Re: [radext] Liaison to government agencies

[Bernard Aboba <[e-mail]>]

Stephen said:

"Perhaps the charter text you'd like added would say that the WG needs to
establish what protocol requirements need to be met for FIPS-140 compliance
before defining anything?"

[BA] That seems like a good way to go about it. Just like the IETF has
learned to avoid "amateur lawyering", it is necessary to avoid "amateur
regulation interpretation", where participants offer their own
interpretation of regulations, speaking on behalf of government agencies.
In the RADEXT WG, we adopted the policies of other IETF WGs in requiring
that only employees or authorized representatives of government agencies be
allowed to speak on behalf of those agencies.

 "Establishing what protocol requirements need to be met"  shouldn't invite
a discussion among "amateur regulators" about what they think FIPS-140
"should mean".

On Wed, Nov 23, 2022 at 1:49 PM Stephen Farrell <[e-mail]>
wrote:

>
> Hiya,
>
> On 23/11/2022 17:11, Bernard Aboba wrote:
> > [BA] Employees of NIST have a long history of engagement on network
> access
> > security.  The design of 802.11 security (including the RADIUS aspects)
> was
> > kicked off by a meeting at NIST. If FIPS compliance is a goal for this WG
> > (as some seem to think) then we should get info “from the horses mouth”.
>
> Ok, think I understand what you're after now, but I'm not
> sure that requires or would work via a liaison though, for
> various reasons.
>
> Perhaps the charter text you'd like added would say that
> the WG needs to establish what protocol requirements need
> to be met for FIPS-140 compliance before defining anything?
>
> S.
>