Re: [saag] Discuss at SAAG? was Re: nation state crypto profiles - draft-jenkins-cnsa-cmc-profile-00

On Tue, 2 Oct 2018, Carl Wallace wrote:

> What's the difference between a nation state profile and a similar or same
> profile that has been marshaled through a commercial entity?
> What's the difference between a nation state profile and a profile from a
> very large company? Is a market cap limit next?
> Would elimination of all affiliation flatten the space in a good way or is
> the current truth in packaging preferred?

These are good questions for a SAAG discussion.

If we have an industry wide recommendation, I think that could qualify
for an IETF reviewed and published document. And I feel external entities
dictating algorithms or bypassing IETF review via the Independent Stream
Editor, should not be published by the IETF/ISE.

Some of this work for recommending algorithms is already done by the IETF,
for example see RFCa4307/ 8247 and RFC 7321/8221 and I think these kind
of usage documents are within the scope of the IETF. And I believe
recommendations by the relevant WGs such as IPsecME or TLS is where this
kind of work needs to happen, if the end result is the publication of an
RFC.

Paul

> On 10/2/18, 10:57 AM, "saag on behalf of Paul Wouters"
> <saag-bounces@ietf.org on behalf of paul@nohats.ca> wrote:
>
>>
>> I think this group is a better discussion place for this item.
>>
>> Can we add this to the agenda for Bangkok to discuss?
>>
>> Paul
>>
>> ---------- Forwarded message ----------
>> Date: Fri, 28 Sep 2018 15:40:46
>> From: Paul Wouters <paul@nohats.ca>
>> Cc: IETF <ietf@ietf.org>
>> To: Russ Housley <housley@vigilsec.com>
>> Subject: Re: nation state crypto profiles -
>> draft-jenkins-cnsa-cmc-profile-00
>>
>> On Fri, 28 Sep 2018, Russ Housley wrote:
>>
>>> That thread came to the conclusion that the IETF should not process
>>> profiles
>>> for any nations states.   In my opinion, there is value in making it
>>> easy for
>>> implementers to find such profiles.  So, if the Independent Stream
>>> Editor is
>>> willing to process such profiles, they can be published as RFCs, which
>>> would
>>> not consume any resources from the IETF leadership.
>>
>> I do not agree the thread came to that conclusion. I see people
>> disagreed and stop the discussion, because everyone agreed the
>> draft in question to make Suite B historic was not disputed.
>>
>> People outside the IETF do not understand the subtleties of different
>> IETF streams, and having an RFC is seen as a stamp of approval of
>> the international community. Therefore, I do indeed believe we should
>> not make the same mistake again.
>>
>> The USG seems to be doing a fine job making FIPS publications available
>> without these being enshrined in RFCs.
>>
>> I am against the IETF publishing CNSA or any other nation state
>> cryptography profiles.
>>
>> Paul
>>
>> _______________________________________________
>> saag mailing list
>> saag@ietf.org
>> https://www.ietf.org/mailman/listinfo/saag
>
>