Re: [radext] Liaison to government agencies

[Stephen Farrell <[e-mail]>]

Hiya,

On 23/11/2022 23:06, Bernard Aboba wrote:
> Stephen said:
> 
> "Perhaps the charter text you'd like added would say that the WG needs to
> establish what protocol requirements need to be met for FIPS-140 compliance
> before defining anything?"
> 
> [BA] That seems like a good way to go about it. 

Cool. Next step there would be for someone to propose
concrete wording for that, then our AD can decide to
update the draft charter or not. I can give it a shot
tomorrow if that's useful, and if nobody else does it
first:-)

Cheers,
S.

> Just like the IETF has
> learned to avoid "amateur lawyering", it is necessary to avoid "amateur
> regulation interpretation", where participants offer their own
> interpretation of regulations, speaking on behalf of government agencies.
> In the RADEXT WG, we adopted the policies of other IETF WGs in requiring
> that only employees or authorized representatives of government agencies be
> allowed to speak on behalf of those agencies.
> 
>   "Establishing what protocol requirements need to be met"  shouldn't invite
> a discussion among "amateur regulators" about what they think FIPS-140
> "should mean".
> 
> On Wed, Nov 23, 2022 at 1:49 PM Stephen Farrell <[e-mail]>
> wrote:
> 
>>
>> Hiya,
>>
>> On 23/11/2022 17:11, Bernard Aboba wrote:
>>> [BA] Employees of NIST have a long history of engagement on network
>> access
>>> security.  The design of 802.11 security (including the RADIUS aspects)
>> was
>>> kicked off by a meeting at NIST. If FIPS compliance is a goal for this WG
>>> (as some seem to think) then we should get info “from the horses mouth”.
>>
>> Ok, think I understand what you're after now, but I'm not
>> sure that requires or would work via a liaison though, for
>> various reasons.
>>
>> Perhaps the charter text you'd like added would say that
>> the WG needs to establish what protocol requirements need
>> to be met for FIPS-140 compliance before defining anything?
>>
>> S.
>>
>