Re: [saag] sntrup761x25519-sha512

[Tero Kivinen <[e-mail]>]

Peter Gutmann writes:
> Tero Kivinen <[e-mail]> writes:
> 
> >All names having @example.com are free for that organization to allocate as
> >they like. I.e. openssh has allocated several protocol names from
> >@openssh.com domain.
> 
> Some of those are actually de facto standards, for example there are
> implementations that either ship with, or whose default configuration is,
> "*[e-mail]" and none of the MTI mechanisms covered in the spec, so the
> only way you can talk to them is to dig up a vague description of what that
> involves from the bottom of a locked filing cabinet stuck in a disused
> lavatory with a sign on the door saying "Beware of the Leopard".

If they are defacto standards, then I think it would be usefull to
have more people looking at them, thus having IETF consensus would be
better than just expert review.

> The ability to stuff things you've made up yourself into @xyz mechanisms I
> think is more of a bug than a feature when you've got something that can set
> de facto standards in this way, you end up having to implement it or things
> break but there's no RFC to implement it from.

It also allows fast testing and development, as you can allocate
unique identifiers for your algorithms easily without needing to wait
for official allocation from anybody.

The issue is that people should NOT use those implementations having @
names, they should ask for the vendor who allocated them to actually
write documentation of the feature, and get proper name allocated.
-- 
[e-mail]