Re: [Cfrg] On "non-NIST"

[Phillip Hallam-Baker <[e-mail]>]

On Sat, Feb 28, 2015 at 10:41 AM, Paul Hoffman <[e-mail]>
wrote:

> On Feb 28, 2015, at 12:59 AM, Peter Gutmann <[e-mail]>
> wrote:
> >
> > Paul Hoffman <[e-mail]> writes:
> >
> >> The term "non-NIST" is predictive, and the crypto community kinda sucks
> at
> >> predictions. We have no idea what NIST will do in the future if a bunch
> of
> >> IETF WGs adopt specific elliptic curves that are not P256/P384.
> >
> > Why is NIST seen as the ultimate arbiter of what's appropriate though?
>
> Not "the", but "an". The reason is that NIST controls what can and cannot
> be given a FIPS-140 certification, and that certification is considered
> important both by companies who want to sell to the US Govt and companies
> that use their certification as a statement that "we did it right". If you
> make an HSM that uses an algorithm not allowed by NIST, you cannot get it
> certified in the CMVP regime. Thus, when NIST is slow to keep up with the
> best practices adopted by the community, it becomes a roadblock to
> deploying better crypto.


That overstates it.

I need my HSMs validated by some independent party. NIST has an existing,
widely respected infrastructure. The fact that NIST certification is
necessary for US govt use is not the issue here.

We need someone to do the work, there is a limited number of parties with
the resources, skills and authority to do the job. If NIST is not going to
do the job then we would need to find someone else. That is not impossible
but NIST is the default.


So the practical upshot here is that NIST is a stakeholder because we would
like their help. They are also a standards body in their own right (though
not a multi-stakeholder one). So it would be even more helpful if they gave
an indication that the new curves are at least equally acceptable as the
old for US govt. work.

NIST is a stakeholder here. They are not the only one but they are one of
the few stakeholders that is likely to have a strong opinion.


If NIST or Microsoft or Google was to say that they cared a really great
deal about P448 or P521 then that should in my view carry rather more
weight than a bunch of folk with either a mild preference for one or the
other.