Re: [saag] NIST requests comments on using ISO/IEC 19790:2012 as the U.S. Federal Standard for cryptographic modules

On Tue, Aug 18, 2015 at 5:33 AM, Phil Lello <phil@dunlop-lello.uk> wrote:
> I'd just like to clarify that my objection to the paywall isn't about paying
> for the standard per-se, as it would be reasonable to pay a fee as an
> implementor (much like paying to access C++ standards to write a compiler).
> The objection is specifically about needing to pay to access the standard as
> part of a review process, as the fee is a barrier to broad evaluation.

Well, then let me explicitly disagree with this position.  The
standards that run the Internet need to be widely implemented, and
that means the specs need to be widely available.  As Russ observed,
the current FIPS standards are freely available, so moving to a
paywalled standard would be a major step backwards.  And a step
backwards for, AFAICT, no benefit.

I would also observe that "free for review, pay for implementation" is
not really a realistic position.  If anyone can download the spec for
review, then it will be out there on the Internet after it's
finalized.  Much like the C++ spec, in fact (see the links in
https://en.wikipedia.org/wiki/C%2B%2B).  And in practice that just
means that everyone will use the free "almost final" version, not the
paywalled "final" version.

--Richard

>
> Phil
>
> On Tue, Aug 18, 2015 at 1:37 AM, Mark D. Baushke <mdb@juniper.net> wrote:
>>
>> It may be worth noting that NIST actually put the wrong edition of the
>> ISO/IEC standard in the Federal Register article... They intended to put
>> 19790:2012 instead.
>>
>> See also
>>
>>   http://csrc.nist.gov/groups/STM/cmvp/notices.html
>>
>>            -- Mark
>>
>> _______________________________________________
>> saag mailing list
>> saag@ietf.org
>> https://www.ietf.org/mailman/listinfo/saag
>
>
>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
>