Re: [Cfrg] Time to recharter CFRG as a working group? Was: Re: [secdir] ISE seeks help with some crypto drafts

[Mathy Vanhoef <[e-mail]>]

Regarding the Dragonfly datapoint: this protocol already got added to the
802.11 standard in 2011 under the 802.11s amendment. As far as I know, I
only got discussed by the CFRG after this.

On Mon, Mar 11, 2019 at 3:20 AM Tony Arcieri <[e-mail]> wrote:

> On Sun, Mar 10, 2019 at 3:46 PM StJohns, Michael <[e-mail]>
> wrote:
>
>> In recent years, the CFRG has produced documents that are for lack of a
>> better phrase de facto standards.  The rate of document production of the
>> CFRG mimics more closely that of a WG than the other extant RGs AFAICT.
>> As an RG the CFRG isn’t permitted to publish standards track documents, nor
>> is the IESG or the ISE permitted or constrained to require a conflict
>> review on the documents the CFRG does produce.  [the latter comment is my
>> understanding of the rules of the research stream - it may be flawed, but
>> the purpose of RGs is supposed to be looking at futures and that by
>> definition shouldn’t be conflicting with the nows].
>>
>
> An interesting datapoint on this is Dragonfly key exchange, published as
> RFC 7664, has now been incorporated into the Wifi Alliance's WPA3 standard:
>
> https://sarwiki.informatik.hu-berlin.de/WPA3_Dragonfly_Handshake
>
> I will preface the following statement by saying that my criticisms of
> Dragonfly on the CFRG list at the time were misinformed and due to a lack
> of understanding, and would now call it "okay" (and many of my concerns
> were assuaged after it received a security proof).. However, I think it's
> fair to say that as a non-standards document, it has something of a sordid
> history:
>
>
> https://arstechnica.com/information-technology/2013/12/critics-nsa-agent-co-chairing-key-crypto-standards-body-should-be-removed/
>
> I think if there were a WG chartered specifically with a standards-track
> document for what the next generation key exchange to be used for use cases
> similar to and including, but not limited to WiFi were, my best guess is we
> could've done better than Dragonfly. I'm not sure why the Wifi Alliance
> chose it specifically, but it seems the CFRG was treated at least in part
> as a bar the algorithm must pass for incorporation into their standards,
> and for a standard of such importance I guess what I'm saying is I wish
> that bar were higher.
>
> --
> Tony Arcieri
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>