Re: [Cfrg] publishing dragonfly (was: Re: 2^40. I can't exhibit it, but it exists.)

["Eggert, Lars" <[e-mail]>]

Hi,

On 2014-2-6, at 0:34, Manger, James <[e-mail]> wrote:
> Instead of publicly warning a useful contributor,

I'm not debating the usefulness of Watson's contributions (I am in no position to). I am warning him that his tone has on occasion been problematic, and informed him that I have been asked to consider a BCP38 posting rights action.

> could you take a minimal stand against the sabotage of crypto standards by the NSA. I'm glad other IETF groups are trying to address pervasive surveillance with technical measures, but we also know: the NSA has sabotaged crypto standards; they have not told us which standards bodies or which specifications are affected; they haven't told us the nature of the sabotage. The NSA have tarnished a lot of work by our standards community on improving internet security. In this situation it is totally untenable for an NSA employee to chair this crypto standards group. Make it clear that an organization cannot both sabotage our work and have their employees openly participate in our civil community.

The CFRG is not a standards group. It does not produce standards. It's discussions and documents may influence IETF standards, but those discussions happen in IETF working groups governed by the IETF process. This is important, because not all of the IETF rules apply to the IRTF, see RFC2014. (For example, IRTF research groups need not come to consensus on their output.)

As an individual, I am fully in favor of making widespread wiretapping as difficult and costly as possible, and I am very supportive of anything the IETF and IRTF can do here.

That said, replacing Kevin Igoe as co-chair of the CFRG is not an action that will get us any closer towards that goal. Please see my detailed reply to Trevor for why; the short version is that I don't believe that Kevin (or David, for that matter) have any greater influence over the output of the research group than other participants. They don't have any veto rights, or an ability to suppress contributions or discussions, or a way to mandate certain outcomes.

Our best defense against IRTF and IETF work being subverted is transparency, and getting as much review from as diverse a group of people as possible. Eliminating groups of people from participating because of their current or past employment status, or based on whom they consulted for or took research grants from weakens that open process.

Lars