Re: [hrpc] Fwd: [] New paper from IGP on Standards and Human Rights

[Stephen Farrell <[e-mail]>]

Hiya,

On 01/12/2020 19:37, avri doria wrote:
> Hi,
> 
> Possibly interesting to some.

Had a read. I think it's wrong as to the motivations
for TLS1.3 - Snowdonia was IMO only one of those, we
had had a long series of documented attacks on TLS
so TLS1.3 probably would've happened anyway because
of those and the potential RTT improvements. It also
ignores the role of academic cryptographers in the
process of developing TLS1.3 - their proofs and
formal methods and the tools they had for producing
those lead to some of the design choices rather than
any political anything.

There's also a few minor factual errors in the dramatis
personnae, and some omissions of relevant players.
I suspect those may have been driven by the tools that
we have available for re-constructing working group
histories post-facto, as talking to people involved in
the process should have avoided those. The errors
really are minor and of no real impact, but if they
are down to the methodology used by the authors, but
not described, that's a bit more of interest.

I've no opinion as to whether the history backs any
of the three theoretical explanatory frameworks or
not, but the paper's interesting as an example of a
reasonable but imperfect reconstruction of what
happened.

Cheers,
S.

> 
> avri
> 
> 
> 
> -------- Forwarded Message --------
> 
> IGP releases a new research paper on the politics of the new Transport
> Layer Security standard: Standardizing Security: Surveillance, Human
> Rights, and TLS 1.3.
> 
>   
> 
> Standardizing Security develops a conceptual framework for understanding
> the relationship between technical standards and political/social
> effects. We identify three distinct ways of understanding this
> relationship: 1) by examining the interest groups who shaped the
> standard, which we call the Political Economy of Standardization (PES);
> 2) by focusing on the Societal Effects of Standards (SES) which refers
> to cumulative effects of adoption and implementation decisions over
> time; and 3) the idea that politics and rights are embedded in the
> standard; i.e., that Protocols Have Politics (PHP). We then perform a
> detailed analysis of the controversies around the design, adoption and
> implementation of TLS 1.3.
> 
>   
> 
> We find that the PHP approach had limited explanatory value compared to
> the PES and SES approaches. TLS 1.3 does in fact strengthen privacy –
> and technical efficiency – if adopted and implemented as intended. But
> the design of TLS 1.3’s stronger confidentiality measures met with
> resistance from corporate network operators who wanted more visibility
> into their internal networks and some governmental interests, leading to
> the development of an alternate standard by ETSI. There are also
> technical measures that can be deployed to undermine perfect forward
> secrecy. Additionally, authoritarian governments are now taking measures
> to block use of the new protocol. TLS 1.3 was an improvement, but its
> effects were limited.
> 
>   
> 
> By conveying the idea that political, economic and social effects can be
> hard coded into protocol designs, the protocols-have-politics view
> short-circuits careful analysis of the way standards contribute to
> governance. It also drastically overstates the role of protocol design
> in internet governance. Rights advocates and internet governance
> participants need to have more realistic ideas about what measures
> advance human rights on the internet.
> 
>   
> 
> Download the paper here:
> https://www.internetgovernance.org/wp-content/uploads/StandardizingSecurity-TLS.pdf
> <https://www.internetgovernance.org/wp-content/uploads/StandardizingSecurity-TLS.pdf>
> 
> 
>   
> 
> Dr. Milton L Mueller
> 
> Georgia Institute of Technology
> 
> School of Public Policy
> 
> IGP_logo_gold block
> 
>   
> 
> _______________________________________________
> hrpc mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/hrpc
>