Re: [Privacy-pass] Question on proposed charter

On Sun, May 17, 2020 at 6:12 PM Joseph Salowey <joe@salowey.net> wrote:

> There are a few questions on the proposed charter:
>
> In the text
>
> "Negotiation of cryptographic parameters during the protocol is an
> application-specific property and thus out of scope for the Working Group."
>
> What are the cryptographic parameters and why would they not need to be
> negotiated for interoperability?
>
> Also, is the following text a result of the algorithms being worked on in
> CFRG vs. this working group?
>

I suspect this would be things like the curves and configuration used for
the underlying crypto primitives. I think the idea is that the core
PrivacyPass protocol wouldn't support any sort of negotiation, and the
applications built on top of PrivacyPass would either specify the
properties in their implementation or provide their own negotiation
mechanism (for example an HTTP application might have the curves it
supports hard-coded based on what the relevant clients/servers want to
support for compatibility or have some HTTP-application-layer mechanism to
choose corresponding server configurations.

Though it might be worth specifying at the PrivacyPass layer what the
actual "acceptable" combination of parameters is to maintain
security/privacy properties.

>
> "Specification of the underlying cryptographic algorithms or protocols is
> also out of scope."
>
> If so we might mention that this work depends on the work in the CFRG.
>

> Thanks,
>
> Joe
> --
> Privacy-pass mailing list
> Privacy-pass@ietf.org
> https://www.ietf.org/mailman/listinfo/privacy-pass
>