning the WalnutDSA 
> scheme. Notably, this algorithm did not pass to the second round in the 
> NIST competition due to the significant cryptanalysis that it suffered 
> from prior to and in the early stages of the competition. 
> 
> It may be that the proposers of this algorithm are able to avoid all 
> currently known attacks by setting parameters carefully, and through 
> extensive modifications to the scheme. But the scheme's history does 
> not inspire confidence. Moreover, my strong sense is that serious 
> cryptanalysts have stopped working on it simply because it did not pass 
> to the second round (put another way, they successfully killed it in 
> the first round).
> 
> Best wishes,
> 
> Kenny
> 
> 
> -- 
> Kenny Paterson
> Applied Cryptography Group
>  
> ETH Zurich, Computer Science Dept.
> Universitätstrasse 6, CNB E 104.2
> CH-8092 Zurich
>  
> tel. [phone]
> www.appliedcrypto.ethz.ch
> 
> -----Original Message-----
> From: Cfrg <[e-mail]> on behalf of "RFC ISE (Adrian 
> Farrel)" <[e-mail]>
> Reply to: "[e-mail]" <[e-mail]>
> Date: Sunday, 19 January 2020 at 22:55
> To: "[e-mail]" <[e-mail]>
> Cc: "[e-mail]" 
> <[e-mail]>, Adrian Farrel 
> <[e-mail]>
> Subject: [Cfrg] draft-atkins-suit-cose-walnutdsa on the Independent 
> Stream
> 
>     Hi CFRG,
>     
>     Derek Atkins has presented draft-atkins-suit-cose-walnutdsa to me for
>     publication as an Independent Submission Informational RFC.
>     
>     I think this is the sort of draft that would benefit from the CFRG's
>     wisdom and would appreciate any reviews or guidance that you're able to
>     give.
>     
>     The latest version of the draft can be found at
>     https://datatracker.ietf.org/doc/draft-atkins-suit-cose-walnutdsa/
>     
>     If you could cc me on any discussions (or send them off list) that would
>     be helpful.
>     
>     Many thanks,
>     Adrian
>     -- 
>     Adrian Farrel (ISE),
>     [e-mail]
>     
>     _______________________________________________
>     Cfrg mailing list
>     [e-mail]
>     https://www.irtf.org/mailman/listinfo/cfrg
>     
> 
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>