Re: [radext] Liaison to government agencies

[Bernard Aboba <[e-mail]>]

On Wed, Nov 23, 2022 at 08:50 Stephen Farrell <[e-mail]>
wrote:

>
> Hi Bernard,
>
> On 23/11/2022 16:34, Bernard Aboba wrote:
> > In the IETF, we have had problems with individuals making statements on
> > behalf of government agencies who have no connection to those agencies
> and
> > no authorization to speak on their behalf.
> >
> > To avoid this confusion, it has been necessary to formalize the process
> for
> > clarifying regulatory requirements. Typically this is done via a formal
> > liaison to/from the agency or inviting an authorized representative to
> > speak to the WG.
> >
> > In this case, it would make more sense for the RADEXTRA Charter to
> require
> > a liaison with government agencies rather than bake in an interpretation
> of
> > requirements and a predetermined solution.
>
> Sorry, I'm confused by the above and am not sure if/how it
> relates to the BoF discussion. Can you clarify?


[BA] The RADEXTRA Charter includes a work item whose purpose is to satisfy
FIPS-140 requirements.  The work item not only assumes an interpretation of
those requirements that has not been verified by NIST, but it also presumes
a solution based on those unverified requirements.

I'm also not sure of two other things: a) I don't think the
> IETF has a role where someone is a liaison to "government
> agencies" - aren't all our liaisons with very specific other
> bodies?


[BA] Employees of NIST have a long history of engagement on network access
security.  The design of 802.11 security (including the RADIUS aspects) was
kicked off by a meeting at NIST. If FIPS compliance is a goal for this WG
(as some seem to think) then we should get info “from the horses mouth”.