Re: [CFRG] Please review draft-ietf-drip-rid

["Riad S. Wahby" <[e-mail]>]

Hello Uri,

As I've said privately, I appreciate your position even though
I disagree with it. But this thread seems to be going in a slightly
concerning direction:

"Blumenthal, Uri - 0553 - MITLL" <[e-mail]> wrote:
> While we both understand that I am not a spokesman for such a group,
> as nobody appointed or authorized me to do so – IMHO, this group
> would include all the US Government, all the vendors who sell
> to US Government, and probably same contingent for other countries.

The "some of us" context here was "Ed25519 is not acceptable".

Broadening this to include morally equivalent (PQ-wise) cryptography
(e.g., the NIST curves, ECDSA, ...), it seems pretty clear that the
official position of the US Government is that such cryptosystems
*are* acceptable. After all, they are in-use and recommended.

Perhaps once the current NIST competition concludes we will see a quick
shift to PQ cryptosystems as sole recommendations. But I doubt this
very much: experience tells us that breaking newly deployed and
not-yet-well-understood cryptosystems is much easier than building
crypto-threatening quantum computers.

So: I do not think it is correct to claim the USG and its subsidiaries
as ideological allies here.

But I'm not sure this matters much either way, because:

> Mike Scott wrote:
>> I for one would be interested in just how extensive this "some of
>> us" group is. In the interests of transparency I think they should
>> step forward and identify themselves. It is a view I respect, but
>> personally disagree with.
>
> Sure. Though be aware that only a tiny fraction of the above appears
> present here, and I can’t speak even for them.

With respect, this appears to be non sequitur. The question was how
many people would be likely to shoot down new non-PQ proposals:

>> If people in good faith are willing to make major efforts to put
>> forward proposals to this forum, it would only be fair for them
>> to be aware of the extent of that grouping who would reject such
>> proposals out-of-hand.

From that perspective, the only relevant people are those who participate
or who are likely to participate in discussing those proposals.

> Also, please consider that from the common-sense point of view,
> if the security concern I expressed is valid – the number of people
> or organizations who share it is irrelevant. So far, there has been
> no way to either prove or disprove convincingly this concern. And
> we’ve been erring on the side of caution pretty much everywhere
> else – so, why not here?

This argument does not seem productive: essentially all cryptography
is based on hardness assumptions that have not been proved or disproved
(and, given our current knowledge, seem unlikely to be). If we accept
the above argument, the logical conclusion seems to be "disband CFRG".

Cheers,

-=rsw