[Cfrg] What is the standard we are going to apply?

[Watson Ladd <[e-mail]>]

This is a different but related issue to that of the removal of Kevin.
Simply put, when an IETF WG hands us a protocol to evaluate will we
a) demand a reduction in the ROM
b) demand a tight reduction in the ROM
c) demand a tight reduction in the standard model+some signatures
d) demand a reduction in the standard model+signatures
e) demand ProVerif verification
f) say "it looks good to us".

I vote for one of a-d, and e if applicable. f appears to be the
historic standard and
has resulted in a litany of failures, from TLS cipher combinations
that have side-channel
attacks and worse, to IPsec catastrophically failing in certain configurations.

Cryptography is subject to the twelve networking truths, and to a
rephrasing of one of them
"certain truths in cryptography are only apparent to mathematicians".
As a result I feel the
CFRG should take a more proactive stance on being "the crypto people"
at the IETF/IRTF, and should use this position to promote stronger
cryptography with better guarantees than what
has existed so far in the IETF.

After the work of Kenneth Patterson it is clear that those of us who
are cryptographers absolutely need to participate in the standards
process with an aim of ensuring that the most important cryptosystems
in the world are secure. Let's treat TLS like millions of dollars,
billions of confidential emails, and tons of confidential information
are entrusted to it daily, because
that is how it is used.

Sincerely,
Watson Ladd