Re: [Cfrg] how can CFRG improve cryptography in the Internet?

[Stephen Farrell <[e-mail]>]

I think adding energy and appropriate tasking to CFRG is a fine
idea, but this bit is a bit of a potential rathole...

On 02/10/2014 07:18 PM, David McGrew wrote:
> Surely we don't need new crypto mechanisms to solve the problems with
> RADIUS, but analyzing and documenting security issues and helping to
> socialize them with the IETF and the user base are all in charter and
> are worth doing.

I'm not clear on this. I don't think there are non-obvious
crypto issues with RADIUS or Diameter that CFRG can tackle
to be honest. Or maybe I'm not missing something?

I don't think CFRG should be collectively "documenting security
issues" generally, if those that are not cryptographic. Reason
being that that'd likely generate more heat than light and would
overlap with secdir and IETF WGs too much probably.

I could maybe see re-chartering to include theorem-prover style
analyses or results in CFRG's charter, but I interpret the above
differently.

If some CFRG folk are interested in e.g. RADIUS security,
then they are just as free as anyone to send mail to the
DIME list.

Cheers,
S.